AI and the OT Visibility Problem, You Can't Automate What You Can't See

Industrial security teams are asking the wrong question about AI. The debate is framed as "How much should we let AI do on its own?" The better question is "What exactly would it be acting on?"

Honeywell's newly released 2026 OT Cybersecurity Benchmark Report, a survey of 603 industrial security leaders, shows AI is already in the plant: 72% use it for threat detection and 68% for continuous monitoring. Only 23% let it act autonomously. Most coverage treats that 23% as the headline. We think the more important number is buried further down: only 21% of organizations have a complete OT asset inventory.

That is the real story for manufacturers, utilities and healthcare operators. AI does not fix a visibility problem. It scales whatever foundation you give it, good or bad. Here is how we think about AI in operational technology security at InfoSight, and what to do before you hand any more decisions to a machine.

Why OT teams are right to hesitate on autonomy
Caution about autonomous AI on the plant floor isn't fear of new technology. It's sound engineering judgment. In IT, a wrong automated action usually means a locked account or a quarantined laptop. In OT, a wrong automated action can stop a production line, trip a safety system or disrupt patient care.

Three realities make OT different:

• Uptime is the mission. Honeywell's respondents reported an average of 16.2 hours of downtime per significant OT incident, and 21% put losses above $100,000 per hour. An AI that isolates the wrong PLC can cause the very outage it was meant to prevent.
• Legacy systems don't behave like laptops. Controllers, HMIs and historians often run decades-old firmware and proprietary protocols. "Normal" traffic looks strange to models trained on enterprise networks, which drives false positives.
• Context lives in people's heads. Whether a new connection is an attack or a scheduled vendor maintenance window is often known only to the controls engineer on shift.

Honeywell put it plainly: "As AI moves from assisting analysts toward taking action, organizations will need clear decision rights, human oversight and testing." We agree, and we'd add that decision rights mean little if nobody can say which assets the AI is deciding about.

The bigger risk: confidence that outruns visibility
The most dangerous finding in the report isn't about AI at all. It's that 88% of industrial organizations rate their OT security program as mature, while the fundamentals tell a different story:

Source: SecurityWeek on Honeywell's 2026 OT Cybersecurity Benchmark Report

Put that next to the AI numbers and the problem is clear. Teams are layering AI detection onto environments where most assets are uninventoried and most OT traffic never reaches the SOC. An AI model can only flag what it can see. Everything else is a blind spot, now with a confident dashboard on top.

Attackers know this. Ransomware crews and state-linked groups deliberately target the seams between IT and OT: the remote access path a vendor uses, the engineering workstation that bridges both networks, the building system nobody owns. Those are exactly the areas the survey says are least monitored. And the same AI tools defenders are adopting are helping adversaries scan, phish and move faster.

The risk isn't that AI will act too boldly. It's that organizations will believe they're covered because AI is running, when the foundation beneath it is incomplete.

How InfoSight approaches AI in OT: Powered by AI, Fueled by Experts
We use AI where it's strongest: sorting huge volumes of telemetry, correlating weak signals and surfacing what matters in seconds. We rely on experienced analysts where judgment matters most: deciding what an alert means for your operation and what action is safe to take.

That's the "Powered by AI, Fueled by Experts" model, and it's built for environments where a wrong move has physical consequences.

In practice, it looks like this:

1. See it first. Our Industrial Control & IoT Security Assessments build the asset inventory and network map that fewer than one in four organizations have today. Every downstream decision, human or AI, depends on it.
2. Bring OT into the SOC. 24x7 ICS/SCADA MDR feeds OT telemetry into our U.S.-based, 24/7 SOC-as-a-Service, so plant-floor activity is watched alongside IT, not in a separate silo.
3. Let AI triage, let analysts decide. AI-driven detection filters noise and prioritizes threats. Our analysts validate them against your operating context before anything is escalated or contained, following response playbooks agreed with your engineering team in advance.
4. Prove it works. Purple Team testing and SCADA/ICS penetration testing show whether your detections, AI-driven or not, catch real attacker behavior.
5. Govern the AI itself. Our AI Governance & Exposure Assessment helps you define the decision rights, oversight and testing Honeywell calls for before autonomy expands.

Autonomy can be earned. It should be granted one well-understood use case at a time, on assets you can see, with playbooks you've tested. That's how trust in AI gets built on the plant floor.

Five questions to answer before you expand AI in OT

Before adding more AI, or giving it more authority, work through these with your security and operations leaders:

1. Can we name every connected asset in our plants and facilities? If not, start with an inventory. AI can't protect what isn't on the list.
2. Does our SOC see OT traffic, or only IT? If OT alerts go to a separate console, or nowhere, integration comes before automation.
3. Who decides what the AI is allowed to do? Write down which actions are automatic, which need analyst approval and which need an engineer's sign-off.
4. Have we tested our detections against real attack techniques? A purple team exercise will show where AI catches threats and where it stays quiet.
5. What does an hour of downtime cost us? With 21% of Honeywell's respondents above $100,000 per hour, that number should anchor every investment and automation decision.

If any answer is "we're not sure," you're in the majority, and you have a clear place to start.

Start with visibility
AI will reshape OT security. Nearly every leader in Honeywell's survey (99%) expects it within two to three years. The organizations that benefit most won't be the ones that automate first. They'll be the ones that can see their environment clearly enough to trust what their AI tells them.

Talk to an InfoSight OT security expert about an Industrial Control & IoT Security Assessment. We'll show you what's on your network, what your SOC can and can't see, and where AI can safely take on more of the load.