AI-Enabled Cybersecurity and IoT Resilience for Securing Industrial Control Systems in U.S. Critical Infrastructure

Abstract

The threat landscape continues to evolve with nation-state actors, ransomware syndicates, and opportunistic attackers increasingly focusing on the operational-technology (OT) layer and the industrial control systems (ICS) which control energy, water, transportation and manufacturing operations in the U.S. critical-infrastructure system. Security incidents have brought the security agenda from the enterprise information-technology (IT) perimeter to the OT/ICS interior, including SolarWinds intrusion in 2020–2021, Colonial Pipeline ransomware in 2021 and Oldsmar water-treatment attack in 2021. The study empirically tests a strategic cybersecurity framework, where four cybersecurity capability constructs (AI-based cybersecurity, IoT security posture, ZTA, and IRC) collectively contribute to two performance outcomes: ICS cyber resilience and operational continuity. This cross-sectional survey was conducted from March to August 2025 with N = 380 OT/ICS security practitioners from nine CISA critical-infrastructure sectors. OLS structural-model estimation, interaction-term moderation, and Sobel-tested mediation were used to test six hypotheses. The measurement model exhibits high reliability (Cronbach's α range 0.86–0.89; CR range 0.79–0.85; AVE range 0.49–0.54) and good fit (χ²/df = 1.39; CFI = 0.952; TLI = 0.946; RMSEA = 0.033 [0.026, 0.039]; SRMR = 0.042). The AI-enabled cybersecurity significantly predicts both ICS cyber resilience (β = 0.158, p < .001) and operational continuity (β = 0.187, p < .001); IoT security posture is the dominant predictor of ICS cyber resilience (β = 0.427, p < .001); zero-trust architecture is the dominant predictor of operational continuity (β = 0.354, p < .001); workforce cyber awareness partially mediates the AIC → ICR path (Sobel z = 6.61, p < .001); and the AIC × IRC interaction is statistically significant but opposite to the hypothesized direction (β_int = −0.113, p < .01), suggesting a substitution rather than an amplification effect at high incident-response maturity. The results show that five of the six hypotheses are supported. The final models account for 52.2% of the variance in ICS cyber resilience and 50.8% of the variance in operational continuity. Recommendations are provided on how AI, IoT, zero-trust and workforce investments should be prioritized to maximize critical-infrastructure defense and continuity outcomes for US companies.