How Do You Secure OT When AI Writes the Malware?

When agentic AI can write attack code and deploy it autonomously, securing OT networks requires removing the inbound attack surface entirely. At Hannover Messe 2026, Skkynet CEO Gary Tillery describes how the company’s outbound-only architecture does exactly that: Skkynet’s Cogent DataHub platform keeps all inbound firewall ports closed across more than 30,000 installations in 86 countries, according to the IIoT World Hannover Messe 2026 digital booklet. The technology, developed over more than 25 years, moves data from edge to cloud, edge to edge, and OT to IT through outbound connections only, and translates older protocols like Modbus to modern standards including MQTT and OPC UA.

Why Does AI-Written Malware Hit OT Networks Harder?

OT networks are especially susceptible to AI-driven cyberattacks because of the direct control they exercise over physical processes in production environments. That control is the primary reason OT environments face elevated risk, and AI is compounding the problem.

One estimate puts 80% of ransomware as AI-written. The concern extends beyond malware generation: agentic AI can both write the attack code and use bots to deploy it against targets. “You’re going to have agentic AI writing code, but also using those bots, maybe to attack your network,” Gary Tillery said at Hannover Messe 2026.

Skkynet has not recorded any AI-driven attacks against its customers so far, but the topic is under active internal discussion. The broader industry is also paying closer attention: a recent article published on IIoT World says that only 19% of manufacturers plan to invest in OT cybersecurity during automation projects, a gap that AI-powered threats could widen.

How Does Outbound-Only Architecture Eliminate the Primary Attack Vector?

Outbound-only architecture secures OT data by allowing information to leave the production network through outbound connections only, without opening any inbound pathways. The key differentiator: no inbound connections means no inbound attack surface for the OT network.

Skkynet’s technology, delivered through its Cogent DataHub platform, has operated on this model for over 25 years. Enterprise users include ABB, Siemens, and Schneider Electric, according to the IIoT World Hannover Messe 2026 digital booklet.

The system supports three primary data pathways: edge to cloud, edge to edge, and edge to IT. For manufacturers running older equipment, the platform translates legacy protocols, including Modbus, into MQTT and OPC UA.

Skkynet also supports hardware data diodes, which traditionally enforce one-way data flow. Even with data diodes in place, Cogent DataHub allows bidirectional data exchange while maintaining the outbound-only security posture. The company recently secured a CA$2.6 million government-funded initiative to extend this architecture specifically for AI workloads.

Why Do IT Security Models Fail in OT Environments?

IT security practices fail in OT environments because approaches that work on the IT side, particularly patching, operate very differently on production networks. The pattern is common: organizations apply IT security directly to the OT network, but it does not always fit.

That mismatch is where outbound-only architectures gain their relevance. Rather than adapting IT security models to an environment where they may not fit, the approach removes inbound access to the OT network entirely. The security comes from the architecture itself: no inbound connections means no inbound attack surface.

Why Should Each Manufacturer Build Its Own Architecture?

Each manufacturer should design a custom architecture because every operation is different and at a different stage, making copied approaches a poor fit. Organizations also carry the weight of past failed projects that can make teams hesitant to engage with new initiatives.

Getting the organization behind the initiative matters because previous failures shape how teams respond to new projects. The recommendation: build the architecture with knowledgeable people, custom to the specific problem and environment. Then look at technology companies to address security, data translation, and connectivity needs. The sequence is architecture first, technology selection second.

Skkynet exhibits at Hannover Messe 2026 in Hall 27, Canada Pavilion, stand A12. 

This article is based on a video interview with Gary Tillery, CEO of Skkynet, and Greg Orloff of IIoT World, recorded at Hannover Messe 2026. AI tools were used to help summarize and organize the content. Reviewed and edited by the IIoT World editorial team.

Editorially independent. Sponsored by Skkynet.