Enhancing Cybersecurity and Safety for Critical Applications

Posted on August 26, 2026

Martin Dehnel-Wild, Chief Scientist at Kry10

In the first part of 2026, the "Mythos Moment" made AI and cybersecurity a headline debate. For operational technology, it sharpens a problem that already existed. State-sponsored actors are already inside critical infrastructure. CISA, the NSA and the UK's NCSC have confirmed Volt Typhoon and similar groups have sat undetected inside US energy, water and transport networks, pre-positioned for disruption in a future conflict.

AI adds a faster axis to the same problem. As Kry10 CEO Boyd Multerer puts it: "The adversary has the advantage because they get to be a scientist... once a threat is released, the defender has zero time to respond." AI, he adds, "has taken what was already a hard game for the defender and made it impossible." NCSC CEO Richard Horne recently offered a useful reframe, describing cyber security as a contest across near, mid and far spaces. The near space — an organisation's own systems — is where defenders should hold home advantage. There's little value contesting the wider fight if your own architecture stays vulnerable.

For operational technology (OT), that's the whole point. In operational technology, downtime is measured in dollars and deaths, not inconvenience. Faster vulnerability discovery helps defenders keep pace, but it doesn't change the architecture they're defending or evict an adversary who is already inside.

Winning the near space means building systems where there's nothing for adversaries to find. Formal verification mathematically proves a component behaves exactly as its specification says: ruling out whole classes of vulnerability, such as memory-safety errors and unauthorised privilege escalation between components, before a state actor or an AI ever finds them. That distinction matters most in OT because patching is slow and re-certification is costly: a vulnerability class that was never present doesn't need a patch, a maintenance window, or a safety recertification cycle to remove. It is also independent of how fast an adversary's tooling gets. An AI-armed attacker with unlimited time to search is unable to find anything in a component where the flaw category was designed out from the beginning. The advantage isn't erased; it's made irrelevant.

This is the discipline behind Kry10's operating platform, KOS. KOS is built on seL4®, the world's only fully formally verified microkernel. Kry10 is extending that same approach to network-level protection with OT Network Guard, which is currently in pilot development. OT Network Guard is an appliance that sits inline between a trusted, safety-critical system and a lower-trust network, determining and enforcing what crosses that boundary.

If your teams write the software running your critical infrastructure, formal verification is worth understanding now, not after the next incident. Find out more at kry10.com.

Dr Martin Dehnel-Wild is Chief Scientist at Kry10. His career has tracked formal verification out of academia and government, into the real-world systems society depends on.