AI-driven security strategies fail in industrial environments not because the AI is inadequate, but because critical OT telemetry never reaches it. Fewer than 10% of OT networks have meaningful monitoring. Key pitfalls include: AI models trained on IT traffic misclassifying normal industrial protocols like Modbus or PROFINET as threats; automated response playbooks that can shut down production lines; and active scanning tools that crash legacy PLCs. The recommended approach is to first inventory crown-jewel processes, segment networks to isolate OT from IT, then deploy passive monitoring to capture Purdue Level 0–2 traffic before layering any AI on top. A ransomware tabletop exercise illustrates how a phishing email can reach PLCs via a contractor's laptop in under 30 minutes, and how bridging IT/OT cultural divides is as important as any technical control.
