The failure is random. The attack isn't.

Booz Allen warned this week that frontier AI models can plan multi-step attacks through OT pathways, manipulate controllers and physically move robotic equipment. In the same week, Forescout counted thousands of internet-exposed refrigeration controls sitting inside food supply chains and hospitals. Most plant people will file both under IT's problem and walk back to the line. I read them twice.

I spent two decades rating failure modes in automotive and aerospace plants – PFMEA and APQP discipline at WITTE Automotive, a greenfield QA/QC department built from zero for more than 900 people at SNOP. I also hold a CEH, and a clickjacking disclosure once put my name in T-Mobile's bug-bounty Hall of Fame. Both halves of that record say the same thing: I study how complex systems fail, then build them so they don't. Here is the uncomfortable observation: every number on your risk wall assumes the failure does not want to happen.

The math assumes no intent

Pick any artefact of the quality system and read its assumptions out loud. An FMEA occurrence rating is history extrapolated: the failure mode has a rate, and we sample it. A capability index assumes a process that varies but does not choose. MTBF, the bathtub curve, the SIL calculation in IEC 61508, the PL d rating on a safety function – all of it models stochastic decay. Stress against strength, wear against time, chance against control.

I once rated a light-curtain fault occurrence 2 on a PFMEA because three years of line history delivered two nuisance trips and a maintenance log to match. Defensible. Correct, under stochastic assumptions. An adversary does not sample that distribution. He reads it and picks the path of least resistance – the sensor rated 1 because it never fails, the interlock everyone trusts, the gateway nobody logs. Once the failure is chosen, occurrence collapses to 1, detection becomes a race you are already losing, and severity was never in doubt. We built the scoring convention for a world without intent. On paper, we still live in it.

Occurrence is a distribution only so long as nobody wants it to be a decision.

Nothing breaks, everything obeys

The attack Booz Allen describes needs no payload, no corrupted firmware, no alarm stampede. A conveyor slowed eight per cent. A torque target nudged to the edge of tolerance – still passing, still 1.67 on the monthly Cpk report. A refrigeration setpoint drifted a few degrees on a compressor reachable from the open internet, which is precisely what Forescout mapped. Every command is individually legitimate. The chain produces an illegitimate product, or an illegitimate pallet of medicine. Security tooling hunts signatures. Quality hunts variation in parts. Nobody audits the commands, and that is the seam.

I have lived the benign version. At SNOP we burned six weeks of QRQC on a fastener dimension drifting in and out of tolerance with no assignable cause – containment, 100% inspection, a wall of Ishikawa branches – €120,000 gone in sorting and air freight. The cause was an upstream setpoint on a pre-treatment bath, changed during a weekend intervention, never recorded, owned by nobody. An accident with no attacker. Give the same drift to somebody with a motive and a plan, and my QRQC team would have worked it identically: assume randomness, hunt the special cause. We were pattern-matching to randomness while the system was obeying instructions.

I spend part of my week building multi-agent AI orchestration platforms – deployment and integration, not model training – and I have watched individually correct agent steps chain into an outcome nobody specified. Each step defensible, the sequence wrong. That is the attacker's grammar exactly. An AI planner needs no weapon, only a tolerance band.

Rewriting the control plan for an adversary

The standards bodies are converging on this: ISA and IEC are pushing integrated safety and cybersecurity for industrial control systems, because a hazard analysis that ignores reachability is half a hazard analysis. Quality does not need to become information security. It needs to extend the discipline it already owns, and it can start on Monday.

Pin the OT topology on the wall next to the control plan – controllers, gateways, vendor tunnels, remote access points – and revise it with the same discipline as an engineering change. Then treat every remote access point like a supplier entry point: receiving inspection, entry criteria, a named owner. A vendor tunnel into a PLC is a lot shipment with no PPAP.

The PFMEA library grows a new failure-mode family: adversarial actuation. Not "sensor fails low" but "sensor reports convincingly wrong values under command". And red-team the interlocks the way I tested clickjacking – from outside, with written permission. Clickjacking taught me that a trusted interface can be made to lie. So can an HMI. So can a light curtain.

The money argument writes itself. An escape costing six figures in sorting and freight looks brutal until the same event is labelled an incident and the line sits dark for a week. Security owns the firewall, quality owns the escape, and finance reads one P&L. Somebody should connect those sentences before an auditor does.

Quality engineers are the natural owners of this problem. Not because we understand networks – because we already think in failure modes, detection capability, containment and escape. We were closing 8Ds before software had CVE numbers. The only new premise is this: the next serious escape in your plant may not be a failure at all. It may be somebody else's success. The risk registers that matter in the coming decade will list intent next to randomness, and quality is the one discipline already trained to read both columns.