Darktrace / OT — Self-Learning AI for Industrial & ICS

① Why OT and ICS are not just 'IT on the plant floor'

The single most important idea: you cannot treat OT like IT. Operational technology runs the physical process — and the devices that do it (PLCs, RTUs and HMIs) are fragile, often run for years without patching, and can be knocked over by something as simple as an active scan.

That changes the rules. You generally cannot install agents on OT devices, you must not actively probe them, and the priorities are flipped: safety and uptime come before patching. On top of that, OT speaks its own languages — industrial protocols like Modbus, DNP3, Siemens S7, EtherNet/IP, OPC, IEC-104 and Profinet — that ordinary IT security tools simply do not understand.

So any OT security approach has to be passive, agentless and protocol-aware. Point a normal IT scanner at the plant floor and you risk causing the very outage you were trying to prevent.

② Darktrace / OT — passive Self-Learning AI on the plant floor

Darktrace / OT brings Darktrace's Self-Learning AI to OT and ICS. It works entirely from passive traffic — no active scanning, no agents on devices — so fragile gear is never disturbed. From that traffic it learns the normal pattern of life of each OT asset and each industrial protocol, then flags deviations as anomalies. Because it learns rather than matches, it needs no signatures and can catch novel or zero-day OT threats.

Protocol understanding and asset visibility

It genuinely understands OT protocols (Modbus, DNP3, S7, EtherNet/IP, OPC, IEC-104, Profinet), so it can tell a routine Modbus read from a suspicious Modbus write to a controller. Passively, it also builds an OT asset inventory and maps every device to the Purdue model levels — giving you a picture of what is talking to what, and where each asset sits, without ever sending a packet to a PLC.

③ Catching the real attack path — IT to OT, and inside OT

Here is the part interviews care about: most OT attacks do not start in OT. They start with an IT foothold — a phishing email, a compromised laptop — and then pivot across the IT/OT boundary into the plant network. That boundary is the most common attack path, and the blind spot for tools that only see one side.

Because Darktrace correlates IT and OT on one platform, the Cyber AI Analyst can stitch related events into a single incident. An IT phishing compromise and a later anomalous command to a PLC are not two unrelated alerts — they read as one chain. It also catches anomalies within OT itself: an HMI issuing commands it never has, or a device talking to a controller it has never spoken to.

The interview line: the value is following the attacker across the boundary, not just watching one network. You see the foothold, the pivot, and the OT deviation as a connected story.

④ One platform vs silos — and the pitfalls

Why one platform? Because correlating IT + OT together is what lets Darktrace follow an attacker from an IT foothold down into OT. An IT-only tool never sees the OT side; an OT-only tool never sees where the attack came from. Either silo misses the cross-boundary path. Darktrace / OT also adds risk and exposure context — which assets are most at risk — and is designed to work alongside safety systems, never to replace them.

The classic pitfalls

Three mistakes sink most OT-security efforts. Active scanning in OT — using IT-style probes that can crash fragile devices. Treating IT and OT as separate silos — which misses the cross-boundary attack entirely. And having no passive visibility into OT protocols — so anomalous Modbus or S7 traffic goes unseen. Darktrace / OT is built to avoid all three: passive, protocol-aware, and correlated with IT.