AJ Eserjose, Regional Director, OT-ISAC

Markus Mueller, Field CISO, Nozomi Networks

Frontier AI models are beginning to change the economics of offense — accelerating vulnerability discovery, generating exploit paths, automating reconnaissance and reducing the expertise needed to move from disclosure to exploitation. For critical infrastructure operators this has immediate implications for patch prioritization, exposure management, incident readiness, threat hunting and executive-level resilience planning. This session explores what AI-enabled cyber operations mean for OT environments, where security decisions must account for safety, availability, process integrity and physical consequences, and argues that defenders must use AI and automation to compress analysis, improve prioritization and accelerate response without introducing unsafe or poorly governed actions into production environments.

Michele Campobasso, Senior Security Researcher, Forescout Technologies, Inc.

Sifting through hacktivist attack claims to extract relevant threat intelligence: how hacktivism evolved from a grassroots movement to a façade for state-aligned attacks; the current TTPs used by hacktivist groups and why they matter; recognising which groups can realistically pose a threat versus which are just noise; and how to track these groups, use that data in a threat intelligence program, and mitigate the risks to critical infrastructure.

Liu Yuancheng, Head of Technology, National Cybersecurity R&D Laboratory

This share session will introduce the design of several Software-based Critical Infrastructure OT Cyber Twin for supporting cyber exercises, security training, and research. The proposed system digitally replicates the physical processes, OT devices, communication networks, control logic, and supervisory systems of critical infrastructure environments, enabling realistic interaction between cyber attacks and simulated physical processes. The cyber twin adopts a modular architecture that integrates physical-world simulation, virtual PLCs/RTUs/IEDs, industrial communication protocols, SCADA/HMI systems, network services, and cybersecurity monitoring components. Three different cyber twins system will be introduced, including:

· Mini OT Aviation CAT-II Airport Runway Lights Cyber Twin System
· Land Based Railway OT Cyber Twin System
· Power Grid OT-Energy-System Cyber Security Cyber Twin System

The software-based CI simulation approach enables rapid deployment, repeatable scenarios, safe attack experimentation, and scalable multi-user exercises without affecting real-world infrastructure. The proposed design provides a flexible foundation for developing realistic OT cyber ranges and cyber exercises, helping organizations evaluate defensive capabilities, train cybersecurity personnel, and study the impact of cyber attacks on critical infrastructure operations.

Mark Orsi, CEO, Global Resilience Federation