OT Threat Signal: Adversarial AI Tests Your OT Remote Access First. Here's How to Make It Hold.

Dragos's September 30, 2026 Senate testimony shows adversarial AI lowering the barrier to attack and steering attackers to the IT/OT access layer. The defense is the existing playbook, starting with SANS ICS Control 4, Secure Remote Access. Judge any OT remote access solution on whether it leaves a stable endpoint, relies on passwords alone, stops evaluating at login, or leaves sessions unexplained. 

Earlier this year, an attacker broke into the IT network of a municipal water utility in Monterrey, Mexico. They had no apparent OT skill. They were using a commercial AI model to help run the intrusion. 

Nobody told the model to look for control systems. It found an internally reachable interface to the utility's OT anyway. It flagged that interface as a high-value target and launched a tailored credential attack against it. 

Roughly 2,800 login attempts were rejected. The attacker never reached a single industrial system. The IT/OT boundary held. 

That case anchors the written testimony Kurt Gaudette, Senior Vice President of Intelligence & Services at Dragos, gave a U.S. Senate Homeland Security and Governmental Affairs subcommittee on September 30. I've read it twice. If you own OT security, run a plant, or get the 2 a.m. call when a vendor can't connect, it's worth your time. If you're choosing or rethinking an OT remote access solution, it should change how you evaluate one. 

What Dragos Told the Senate 

Here's my read, in three points. 

• Adversarial AI lowered the floor. Dragos says adversarial AI cuts the knowledge and cost of attacking critical infrastructure. It hasn't, to date, raised the ceiling of what attackers can do against a well-defended OT environment. Work that once took a patient specialist can now be attempted by far less-skilled actors. And in at least one case, the model itself steered an IT-focused attacker toward OT. 

• The access layer is where they arrive. Both AI-assisted intrusions Dragos described hit the access layer. In Monterrey, it was a login interface at the IT/OT boundary. At a gas utility, it was a compromised internet-facing firewall, accessed with valid admin credentials. Dragos says the flaws that matter most sit in jump hosts, firewalls, and access points. One threat group it tracks could weaponize a new vulnerability in 24 to 48 hours before adopting AI. With AI, Dragos expects that window to shrink toward minutes. 

• Prevention alone fails eventually. When it does, you need to know what happened. Dragos estimates fewer than 10% of OT environments have visibility and monitoring in place. Without it, you can't find root cause or restore with confidence. 

Keep this in proportion. Neither intrusion reached OT. Dragos is not aware of a confirmed case of AI-generated malware causing physical impact to an industrial process. The adversarial techniques are the same ones we've defended against for years. The speed is new. 

Gaudette's conclusion is the line I keep coming back to: "defense is doable." What adversarial AI changes is urgency. Teams without basic controls are already at much greater risk, and that risk is climbing fast. 

Why I'd Start with Remote Access 

Dragos told the Senate to start with the SANS 5 ICS Cybersecurity Critical Controls. Secure Remote Access is Control 4 by name. After this testimony, it's also the control adversarial AI tests first. 

The payoff is measurable. According to the Dragos 2025 OT Security Financial Risk Report, defensible architecture is associated with up to a 17% reduction in OT cyber risk, and secure remote access with about a 12% reduction. 

Here's the friction I hear about often when talking to OT teams we work with. A VPN tunnel stays open because tearing it down means a ticket next week. A jump host sits unpatched because patching means downtime nobody will approve. A vendor can't get through the login process, so someone texts them the shared password. 

Each of those workarounds made sense to the person who built it. Each one is also a stable, reachable, password-protected door. That's the exact profile the Monterrey AI model went looking for. 

Seven Questions to Ask of Any OT Remote Access Solution 

If you're evaluating a new OT remote access solution, or deciding whether your current one holds up, these are the questions I'd put on the table. Each maps to something Dragos described. 

1. Is there a stable endpoint to find? 

The Monterrey AI model found the OT interface because it was there to find. Anything reachable at a persistent address will be discovered. The only question is when. Ask whether the remote access architecture leaves anything stable to scan between sessions. 

At Dispel, Moving Target Defense eliminates that stable target. It continuously rotates ephemeral pathways, so there's no persistent IP to discover or return to. 

2. Can a password alone open a pathway? 

Monterrey held because none of the passwords the attack tried were valid. Dragos assesses that default vendor credentials or weak passwords could plausibly have let the intrusion progress further. Don't build your boundary on that margin. 

Require MFA, approval workflows, and just-in-time access windows. Together they eliminate standing access, so a guessed or stolen password opens nothing on its own. For high-risk crown-jewel assets, Dispel Identity's IAL2 verification ensures the right person is logging in. 

3. Does trust end at login? 

The gas utility attacker logged in with valid admin credentials. Authentication is where trust starts. Ask how the solution keeps evaluating the session after that. 

Dispel Intelligence eliminates blind trust in approved users. It scores behavior, device, and connection for the life of the session and surfaces a stoplight risk score your team can act on. 

4. Is it another appliance you have to out-patch? 

If exploit windows shrink toward minutes, patch cadence on perimeter VPNs, firewalls, and jump hosts can't keep pace. Ask whether a solution adds another appliance to your perimeter or removes one. You can't out-patch a minutes-long window. You can remove the target. 

5. Can you limit who reaches devices that will never be patched? 

Dragos sorts vulnerabilities into Now, Next, and Never. It puts 60 to 70% of OT vulnerabilities in Next: meaning they need compensating controls or a place in the queue. Some devices will never get a fix. 

Role-scoped, just-in-time access eliminates open-ended reach to those devices. For the highest-risk work, the Dispel Zero Trust Engine isolates the session in a disposable environment. 

6. When prevention fails, can you explain what happened? 

Dispel Intelligence's Session Forensics eliminates the session blind spot. Every remote session is scored, recorded, and ready to explain, so root cause is a replay instead of a reconstruction. If a session turns risky mid-stream, Response & Remediation can end it in real time. 

Be clear-eyed about scope. Session-level visibility complements network monitoring from partners like Dragos and Nozomi Networks. Control 3 still needs its own tools. 

7. Can you deploy it without a redesign? 

Dragos told the Senate that small utilities need resources for foundational controls. The constraint is budget and staff. A remote access project that requires a network redesign won't get off the ground at a lean utility. 

Dispel's Rapid Deployment eliminates that barrier, with a "Do no harm" approach with no intrusive agents, no network redesign that is live in hours. 

Make the Playbook the Easy Path 

None of this is new. That's the point. 

The utility in the Monterrey attack held because a basic control worked. Nothing exotic. Gaudette's message to the Senate was simple: we have the playbook, so run it, and run it now. 

Knowing the playbook is the easy part. Following it at 2 a.m. with a line down is harder. That's where friction decides the outcome. If the secure path is slower than the workaround, the workaround wins, and adversarial AI will find it. 

So make the secure path the fast one. When a vendor connects in seconds through a governed, recorded, just-in-time pathway, nobody needs to text an operator for the shared password. Security gets enforced controls. Operations gets the line back up. Compliance gets the evidence automatically. 

When friction disappears, the sanctioned path becomes the fastest path. 

Control 4 is the control adversarial AI tests first. Dispel makes it the control that holds. 

If you're weighing an OT remote access solution against these seven questions, speak to an expert. I'd rather you pressure-test us now than find the gap later. 

Secure Remote Access: A Critical Control for Modern Risk  

Secure remote access with a defensible architecture delivers more than 30% risk reduction, according to the Dragos 2025 OT Cybersecurity Financial Risk Report — and it's exactly what SANS ICS Control 4 calls out as a critical safeguard for OT cybersecurity. → Download the SANS report