By Rob Demain, CEO at e2e-assure
An industrial operator should be able to answer three questions about the AI helping to defend its estate. Who can see the operational data? Who authorises a response? And what keeps working if an external service becomes unavailable? These are all practical questions about control. As AI becomes part of security operations, they belong alongside the questions operators already ask about safety, availability and dependence on suppliers.
AI can give security teams greater reach. But in an industrial environment, its value depends on understanding the plant, recognising the early stages of an attack and helping people act without making the situation worse.
Much of the discussion about AI in the SOC centres on triaging alerts, summarising investigations and recommending actions. That is useful work. But AI that only examines existing alerts inherits the gaps in the detections that produced them. If important activity never triggers an alert, a better summary will not help.
The greater opportunity is to examine events as they arrive and connect behaviour across the estate: an unfamiliar process on an engineering workstation, an identity appearing on an unusual host, or a remote-access session reaching into the control network. Individually, these may be legitimate. Together, in the wrong sequence, they may reveal an intrusion before it causes operational damage.
Behavioural analysis adds another way to recognise attacks whose tools or infrastructure are unfamiliar. It needs to work alongside established detections, with enough operational context to distinguish suspicious activity from normal engineering work.
That context matters particularly in industrial environments. Equipment may remain in service for decades. Patches can require supplier approval and extensive validation. Maintenance windows may be infrequent, and active scanning can disrupt sensitive devices. Passive monitoring provides visibility without interrogating those systems, supplemented by logs and other telemetry where collection is safe.
The same discipline must govern response. Isolating the wrong engineering workstation or interrupting a control connection can affect production and potentially safety. AI should accelerate investigation and preparation, while actions that could affect the process remain under explicit operator control.
There is room for automation within tested, pre-authorised boundaries. High-impact actions need clear authority, an understood operational consequence and a recovery plan. Reversing a technical change does not necessarily reverse its physical effects.
The AI itself also needs defending. A model reading logs, filenames or network content is handling input an attacker may influence. Prompt injection is therefore a design concern, not a theoretical objection.
The safeguards must extend beyond the model: bounded tasks, restricted permissions, controlled external access and separation between analysis and execution. Findings should point back to source evidence, with deterministic checks confirming facts wherever possible. Agreement between models can support review, but it is not proof.
Nor should an unfamiliar finding need an existing detection rule to agree before an analyst can see it. That would defeat the purpose of looking beyond known patterns. The system should distinguish verified observations from hypotheses and make uncertainty visible. The underlying telemetry must remain protected and auditable, independently of the AI’s interpretation.
Sovereignty brings these requirements together. Operators need control over where sensitive evidence is processed, who can administer the service, which jurisdiction applies and which dependencies could interrupt protection.
For some environments, that means local inference. For others, an appropriately governed UK-hosted service may meet the requirement. Either way, external model availability should not become an unexamined dependency for essential detection. Frontier models can contribute to approved tasks, with deliberate limits on the information shared.
Context comes from accurate knowledge of the estate. A locally hosted model still needs reliable evidence about assets, identities, communications and operational dependencies.
That knowledge also supports earlier intervention. A maintained model of the estate can help identify plausible routes from compromised IT systems towards operational assets, compare mitigations and prioritise engineering work before an attacker exploits those paths. Its assumptions and blind spots must remain visible. Simulation can inform a decision; it cannot certify that a change is safe on the real plant.
The national direction is encouraging. The government’s £1.1bn AI Hardware Plan includes a national AI supercomputer planned for deployment in 2030. NCSC and DSIT are also developing Cyber Shield, bringing industry and CNI organisations into work on national-scale AI cyber defence.
Operators should engage with that work while improving their own defences now. A sovereign AI SOC should deliver earlier warning, stronger investigations and dependable protection under the operator’s control. Its success should be judged by how effectively it helps people protect the plant.
