Agentic Threat-Informed Defense for Secure Operational Control (TIDSOC): An Imperative

Historically, these systems were isolated, air-gapped from enterprise networks, and secured through physical measures (NIST SP 800-82, 2023). However, the drive for smarter infrastructure, operational efficiency, sustainable manufacturing, remote management, and data-driven business insights has seen an unprecedented convergence of IT and OT systems (Accenture, 2023). As IT and OT systems continue to converge and become even more interconnected, the control of physical processes remains a relatively unique and critical concept of OT. While this integration unlocks significant value, it has concurrently dismantled the traditional security assumptions of isolation and security through obscurity exposing critical OT environments to the full spectrum of cyber threats previously confined to the IT domain.

Furthermore, many older or legacy OT devices remain in operation for years without receiving critical security updates or patches, either because their vendors no longer support those systems, or because the vendors themselves have long since gone out of business. Traditional security tools also present numerous issues related to their resource-intensive monitoring and management features that can pose a direct risk to process stability (Claroty, 2023). These systemic vulnerabilities have not gone unnoticed by threat actors. The cybersecurity landscape for Industrial Control Systems (ICS) has evolved from facing generic malware to combating sophisticated, state-sponsored Advanced Persistent Threats (APTs) and specialized cyber-criminal groups (MITRE ATT&CK for ICS, 2023). These adversaries demonstrate a deep understanding of industrial processes and the specific weaknesses. They leverage this knowledge and more recently the power of AI (AI Attack Staging, AML.TA0001) to orchestrate and execute multi-stage attacks designed for stealth, persistence, and maximum operational impact, as mapped by frameworks like the MITRE ATT&CK® for ICS and MITRE ATLAS. Their tactics, techniques, and procedures (TTPs) often involve abusing the inherent trust within OT protocols for reconnaissance, lateral movement, and the manipulation of physical processes in complex environments.

Adversarial Operations in OT Environments

The critical environments that underpin global critical infrastructure to enable free trade, manufacturing, and global supply chain represent a complex and increasingly vulnerable cyber-physical frontier. The consequences of this systemic exposure have been repeatedly demonstrated through a series of high-profile cyberattacks that transcended digital boundaries and caused tangible operational disruption. In particular, these attacks stand out:

1. The TRISIS/Triton malware attack on a Saudi Arabian petrochemical facility in 2017 specifically targeted Schneider Electric’s Triconex Safety Instrumented System (SIS), aiming to disable safety mechanisms and induce physical damage—representing a deliberate convergence of cyber intrusion and process control manipulation.

2. The Havex Remote Access Trojan (RAT), deployed in campaigns against European and North American energy sectors, infiltrated industrial control environments under the guise of legitimate software updates, exfiltrating configuration data and establishing persistent access for future compromise.

3. More recently, the 2021 Colonial Pipeline ransomware attack, though initiated within the IT enterprise network, demonstrated how the shutdown of critical energy transportation infrastructure across the U.S. East Coast — could cause macroeconomic and national security implications beyond just monetary or reputational damage that companies incur after a cybersecurity incident (Mandiant, 2021; Colonial Pipeline Company, 2021).

4. During the 2023–2024 Log4J vulnerability crisis, incident responders discovered not only exposed Java services but also hundreds of BACnet devices “leaking” onto the public internet due to misconfigured routing and a lack of segmentation (DIVD, 2023). This demonstrated that discovery and management failures in BAS can amplify the impact of unrelated IT security events, compounding risk across organizational boundaries.

5. In 2023, the MGM Resorts International breach further exposed the fragility of hybrid IT–OT architectures within large-scale operational environments. Attackers exploited a social engineering vector—impersonating IT personnel via a helpdesk call—to gain privileged access to Active Directory and downstream operational systems. The resulting disruption extended beyond hotel IT systems to physical operations including casino floor systems, digital room access, and payment terminals losing $8 Million a day. This incident underscored how modern threat actors exploit human and procedural weaknesses to pivot from enterprise infrastructure into operational assets with cascading financial and reputational consequences (CISA, 2023; Volexity, 2023).

Rise of Covert Channels and Protocol Abuse

Today’s OT threat landscape has evolved significantly from the earlier, more direct and overt forms of cyberattacks spreading to influence kinetic operations. Notable examples include the Russian operations against Ukraine’s power grid in 2015 and 2016, where intrusions relied on visible, disruptive techniques to compromise industrial control systems. In contrast, contemporary OT-focused adversaries increasingly adopt subtle, covert, and persistence-oriented methods aimed at infiltrating a nation’s critical infrastructure while remaining undetected for extended periods. This shift reflects a strategic intent to establish latent access and prepare operational environments for potential future use—such as in the event of armed conflict between states—where pre-positioned capabilities can be rapidly weaponized with significant impact and magnitude.

In 2024, the Cybersecurity and Infrastructure Security Agency(CISA)  discovered  that Chinese state-sponsored Advance Persistent Threat(APT) Volt Typhoon (also known as Vanguard Panda, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, and Insidious Taurus) had compromised the IT environments of multiple critical infrastructure organizations—primarily in Communications, Energy, Transportation Systems, and Water and Wastewater Systems Sectors—in the continental and non-continental United States and its territories, including Guam. Volt Typhoon uses a technique known as Living Off the Land(L.O.T.L.) which derives from the LOLBins, or “Living Off the Land binaries” which  are legitimate, pre-installed executable files on an operating system (like Windows) that threat actors misuse for malicious purposes.

L.O.T.L. techniques represent a new and insidious frontier in advanced state-sponsored cyberattack campaigns and are characterized by a lengthy reconnaissance phase to study the victims network infrastructure and abuse legitimate OS tools to avoid raising red flags from traditional rule-base and alert-base security tools. According to CISA, L.O.T.L. techniques are not merely a way to conduct extensive and persistent cyberespionage campaigns against the U.S. and its critical infrastructure, but rather have been observed to be a strategy to preposition and laterally move from the IT environment to the OT infrastructure(CISA, 2024). This strategy would imply that adversaries of the U.S. and its allies are slowly but steadily infiltrating the OT substrate in order to weaponize critical infrastructure in the event of escalating tension between the two nations. In the case of Volt Typhoon, the threat group remained undetected for approximately five years, raising serious concerns about how many state-backed threat actors may currently be infiltrating—or may already have infiltrated—the OT layers of critical infrastructure (CISA, 2024).