Recommended Free Tools
Booz Allen says frontier AI models achieved every defined objective in eight controlled operational technology (OT) scenarios, including reaching an industrial control network in just over 16 minutes in one test. The results demonstrate what the models did in an isolated lab—not that they compromised a live facility or could breach any industrial site on the same timeline.
What Booz Allen tested
Booz Allen describes its evaluation as a series of tests in an isolated, multi-vendor OT cybersecurity lab modeled on a manufacturing facility. Across eight scenarios, the models met every defined objective. The work covered asset discovery, device research, attack planning, troubleshooting and execution. Booz Allen says the models operated without source code, engineering documents or advanced OT guidance.
As an Amazon Associate I earn from qualifying purchases.
The firm reports that the systems identified unfamiliar equipment, used asset and firmware details to match known vulnerabilities, developed attack paths, and reached controllers and supervisory systems. In some tests they also changed physical equipment, but only after human operators approved actions that could have a physical effect.
What the results show—and what they do not
In one scenario, the models progressed from a perimeter compromise to actions inside an industrial control network in just over 16 minutes. A separate scenario identified and moved a robotic arm within minutes. Both examples came from Booz Allen’s controlled lab, not an operating plant.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
That distinction matters. The timing describes performance under the test’s conditions; it is not a forecast of how quickly an attacker could compromise a particular facility. Booz Allen says consequences in an operating environment would depend on the facility’s architecture, equipment, safeguards and the access an attacker obtained. Human approval was part of the evaluation, so the reported results should not be read as a demonstration of unconstrained autonomous action.
The public summary does not name the two tested models. The Register described them only as the latest frontier models from leading providers, so their identities and any vendor-specific conclusions remain unestablished.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
How the models adapted during a SCADA scenario
One reported example illustrates why the evaluation focused on troubleshooting as well as initial access. The models first targeted the wrong version of an operator interface. They then checked active sessions, adjusted their approach and found live, pre-authenticated connections to 14 OT devices.
This example points to a potential risk from trusted connections and exposed access paths: an attacker may be able to use them to reach devices beyond the system first encountered. It does not establish that every facility has such connections, or that the same route would be available outside the test environment.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Safeguards did block or slow some actions
The evaluation was not a story of every defense failing. Booz Allen says a controller rejected a stop command, a motor in local-control mode could not be started remotely, and firewalls, segmentation and endpoint protection blocked or slowed some actions. The firm’s conclusion was that no single safeguard consistently stopped the models across the evaluation—not that safeguards were ineffective.
For operators, that points to a layered approach based on which systems an attacker could reach and what changes those systems could make. A control that stops one action may not prevent another route, so protective measures need to work together and account for the physical processes at stake.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Defensive priorities Booz Allen recommends
Booz Allen’s recommendations focus on reducing reachable paths, hardening systems that bridge or administer the environment, detecting consequential changes and preparing to restore trusted operations. The recommendations arise from this evaluation; none is a guarantee of prevention on its own.
- Segment high-consequence processes. Review and remove unnecessary paths across network boundaries, including dual-homed systems, shared services and pre-authenticated sessions.
- Protect boundary and administrative systems. Give particular attention to firewalls, switches, jump hosts, administrative interfaces, SCADA platforms and engineering workstations.
- Prioritize weaknesses by consequence and reachability. Consider not only whether a vulnerability exists, but what an attacker could reach and change through it.
- Monitor for meaningful control changes. Watch for controller-mode changes, program writes, SCADA project imports and unexpected use of trusted interfaces.
- Maintain tested recovery options. Keep backups and known-good configurations, and verify that they can support recovery when needed.
How this fits with other AI cyber evaluations
Booz Allen’s Cyber Weapon Index (CWI) is a separate evaluation. The company describes the CWI as testing offensive capabilities in a live enterprise environment under identical conditions, with telemetry and logs used to validate behavior. Its public index page reports results from an original evaluation of 18 U.S. and Chinese large language models. That study is not the OT lab test: the environments, tasks and scopes differ.
Best Value
- Ultra-Compact FIDO2 Security Key – Plug-and-stay or carry on a keychain. This USB-C hardware security key offers portable, always-on protection for desktop and mobile use.(Item Size: 0.73 X 0.60 X 0.30 inches)
- USB-C Hardware Key for All Devices – Works with USB-C ports on PC, Mac, Android, and USB-C iPhones. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key – Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey – Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication – Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
The UK AI Security Institute (AISI) offers broader context, not a replication. It reports that the cyber tasks its best models could complete with a 50% chance grew from under ten minutes in early 2023 to over an hour by mid-2025. Those figures describe AISI’s own evaluation trend, not performance in Booz Allen’s OT scenarios. AISI also characterizes its report as a snapshot rather than a forecast or comprehensive review of the field.
Evaluation results can depend on the task, tools, configuration, human involvement and success criteria. Booz Allen’s public summary does not disclose the model names or enough repeated-run detail to settle questions about repeatability and performance across other OT environments. The findings are evidence of demonstrated capability under specified lab conditions, not a universal measure of industrial exposure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
