Agentic Cybersecurity Officer for Unattended Critical Infrastructure: An Evidence-Governed Architecture for Cyber-Physical Security
Year: 2026
Type: preprint
Abstract: Selected unattended and lightly staffed energy facilities combine heterogeneous operational technology (OT), remote maintenance, and physical-security signals, often with intermittent central connectivity. This position paper proposes a site-resident Agentic Cybersecurity Officer (ACSO) as a bounded cyber-physical security assistant, not an autonomous plant controller. Local inference correlates observations and supports human incident triage. The OT Security Operations Center (OT SOC) coordinates cross-site assessment while operational control centers retain plant authority. The proposed architecture distinguishes a mediated management path from a hardware-unidirectional evidence-export path, with separately governed collection and external verification. We define trust assumptions, limits on actionable authority, reconnect behavior, and precise boundaries of cryptographic evidence claims. We also specify testable comparisons against rule-based monitoring and alternative evidence anchors. The architecture has not been implemented, and its proposed benefits remain empirically unvalidated. Publication context Independent research companion to the presentation From Trust to Proof: Blockchain-Anchored File Integrity for Critical Infrastructure Operators, scheduled to be presented by Arslan Brömme at the 4th Annual Energy & Utilities Cyber Security Forum in Amsterdam, 25–26 November 2026.
Author: Brömme, Arslan
Language: English
Subfield: Control and Systems Engineering
Field: Engineering
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225651729
Cites:
Cited by:
Related to: