HERMES–AEGIS: AI-assisted security for operational technology with structural separation from the plant

HERMES–AEGIS is a research programme on AI assistance for security teams in industrial plants and other critical infrastructure. It rests on three principles. First, separation by structure: no component that reads AI output is given credentials or a network path to controllers or safety systems, with the plant boundary enforced one way. Second, evidence before conclusions: every claim is tied to its source data and checked before an analyst sees it. Third, intelligence by need: each step uses the least costly sufficient AI model and escalates only when the evidence calls for it. This note sets out the problem, the principles and the current status. HERMES, the reasoning layer, exists as a research prototype exercised with simulated models; AEGIS, a read-only incident-triage application for OT security teams, is in preparation. The note includes one observational result from 7,366 public AI-agent task recordings. It is not a product announcement, makes no claim of validation against real incidents, and makes no claim of compliance with ISA/IEC 62443, NIST guidance or any regulation.