Lessons OT Security Must Learn from the Hype Cycle

OT has been sold two big dreams — and both have left scars. First, it was asset discovery. Now it’s GenAI/LLMs. Both created hype, both promised shortcuts, and both left asset owners with a false sense of security.

The first wave was asset discovery. Marketing promised instant visibility and full assessments out of the box. The reality couldn't have been more different. These tools couldn't discover everything, couldn't provide true risk assessments, and left operators with a dangerously high level of false confidence.

Asset owners who bought into this hype early have since learned the hard way. To get anywhere close to the promised outcomes, they invested heavily in network restructuring, bringing assets online, and recognizing that not everything can be discovered passively. Even then, the data these tools produced wasn't usable on its own; it needed another layer of solutions and expertise to turn raw visibility into actionable results for security and operations.

The second wave came with GenAI and LLMs. For almost two years now, they've been marketed as the “silver bullet” that will magically fix every problem we face. Riding the global AI trend, OT vendors painted a picture of cloud-based, GPU-heavy LLMs transforming the field overnight.

The reality is very different. In the last two years, while advising supply chain and Cybersecurity startups, I've watched ideas die before they could take root, and others collapse shortly after launch. Why? Because what they spent months building suddenly became available off the shelf in commercial AI platforms. Additionally, many startups rushed into the wave, believing GenAI was “magic,” chasing hype and funding rather than addressing real problems. Instead of building practical tools, they built demos.

And here’s the hard truth: never expect any AI tool to provide you with an accurate OT assessment.

The issues in OT are fundamentally engineering problems and remain quite simple. Over-complicating them with layers of AI hype is a mistake. The correct approach is straightforward: simplify first, then secure the basics.

AI will not run on its own in OT environments, not for at least the next 5 to 10 years. It will always require guidance, validation, and support from human expertise. Some early use cases may emerge in industries such as discrete manufacturing, but in critical infrastructure and process environments, the gap between AI promises and OT realities remains substantial.

The real promise lies in small, local models that are lightweight, deployable at the edge, and designed for the constraints of industrial environments. These models can complement human expertise instead of trying to replace it, and they respect the practical limits of OT. A deeper dive into why I hold this expectation deserves its own article, and I plan to address it in a separate article.

Through both hype cycles, one truth has become clear: OT security will remain consultancy-driven for at least the next 7–10 years. The complexity of environments, the diversity of systems, the obsolescence of ICS systems, and the need for engineering expertise mean there are no shortcuts.

The solutions that succeed will be those that reduce onsite time, lower the skill barrier, and integrate with how plants truly operate not those that oversimplify problems into IT-style checkboxes.

This is also where definitions matter. In OT, an “asset” is not just a count of devices. It is defined by its physical function and its contribution to production. Any vendor still insisting on the IT definition is missing the point. Asset owners need to sharpen their lens.

And above all, look at who is serving your environment. Do they have real ICS site experience? Can they speak from time spent in plants, not just theory and slides? It’s not a shame to interview them directly on what you know, and then let them serve you with what they know.

That’s how trust is built. That's how you separate the true partners from the product pushers.

The marketing cycles will continue. Silver bullets will always be advertised. But engineering power will always prevail.

So ask yourself today:

• Are you building your OT security strategy on hype or on reality?
• Are your partners guiding you with real experience, or selling you the latest buzzword?
• And are you ready to choose trusted advisors who know ICS deeply and can turn complexity into usable outcomes?

Hype fades. Engineering endures. Choose wisely.