Securing the Physical-Digital Frontier: AI for Anomaly Detection in OT, IoT, and Critical Infrastructure

Abstract

This article explores the application of artificial intelligence (AI), particularly agentic and large language model (LLM)-augmented systems, for anomaly detection in Operational Technology (OT), Internet of Things (IoT), and critical infrastructure environments. The study reviews recent academic literature, industry reports, and real-world deployments to compare AI-based detection methods with traditional signature-based and behavioral approaches. It introduces the concept of a defensive operational uplift metric (U = T_manual / T_AI) to quantify how AI reduces the time required for analysts to detect and respond to security incidents.

The paper demonstrates that AI is most effective as a decision-support tool that accelerates threat analysis, correlates data from multiple sources, and improves analyst productivity rather than replacing human decision-making. It also highlights the importance of edge AI deployment, explainable AI, and human-in-the-loop oversight in safety-critical environments. Furthermore, the study discusses emerging challenges, including adversarial AI techniques that attackers may use to evade detection.

Overall, the article provides a comprehensive overview of current AI-driven cybersecurity practices for critical infrastructure and offers practical recommendations for organizations seeking to strengthen cyber resilience through intelligent anomaly detection.