The system is restored. The product isn't.

Booz Allen reported last week that frontier AI models can exploit OT pathways, manipulate controllers and move robotic equipment. Security teams read it as a security headline. I read it as a quality problem. I have stood on the floor the morning after an incident – screens back, PLCs re-flashed, IT relieved, the line released to two shifts – and I know which question is still standing in the middle of the hall: what did we make while this thing was inside?

It was not one warning. Forescout flagged refrigeration controllers exposed on the open internet, with food supply chains and hospitals downstream. Frenos warned that AI-assisted attack planning is lowering the entry barrier for critical infrastructure and ICS targets. Three reports in one week, one conclusion: someone is mapping the physical layer. I hold a CEH and a place on T-Mobile's public bug-bounty Hall of Fame, and I have spent two decades running quality in automotive and aerospace plants. I sit exactly on that seam. It is where product falls through.

The intrusion window is a production window

A ransomware crew wants to be seen: splash screen, countdown, negotiation channel. An adversary with controller access needs none of that theatre. Shift a weld offset by 0.3 mm. Take eleven degrees out of a curing oven so the surface still looks right. Tighten a torque target until the joint strips in year three instead of today. The line keeps running, cycle times stay green, and the SPC chart has no opinion – a well-chosen parameter attack hides inside normal variation.

The damage is latent and deniable. It surfaces months later as warranty claims, field failures, an escape at a customer – long after the incident is closed, the forensic images archived, the retainer paid. Nobody connects a field return in March to a quiet Tuesday when somebody rewrote recipe 47.

Where the incident-response playbook stops

Pull any incident-response plan off the shelf: detect, contain, eradicate, recover. Every phase faces the system. Recover means servers restored from clean images, controllers re-flashed, domain rebuilt – then the incident commander declares victory and goes home.

There is no step that says: define the suspect window, bracket the lots, quarantine, re-verify. Not because the capability is missing. It lives in the quality organisation – containment and traceability are our trade. At SNOP I built the QA/QC department for a greenfield plant of 900+ people, and the first system I made work end to end was the bracket: machine, batch, tool, shift, timestamp. When a suspect batch surfaced, we bounded it to a shift and a serial range within an afternoon. The muscle exists. Nobody invites it to the incident-response table, so the handoff has no owner – and a handoff with no owner does not happen.

The incident ends when the screens come back; the liability begins when the parts ship.

Bracket, quarantine, re-verify

The product-recovery step is not exotic. It is a containment exercise with a security log where the customer complaint used to be, run with mechanics the quality organisation already owns.

• Bracket the window. Correlate security logs against traceability records: first anomalous write to the controller on one side, last confirmed-clean backup on the other. Bound suspect stock by part, batch, machine and shift. An unbounded window is an unbounded cost.
• Quarantine physically. Blocked stock with a named owner, behind a rope if necessary – not a flag in the ERP the next expediter overrides to protect a shipment.
• Re-verify by decision tree. Measurable characteristics: 100% re-inspection. Tampered parameters: re-run capability on the affected CTQs before releasing the machine. Provenance unprovable: scrap. The default is proof, not confidence.

Then seat the security engineer inside the 8D. Intrusion evidence – timelines, hash mismatches, log excerpts – belongs in D4 next to the process data, because a root cause written without the intrusion is a story with a hole in it.

And rehearse. Run one tabletop a year that ends with 11,000 parts of unknown provenance on the board, and time how long the room takes to bound it. At €14 a part that is €154,000 of scrap – a bad week. The same defect escaping to three OEM platforms means sorting teams, containment shipments and line-down penalties every week for a quarter. At SNOP we closed a quarter with zero critical customer escalations, not because nothing went wrong, but because we could bracket fast, decide fast and prove what we shipped. Containment buys time. The question is whether you spend it on evidence or on blame.

The AI dimension is personal. I design and deploy autonomous multi-agent systems – an orchestration platform running 63 models in parallel – and I do not train foundation models; I wire them into workflows and hand them tasks. Which is the point. A planning agent needs no creativity to hurt a plant. It needs a map of the line – controller addresses, recipes, robot teach points, all vendor-standard and sitting in the commissioning file – and patience. The defensible posture is not pretending the map does not exist. It is knowing, down to the part, what you made through the window.

One page, one owner, one rehearsal

Here is the uncomfortable observation: the next 8D you sign may carry a CVE number in its root cause, and most quality organisations are neither staffed nor rehearsed for that sentence. The remedy is smaller than the fear. One page added to the incident-response plan that seats the quality lead at the table and defines the product handoff. One named owner of that page. One joint exercise a year that ends in parts, not servers. That is the whole ask.

The plants that lose days and the plants that lose customers will be separated by this handoff alone. Quality is the discipline of understanding how complex systems fail and building them so they don't – and for twenty years the systems I worried about failed through torque values and cure cycles. Now the failure arrives over the network and finishes at the part. Rehearse the moment the incident commander says systems restored. That sentence is not the end of the event. It is the first line of your containment report.