Dan Matlick is the director of Cyber Mission & Operational Technology at Accenture Federal Services
Autonomous adversaries are targeting the operational systems behind government missions. Defending them requires real-time asset intelligence, software supply chain visibility, and cyber resilience at machine speed.
For more than two decades, traditional Information Technology (IT) security has consumed the vast majority of federal cyber budgets. While critical, this imbalance has left the physical controllers governing water treatment facilities, military hospitals, and national power grids partially exposed. As the digital and physical worlds converge and advances in AI expose vulnerabilities in Operational Technology (OT), cyber incidents are shifting from enterprise network disruption to direct, real-world physical consequences, potentially compromising critical infrastructure safety and mission-critical operations.
Today, advanced persistent threat groups are actively weaponizing this blind spot. The Cybersecurity and Infrastructure Security Agency (CISA) has repeatedly warned that, for years, they have been tracking and mitigating hostile actors who are pre-positioning themselves within U.S. critical infrastructure. Connecting isolated industrial control systems to enterprise networks drove operational efficiency, but it inadvertently bridged secure, air-gapped industrial networks with the heavily targeted public internet. The CISA warnings are no longer predictive projections of future risk; they are active, present-day post-mortems. As daily breaches continue to pop up across federal networks and municipalities, the threat is no longer “a matter of time”, the exploitation window is already open, and adversaries are executing machine-speed disruption against our critical infrastructure in this very moment.
Legacy OT infrastructure was never built to withstand modern adversarial tradecraft, and when exposed to AI-driven exploit chains and rapid lateral movement, the results could be catastrophic. The Department of War’s recent mandates prioritize the immediate modernization of critical infrastructure defenses – explicitly demanding a shift away from passive monitoring to AI-enabled defense.
The next era of cyber defense is proactive, persistent and AI-powered. Federal teams need to hunt threats at machine speed, eliminate attack paths, and deploy precision S countermeasures before an adversary can manipulate physical controls.
Illuminating the Blind Spots
You cannot fully protect what you cannot see, even in a Zero Trust model.
The foundational step in modern extended Operational Technology (xOT) defense is establishing absolute visibility across the cyber-physical ecosystem. While Zero Trust controls such as continuous authentication, least privilege, segmentation, and policy enforcement provide resilience by limiting what an unknown or compromised asset can do, those controls are not a substitute for comprehensive visibility.
Visibility allows us to discover gaps; zero trust limits the impact when those gaps inevitably occur.
Many federal agencies lack a complete inventory of the industrial devices operating within their facilities. By leveraging advanced asset intelligence platforms, security teams can conduct comprehensive exposure assessments without risking operational downtime. Pulling in existing IT, OT, and cloud asset data allows defenders to safely identify undocumented hardware, rogue connections, and shadow IT infrastructure seamlessly.
Discovering the physical device is the first step. To achieve total supply chain security, agencies must also illuminate the code running inside those devices.
By integrating deep firmware analysis, agencies gain unprecedented visibility through automated Software Bill of Materials (SBOM) generation. In alignment with CISA’s global standardization mandates, utilizing the universal SBOM framework ensures machine-readable formats across critical infrastructure. This technology dissects industrial firmware to identify hidden vulnerabilities and hardcoded credentials, enabling security teams to continuously map firmware components against known CVE databases to proactively assess and prioritize mission risk before adversaries can exploit it.
Unifying the Mission Platform
Visibility alone does not stop an attack. Federal agencies must be able to detect active threats and execute automated remediation at scale. Managing isolated dashboards leads to crippling alert fatigue; analysts require a centralized control plane that contextualizes threats and provides immediate, actionable remediation steps that can be automated to address certain rapid response needs
This is why the recent industry-wide shift toward unified cyber-physical security platforms is a watershed moment for critical infrastructure defense. By consolidating asset visibility, firmware analysis, and AI-enabled industrial-specific threat detection into a single, cohesive extended OT (or xOT) operating model, defenders can finally view and defend their entire environment without relying on fragmented, disjointed point solutions.
When an anomaly is detected, analysts are not just handed a generic alert; they receive detailed, context-rich threat intelligence.
This unified approach allows federal agencies to focus on Time to Safe State (TTSS) – the time from the first indication of a cyber or AI-driven compromise to restoring the affected critical process to a verified safe operating state. In an AI-speed threat environment Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are less relevant when dealing with critical infrastructure. The Key Performance Indicator (KPI) that we should now focus on is how quickly we can get the operation back to a verified safe state.
Securing critical infrastructure requires a vastly different approach than securing a traditional digital network. By unifying asset discovery, software supply chain security, and AI-enabled threat detection modeled specifically for industrial control systems, government and industry can work together to ensure that the essential systems our country and communities depend upon remain resilient under pressure.
Throughout October, in recognition of Cybersecurity Awareness Month, WashingtonExec will feature op-eds from GovCon cybersecurity experts exploring emerging threats, evolving technologies, challenges shaping the field and practical strategies for strengthening cyber defenses.