Department of the Air Force official urges AI, zero-trust and new CROCS effort to secure aging operational systems

A Department of the Air Force official speaking at a DARPA AIxCC event on cybersecurity said legacy operational-technology systems on military installations require bespoke approaches to AI and zero-trust, and that current vendor pricing models often make commercial solutions unaffordable for small OT operators.

The official told attendees that many OT systems still run decades-old operating systems — citing Windows XP and Windows 7 as common examples — and that buildings and facilities often have far more OT points than traditional IT. Using a large Pentagon-area building as an example, the official said security systems can monitor about 10,000 devices, IT operations about 20,000 and building/facilities operations about 50,000, and noted these OT counts change baseline and update expectations compared with IT.

"Zero trust has taken us from thinking about the perimeter security to thinking that an adversary is already in your network," the official said, adding that intelligence-community discussions show zero-trust measures can make lateral movement more difficult. "When you apply zero trust, ... they get very frustrated, and they cannot be successful," the official said, while also stressing that zero trust cannot, by itself, perform all IT functions for OT.

The presenter illustrated procurement and affordability problems with a pricing example. For a small utility network of three water and two wastewater systems, a vendor proposal of a $250,000 appliance plus a $250,000 annual licensing fee would amount to roughly $2,500 per monitoring point for a 100-point site, an expense the speaker characterized as out of reach for many operators. "Who thinks the people who are running this environment have that kind of money? They don't," the official said.

The official urged a rethink of contracting and budgeting: OT teams often lack funds for routine maintenance and are expected to self-fund cyber upgrades, while IT groups rarely reallocate budget to cover OT needs. The speaker recommended cross-training so engineers and OT operators learn core cyber practices and cyber staff learn OT constraints, warning that inappropriate IT-style interventions can disrupt critical systems.

The presentation also compared scale and implementation requirements: the speaker said about 152 activities are commonly associated with zero-trust implementations for IT and that the Air Force has identified roughly 104 discrete activities tailored for OT, underscoring that OT requires different priorities and tooling.

Announcing an organizational step, the official said the Department of the Air Force has established a Cyber Resiliency Officer Control Systems initiative, or CROCS, modeled on the Cyber Resiliency Office of Weapon Systems (CROWS). The speaker said CROCS currently consists of the official and four contractors and is focused on addressing OT resiliency across more than 200 bases, and invited collaboration from industry and researchers.

The official closed by thanking the DARPA AIxCC organizers and attendees and encouraging continued work on pricing models, training and contract language so security can be designed into OT without compromising operations.