Who Certifies the Detector? AI-Based Threat Detection and the Resilience Certification Gap in Critical Infrastructure

AI-based detection is becoming the eyes of critical infrastructure operators. In the Resilmesh platform, anomaly detectors running at the edge and in the cloud watch IT and OT data around the clock, and their output feeds the correlation, risk-assessment and mitigation functions that decide how to respond. But if the detector is wrong, or is deliberately deceived, nothing in today’s certification landscape tells an operator how much that matters. This white paper makes three points: 1. Lightweight detection works, and it can be made robust. Resilmesh detectors reach results at or near the top of published results on the public BATADAL water-distribution benchmark. The lightweight edge detector, one of the project’s results, comes within 0.4% of a centralised detector’s overall score, detects attacks faster, localises them to the network area concerned and needs a fraction of the energy. This type of detectors in general can be deceived by a determined attacker: in our tests, an attacker who knew the model disguised most attacks from a standard centralised detector, and hardening did not reliably fix this. Our results also show how to deploy edge detection robustly: combined with a system-wide view, as in the Resilmesh architecture, a compromised controller hid fewer anomalies than from edge-only detection. 2. The standards do not cover the gap. Security (IEC 62443), functional safety (IEC 61508) and AI and product rules (EU AI Act, Cyber Resilience Act) each certify resilience in their own way, on different assumptions. Taken together, they do not add up to a guarantee for a system in which a detector feeds a safety-relevant decision. 3. The gap can be managed now. We recommend treating AI detectors as attackable, safety-relevant components; reporting their robustness next to their accuracy; stating how each certificate was derived; and requiring any combination of certificates to carry an explicit, justified assumption. The paper closes with recommendations for operators and integrators, technology developers, standardisation bodies and regulators.