Human-in-the-Loop AI - The New Attack Surface in Industry 5.0

By Muhammad Ali Khan ICS/ OT Cybersecurity Specialist — AAISM | CISSP | CISA | CISM | CEH | ISO27001 LI | CHFI | CGEIT | CDCP

Industry 5.0 brought humans back into automated industrial systems with good intentions. The idea was simple: combine machine intelligence with human judgment to make better, safer decisions.

The common belief is that

“If a human is involved, the risk goes down.”

What Really Changed in Industry 5.0

In Industry 4.0:

• AI analyzed data
• Automation executed actions
• Humans supervised the systems

In Industry 5.0:

• AI makes recommendations
• Humans make the final decision
• Systems carry out that decision

This shift creates a new trust boundary. The human becomes the final decision point, effectively, the last control interface in the system.

Unlike machines, humans:

• Don’t behave consistently
• Don’t always document decisions
• Don’t fail in obvious ways
• Can be influenced without touching the network at all

This is where the risk begins.

Attack Surface 1: Manipulating Human Judgment

Human-in-the-Loop systems rely on people to validate AI output.
 But validation is not the same as verification.

Attackers don’t always need to tamper with the AI model or the data.
 Sometimes, they only need to influence how the output is perceived.

For example:

• An AI flags a fault as “moderate” instead of “critical”
• Operators see similar alerts every day
• Fatigue sets in
• The shutdown recommendation is ignored
• A failure follows

There is no malware involved, no intrusion alerts are triggered, and no systems appear compromised. Instead, the attack succeeds through carefully engineered doubt, hesitation, and human error, allowing failure to unfold quietly without ever touching the technical defenses

Attack Surface 2: Trusting the Interface Too Much

Human-in-the-Loop decisions depend heavily on what people see on screens:

• Dashboards
• HMIs
• Confidence scores
• Risk levels
• “Recommended action” messages

Attackers increasingly focus on how information is presented, not just on the data itself.

If a system says:

• “Low risk”
• “85% confidence”
• “Safe to defer maintenance.”

Most people instinctively trust those signals. This is not traditional data poisoning; it is trust poisoning, and it remains a blind spot in most OT security programs

Attack Surface 3: When AI Quietly Becomes the Authority

In experienced plants, operators traditionally rely on:

• Their training
• Their experience
• Their intuition

Industry 5.0 slowly changes that balance.Over time, the message becomes:

“The AI has more data than you.”

As a result:

• Operators challenge recommendations less
• Overrides become rare
• Manual checks disappear

The human may still be described as “in the loop,” but in reality, control has quietly shifted away. As trust in the system grows, even a flawed AI recommendation can pass through without being challenged or questioned.

Attack Surface 4: No One Clearly Owns the Decision

When AI suggests an action and a human approves it, responsibility becomes unclear.

After an incident:

• Vendors blame misuse
• Operators blame the AI
• Engineers blame the configuration
• Security says no breach occurred

This lack of ownership is a security weakness. Attackers benefit when:

• Decisions don’t have clear owners
• Overrides aren’t logged properly
• Accountability is assumed instead of defined

Human-in-the-Loop systems without strong accountability create perfect blind spots.

Attack Surface 5: Increased Insider Risk

Industry 5.0 assumes humans add ethics and responsibility.

From a security perspective, humans also add unpredictability.

A malicious or compromised insider no longer needs:

• PLC access
• Network credentials
• Administrative privileges

They only need:

• Approval authority
• The ability to override AI decisions
• “Operational discretion”

Human-in-the-Loop design unintentionally amplifies insider impact.

Attack Surface 6: Pressure-Based Decision Exploits

Most HITL decisions are made under stress:

• During alarms
• During outages
• During peak production
  During shift changes

Attackers exploit timing, not technology.

They create situations where:

• Decisions must be made quickly
• Humans choose speed over analysis
• Oversight is reduced

Urgency defeats even the best security controls.

Why Traditional OT Security Doesn’t Catch This

Firewalls cannot protect human judgment, intrusion detection systems cannot detect hesitation, and Zero Trust architectures offer no defense against misplaced confidence in human decision-making.

These risks exist above the network layer:

• In workflows
• In authority structures
• In cognitive bias
• In governance gaps

Most OT risk assessments never look there.

What Securing Human-in-the-Loop Really Means

This problem is not solved by:

• Better AI models
• More dashboards
• Generic training sessions

It requires treating human decisions as security-critical events. That means:

• Clear ownership of AI-assisted decisions
• Logging and auditing human overrides
• Dual approval for high-impact actions
• Showing uncertainty, not artificial confidence
• Limiting who can intervene and when
• Preparing incident response plans for bad decisions, not just breaches

The Reality of Industry 5.0

Industry 5.0 did not automatically make industrial systems safer; instead, it made attacks quieter, more subtle, and harder to detect. Human-in-the-Loop AI is not an inherent safeguard but a new attack interface, one that rarely shows up in logs or security alerts. Until organizations recognize human judgment as part of the attack surface, Industry 5.0 will remain intelligent and human-centric, yet dangerously exposed.