Wastewater engineers must review sensitive packet captures on an air-gapped plant network and cannot send traces to a public cloud chatbot. Which AI security tool choice best fits the constraint?

Wastewater and other OT environments often keep packet captures on air-gapped or tightly controlled plant networks where an on-premises AI helper that summarizes syslog events locally without upload still misses the need, because syslog summarization cannot substitute for packet capture analysis and would leave safety-sensitive trace review unaddressed. A local CLI AI plug-in that analyzes captures on-premises without cloud upload matches that constraint: engineers still gain summarization or anomaly hints while traces never leave the plant trust boundary. An on-premises AI helper that summarizes syslog events locally without upload preserves isolation but is the wrong tool for packet capture review because it is built for syslog events, not PCAP analysis, and cannot address the sensitive capture use case. A local Wireshark copilot that documents protocols on-site without cloud upload preserves isolation but is the wrong tool for packet capture review because protocol documentation does not provide analysis of sensitive captures for anomalies or review. An air-gapped LLM workstation that tunes firewall rules offline without egress preserves isolation but is the wrong tool for packet capture review because it is built for firewall-rule tuning, not PCAP analysis, and cannot address the sensitive capture use case. Exam caveat: modality must fit constraint—offline or local AI for air-gapped review beats cloud convenience when the stem stresses no public upload. Operational check: inventory which AI tools are approved for OT, keep captures on approved media, sanitize or segment management data before any analysis, and document that no plant PCAP left the air-gapped enclave.