IEC 62443 doesn't cover your LLM agents yet. That gap is on the plant floor now.

Manufacturing has hardened its control systems for decades. But the standard that governs it — IEC 62443 — does not yet fully address LLM agents. That gap is live on the plant floor right now, and it lives on a Linux host.

The questions manufacturers are actually asking

As the floor goes software-defined, AI moves onto edge nodes and into SCADA-integrated interfaces. The questions engineering and security teams raise:

• IEC 62443 gives me zones and conduits — but what governs an LLM agent calling out from an edge node?
• How do I stop prompt injection reaching a SCADA-integrated assistant, or poisoning of a predictive-maintenance model?
• When an agent moves proprietary process data off the floor, can I see it and stop it?
• CIRCIA gives me 72 hours to report a substantial incident. Do I have evidence I can use?

The landscape: a hardened standard with a fresh AI gap

IEC 62443 is the globally adopted framework for industrial control systems — built on the zone-and-conduit model and four security levels, and referenced by the EU's NIS2 and Cyber Resilience Act. In 2026 the standard began catching up to AI, with new component-certification language around anomaly detection and threat modeling.

The gap is still explicit. Analysts note IEC 62443 does not yet fully address adversarial machine learning or LLM-agent integration — NIST is developing an AI RMF Profile for Critical Infrastructure to help fill it. In the meantime, three AI-specific attack vectors are already in the wild: data poisoning of predictive-maintenance models, physical adversarial attacks on computer-vision inspection, and prompt injection via SCADA-integrated LLMs. None of these show up cleanly in traditional OT network traffic.

The stakes are not theoretical. Manufacturing has been among the most-targeted sectors for cyber incidents for years, and OT protocol attacks jumped again in 2025. Yet only a small share of organizations report an advanced AI security strategy. CIRCIA will require substantial incidents, including AI-related ones, reported to CISA within 72 hours.

Where the real risk lives — the edge node

Vantio does not replace your PLC safety logic or your zone-and-conduit segmentation — those remain your foundation. We protect the general-purpose Linux compute layered on top: the edge nodes and industrial PCs where AI agents plan, infer, and connect out. That is precisely where the new AI attack vectors land, and precisely where IEC 62443 has not caught up for agents.

On a plant floor an ungoverned agent is both a security and a continuity risk — it can leak a process recipe, reach an unauthorized destination, or take a host action that stops the line. Seeing that behavior and stopping a forbidden move on Linux you enroll is the control IEC 62443 assumes but does not yet specify for agents.

How Vantio answers these questions

For a manufacturer, Optics runs free on edge nodes to reveal what agents call out to. Gate applies data and destination rules on that path. Phantom Engine protects controllers you enroll. Enterprise governance produces a durable trail you can use when you have to report.

What Vantio does — and does not — do

• Does: observe and govern LLM and AI agents on Linux edge nodes and industrial PCs — the layer IEC 62443 does not yet fully cover for agents.
• Does: surface and stop an agent moving proprietary process data or reaching a ruled-out destination, and keep a record you can use for incident reporting.
• Does not: replace IEC 62443 zones and conduits, PLC or DCS safety logic, or OT network segmentation — Vantio complements them at the agent layer.
• Does not: secure Windows-only or air-gapped legacy controllers via Phantom Engine. Control is Linux; Optics and Gate still govern the wrapped agent path.

Get started

Optics is free visibility inside the agent process you wrap. Gate applies the rules you set. Phantom Engine protects Linux hosts you enroll — a Helm DaemonSet on Kubernetes you operate, or a Linux daemon on standalone machines. Talk to sales when you need governance on top.

Sources

• ISA/IEC 62443 series
• NIST AI RMF work on critical infrastructure
• CIRCIA — 72-hour incident reporting to CISA