AI chatbot to help cybersecurity teams protect infrastructure

Experts led by Professor Carsten Maple at the University of Warwick's Cyber Security Centre, have developed a new tool, called ICSThreatQA, to tackle the problem of cybersecurity breaches.

The Cyber Security Breaches Survey 2025 found that just over four in 10 businesses and three in 10 charities experienced some form of breach or attack in the last 12 months.

The latest research estimates this amounts to an annual UK cost of £14.7 billion.

Industrial control systems

In an increasingly digitised world, critical infrastructure, including power grids, water treatment plants and transport systems, is vulnerable to cyberattacks.

This new tool is the first solution of its kind designed specifically for industrial control system cybersecurity.

It works much like a chatbot in that it uses conversational interaction, allowing analysts to ask questions in plain English.

Building trusted knowledge

Unlike generic chatbots, it is a specialised analytical tool built on a trusted knowledge base, designed to deliver accurate, context-aware answers for industrial control system (ICS) security.

This helps reduce cognitive load on analysts and accelerates decision-making during fast-moving cyber incidents.

This offers a new way to help digital security teams detect and respond to threats quickly and effectively.

Produced by experts

The tool is free to download and use via the Huggingface platform.

It is part of the Warwick AI Testing and Development Lab.

It will be promoted in collaboration with partners including the High Value Manufacturing Catapult and the UK Research and Innovation (UKRI) funded National Hub for Edge AI.

How it works

ICSThreatQA uses advanced AI techniques called Retrieval-Augmented Generation, enhanced with knowledge graphs.

This enables the system to reason across complex relationships within threat data and provide clear, accurate answers grounded in validated sources.

By turning static repositories of cyber threat information into an interactive, analyst-ready system, ICSThreatQA supports quicker, more reliable decision-making during cyber incidents affecting critical infrastructure.

Quick effective help

Professor Maple said:

The system is much like a chatbot in that it uses conversational interaction, but is a specialised analytical tool built upon a specific knowledge base.

This means it can effectively answer complex questions and produce clear, accurate answers.

This reduces cognitive load on analysts and accelerates decision-making for ICS security teams.

Protecting essential systems

The researchers say the goal is to help the people who protect essential services respond faster and more accurately when threats emerge.

This will ultimately support the resilience and reliability of the power, water, manufacturing and transport systems that citizens rely on every day.

Professor Charlotte Deane, Executive Chair of the Engineering and Physical Sciences Research Council (EPSRC), said:

Cybersecurity underpins every aspect of our digital economy and national security.

This research demonstrates how advanced AI can transform risk assessment and resilience in complex systems.

EPSRC's sustained investment in secure digital technologies and AI ensures the UK remains at the forefront of protecting critical infrastructure and enabling trust in emerging technologies.

The research project, called Responsive Additive Manufacture to Overcome Natural and Attack (RAMONA), was funded by UKRI.

Top image: Advanced Research Centre, University of Glasgow. Credit: EPSRC