Adaptive AI, Industrial IoT, and Zero-Trust Cyber Resilience for U.S. Critical Infrastructure Control Systems

Abstract

U.S. critical-infrastructure control systems face a threat environment in which nation-state adversaries, ransomware operators, and industrial espionage groups increasingly target the industrial control system (ICS) and operational-technology (OT) layer. In response, three technology families are converging as the leading defensive stack of the mid-2020s: adaptive AI models capable of self-tuning threat detection on live telemetry streams, industrial IoT security postures that harden the sensor-and-actuator surface, and zero-trust architectures that constrain lateral movement across the IT/OT boundary. This study empirically tests an integrated framework in which these three capability constructs, jointly with threat intelligence sharing and cybersecurity governance maturity, determine two performance outcomes: cyber resilience of ICS and operational reliability. Cross-sectional data were collected from N = 315 US-based OT/ICS cybersecurity practitioners between April and September 2025 across eight CISA critical-infrastructure sectors. Six hypotheses were tested using OLS structural-model estimation, moderation, and Sobel-tested mediation analysis. Measurement-model reliability was strong (Cronbach's α range 0.86–0.89; CR range 0.79–0.85; AVE range 0.46–0.53) and fit indices were good (χ²/df = 1.39; CFI = 0.955; TLI = 0.949; RMSEA = 0.036 [0.028, 0.043]; SRMR = 0.045). Industrial IoT security dominates the ICS cyber resilience outcome (β = 0.461, p < .001) and zero-trust architecture dominates the operational reliability outcome (β = 0.341, p < .001). Adaptive AI has a direct effect on operational reliability (β = 0.198, p < .001), but its effect on ICS cyber resilience is fully mediated by threat intelligence sharing (Sobel z = 6.17, p < .001; direct β = 0.083, ns) — a substantively novel finding indicating that AI models translate into cyber-resilience outcomes only when their outputs feed into functioning threat-intelligence-sharing channels. Governance-maturity moderation of the adaptive-AI path is not supported. Four of six hypotheses are supported. Final models explain 51.2% and 45.0% of variance in the two outcomes. The results imply that U.S. critical-infrastructure firms should sequence investment in industrial IoT security first, zero-trust second, and adaptive AI in conjunction with formal threat-intelligence-sharing memberships.