OTCC joins NVTC Cyber Summit panel on protecting critical infrastructure from automated exploits

AI is changing the pace of cyber threats against critical infrastructure. Attackers can now find and exploit weaknesses at machine speed, and the people defending power grids, hospitals, and other essential services are under pressure to keep up.

That was the focus of "Protecting Critical Infrastructure from Automated Exploits," a panel at the Northern Virginia Technology Council's (NVTC) 2026 Cyber Summit & Cyber50 Awards on October 28 in McLean, Virginia. OTCC Executive Director Tatyana Bolton joined Paul Curylo, CISO of Inova Health System, and Sean Stalzer, CISO of Dominion Energy, for a discussion moderated by Shawn Kingsberry, Vice President at SAIC.

Defending at machine speed

This year's summit was built around the theme "Cyber at the Speed of AI," and the panel took that idea into the operational world. When an intrusion reaches an operational technology (OT) environment, the consequences go well beyond stolen data. They can mean a disrupted grid, a hospital system knocked offline, or equipment that stops working as designed.

The panel brought together perspectives from across that landscape: an energy utility, a regional health system, a federal technology integrator, and a coalition working across the full OT lifecycle.

On the agenda

The session focused on the areas where OT defenders are feeling the most pressure:

• Legacy industrial systems. Much of the equipment running critical infrastructure was designed decades before today's threats and can't always be patched or replaced quickly. As automated tools make weaknesses easier to find, those systems carry growing risk.

• The IT/OT boundary. As IT and OT networks become more connected, the line between them becomes a critical point of defense. Zero Trust segmentation is one way to keep an intrusion on the IT side from reaching the systems that control physical operations.

• AI-enabled detection and autonomous monitoring. If attackers are using automation, defenders need it too. AI-driven detection and continuous monitoring can help teams spot threats faster than they could on their own.

• Evolving federal requirements. Security expectations for critical infrastructure continue to shift. Operators need requirements that are clear, consistent, and grounded in how OT actually works.

• Workforce gaps. Many critical infrastructure operators, especially smaller ones, don't have large security teams. Automation can help resource-constrained organizations get more out of the people they have.

"Automated attacks move faster than most OT environments were ever designed to handle," said Tatyana Bolton, Executive Director of OTCC. "Operators need tools that can keep pace, a clear line between IT and OT, and federal requirements that strengthen security instead of adding to the paperwork."

Keeping pace

For OTCC, these issues connect directly to our policy work. In our position paper, A Unified Approach to OT Cybersecurity, we called on policymakers to recognize ISA/IEC 62443 as the global standard for OT cybersecurity, so operators can focus on security outcomes instead of a patchwork of overlapping mandates. We've also urged CISA to issue a Binding Operational Directive for OT cybersecurity that would give federal agencies clear baseline requirements, from asset inventory and configuration baselines to backup and recovery.

Thank you to NVTC for hosting, to Shawn Kingsberry for moderating, and to Paul Curylo and Sean Stalzer for joining the conversation.