Produced by Reuters Plus for
Securing social infrastructure in the age of AI
The Reuters news staff had no role in the production of this content. It was created by Reuters Plus, the brand marketing studio of Reuters.
As complex systems from energy to transportation grow more integrated and connected, a new aggressive, holistic approach to cybersecurity is needed.
Govern & identify, manage, recover
Secure by design principles
A core lesson from recent infrastructure incidents is that security shouldn’t be treated as an afterthought or simply bolted on after deployment. Embracing "secure-by-design" principles from the initial architectural phase ensures that systems are built to withstand threats both seen and unseen.
“We really need to make sure as we innovate into AI and OT that security is built into the design,” said Rehman.
The philosophy is engrained in HMAX Cyber, which is a foundational service woven throughout the company’s expanding portfolio of HMAX by Hitachi services.
Importantly, adopting secure-by-design principles also saves money in the long term. According to Rehman, the analogy is a bit like securing a house. “If I design a house with multiple doorways and windows covered by trees, I would never be able to protect it,” he said. “But if you design the house with only one way in and one way out, your long-term costs for protecting it are substantially less.”
Not only that, but the ‘blast radius’ – the damage that could be done when something bad happens – is much smaller.
Securing OT in the digital age requires navigating a complex environment where industrial machinery, IT systems and physical AI are heavily interlinked. Many pure-play cybersecurity companies struggle in this space because they lack an innate understanding of critical infrastructure.
"I've seen companies that come from the digital world that want to go down to the OT world and fail,” said Sam Rehman. “It's a very different world – one that moves at a different speed, has different requirements and a company culture where you need to understand the importance of resilience."
Leveraging its deep industrial heritage alongside modern digital capabilities, Hitachi has designed HMAX Cyber to bridge this gap and protect mission-critical infrastructure in the digital age.
Sam Rehman is Chief Executive Officer, Hitachi Cyber
The challenge of industrial environments:
Industrial assets cannot be replaced every few years
Devices often need to be protected for 20+ years
Explore
Explore the first article in the series, Building an operating system for social infrastructure, to discover how HMAX is transforming the systems that underpin society.
READ HERE
With OT it’s no longer just about data threat and data theft, or about confidentiality, we’re now talking about systems shutting down and people’s safety.
Sam Rehman, Chief Executive Officer, Hitachi Cyber
Aging infrastructure creates significant technical debt
Many systems were never designed for internet connectivity
We really need to make sure as we innovate into AI and OT that security is built into the design.
Sam Rehman, Chief Executive Officer, Hitachi Cyber
Explore
Read more about HMAX Cyber by Hitachi here
Disclaimer: The Reuters news staff had no role in the production of this content. It was created by Reuters Plus, the brand marketing studio of Reuters. To work with Reuters Plus, contact us here.
Read the next article in the series, How to make AI agents behave in the physical world, to discover how Hitachi’s IWIM brings orchestration, context and guardrails to industrial AI agents.
READ HERE
Matt Castonguay is Chief Revenue Officer, Hitachi Cyber
Released only recently, HMAX Cyber is a new operational resilience service designed to protect systems from increasingly sophisticated cyberattacks and provide business continuity through advanced AI and operational expertise. Organizations, whether industrial or enterprise, are offered three service categories: “Govern & Identify,” which anticipates and prepares for potential risks; “Managed,” which supports 24/7 monitoring and operations; and “Recovery,” which enables rapid restoration in the event of an incident.
For Rehman, a career cybersecurity expert, it’s all about adopting an “assume breach" mentality. Operators, he says, should expect adversaries to probe their perimeters. And while defensive measures cannot completely stop a sophisticated adversary, they can alter the cost vs. benefit equation for attackers.
“The idea is to slow them down and make it difficult enough, so they think it’s not worth their time,” said Rehman.
Inevitably, one of the challenges for industrial operators is the immense longevity of operational machinery. Unlike consumer technology or enterprise computing, industrial assets cannot be swapped out every few years. Often devices need to be protected for over 20 years or more. This reality creates massive ‘technical debt,’ or the cost of continuing to secure legacy codebases, outdated hardware protocols and unpatched software that was never designed for Internet connectivity.
Within these aging environments, attackers leverage automated tools to discover zero-day exploits before patches can even be developed, says Matt Castonguay, Chief Revenue Officer, Hitachi Cyber. "Insurance companies are having to pay out on things they weren't even considering before,” he adds.
Where once an ‘air gap’ of physical disconnection existed between industrial machines and processes and the outside world, today hyperconnectivity and accessibility from the core to the edge have left companies increasingly exposed.
“For years a big part of OT (operation technology) security relied on locking up industrial systems and then ringfencing them,” said Sam Rehman, Chief Executive Officer, Hitachi Cyber. “Those days are gone.”
Instead, Industry 4.0 – the latest industrial revolution predicated on digital transformation – requires OT to be connected to IT and physical AI, to remain competitive and drive productivity. Unlike traditional software-based AI platforms that are confined to corporate servers, physical AI acts at the edge – embedded directly within the machinery, robotics and controllers that manage physical processes and social infrastructure.
This decentralized intelligence requires constant communication between localized sensors, edge computers and central management systems. As the connectivity spreads, new attack vectors surface, like the ability to inject commands between autonomous loops or corrupt the integrity of an edge model. The big difference between enterprise and industrial vulnerability, however, is that the consequences of the latter have the potential to manifest physical chaos in the real world.
“With OT it’s no longer just about data threat and data theft, or about confidentiality, we’re now talking about systems shutting down and people’s safety,” said Rehman.
Consider the widespread cyberattacks that were launched this summer against the automated control systems of municipal water systems across the U.S. The attacks, which targeted Internet-attached programmable logic controllers, forced utilities to manual operations quickly. The FBI, which received incident reports from water and wastewater utilities in at least seven U.S. states, issued warnings that malicious cyber actors were conducting cyberattacks targeting Operational Technology (OT) devices.
This fast-moving cyber landscape has driven Hitachi to take a proactive, if not pragmatic approach to cybersecurity and the securing of social infrastructure,
with a new service called HMAX Cyber.