Capacity Aware Cyber Threat Detection and Safe Response for Critical Infrastructure

A cyber detector can classify industrial traffic accurately and still overwhelm the team responsible for investigating its alerts. An equally important failure occurs when a plausible detection triggers a response that interrupts a physical process. We develop an operational technology architecture that separates detection, incident review, and authorization to intervene. Sites score events locally, collaborate on model updates when privacy and availability requirements permit, and consult a read-only digital twin before proposing a control-sensitive response. An analytical stress test quantifies the interaction between incident prevalence, detector sensitivity, false-positive rate, and review capacity. At an assumed prevalence of 0.1%, sensitivity of 90%, and false-positive rate of 0.1%, a stream of 100,000 review units yields 190 expected alerts, including 90 true positives. A review budget of 100 units requires a false-positive rate near 0.010% to retain that sensitivity and accommodate all expected alerts. A second analysis shows that the usefulness of twin corroboration depends on its behavior specifically among detector-positive cases. The results are conditional planning estimates. A chronological, cross-site evaluation protocol specifies how to test whether the proposed operating points are attainable under incident clustering, telemetry loss, and changing plant conditions.