A water utility SCADA security brief covers AI that flags unusual remote-access timing—not how to attack the plant. What defensive monitoring literacy point fits?

Water utility and other critical civic infrastructure security briefs often introduce AI that flags unusual remote-access timing—such as interactive sessions outside approved maintenance windows—as a defensive monitoring literacy point. Detecting anomalous access timing supports investigation of compromised credentials, unauthorized vendor access, or policy violations without teaching operators how to attack the plant. The value is earlier human attention to suspicious remote activity on SCADA-adjacent networks. AI that synthesizes targeted remote-access exploitation payloads to advance offensive security of critical civic infrastructure is an offensive use that teaches how to attack the plant, not the defensive monitoring literacy point the brief covers, which is about timing of human remote-access sessions for investigation without providing attack methods. AI that autonomously blocks unusual remote-access sessions to execute active mitigation for critical civic infrastructure confuses monitoring with automated response, because the brief is about flagging suspicious remote-access timing for triage, not autonomously terminating sessions or executing active mitigation. AI that simulates theoretical remote-access intrusion paths to guide vulnerability testing of critical civic infrastructure is a vulnerability-testing use, not the defensive monitoring for earlier attention to suspicious remote activity that the brief is about. Exam caveat: timing anomalies are indicators, not proof of compromise; maintenance emergencies, daylight-saving shifts, and approved after-hours work can look unusual, so alerts need context from change tickets and identity logs. Operational check: ensure remote-access telemetry feeds the detector, that alerts route to an on-call defender with plant operations awareness, and that physical and logical controls (locks, MFA, jump hosts) remain in place while AI monitoring is evaluated.