CISA Issues New AI Security Guidance for Critical Infrastructure

CISA, alongside international partners, released guidance on integrating AI into operational technology (OT) that supports critical infrastructure, warning that widespread generative AI use and increased IIoT connectivity heighten risks such as model manipulation, safety-process bypasses, and prompt injections. The bulletin urges owners and operators to understand AI risks, assess OT-specific use cases and data handling, establish governance and assurance frameworks, and embed safety and security into AI-enabled systems—leveraging traditional controls (access control, auditing, encryption), integrating AI into incident response, and starting with small, secure pilots to address skill gaps and mitigate evolving threats.