Cybersecurity in the mining supply chain has a peculiarity that is not repeated in many other industries: the same companies that compete daily for the price of copper and lithium sit down together to share how they are being attacked.
That was the starting point of the panel «Digital Mining: Cybersecurity in the Era of Automation and Autonomy» of the Industrial Cyber Summit Chile 2026, Moderated by Fernando Lucchini, executive director of the Mining Cybersecurity Corporation (CCMIN), with Carlos Schipmann (IM Regional Delivery Manager Copper at Anglo American), Miguel Ángel Elizondo (CISO of Antofagasta Minerals) and Álvaro Pizarro (Head of IT Services at SQM).
The context that Lucchini put on the table is stark: Chile is the world’s largest copper producer and concentrates more than 50% of the global lithium reserves. That makes Chilean mining infrastructure by definition critical, and a hyperconnected industry, where autonomous trucks, exploration drones, and remote operation centers multiply the attack surface at a pace that none of the three panelists described as «under control.».
The problem is not the technology, it is the behavior.
Schipmann was the first to name something that the other two later confirmed: the main cybersecurity incident at Anglo American today is not a technical failure, it is a behavioral one. All the awareness-raising work they have been doing, he said without hesitation, «is not being enough.» And that behavior does not stop at the employees themselves: it includes the contracting and subcontracting companies that operate within the enterprise, with access to systems and data as sensitive as those of internal personnel.
Anglo American’s response was to require that every company that brings in a system or handles data sign a cybersecurity annex in their contract, and then assess which of each provider’s services are critical to identify gaps and build up plans for immediate action. Schipmann was clear on the underlying goal: not all companies in the chain have the same level of maturity, so they need to «level the playing field with minimum standards» before that maturity gap becomes an entry point for an attacker.
When IT and OT speak different languages
Miguel Ángel Elizondo identified the second major challenge as the convergence of IT and OT, which he described as a «turning point» for which the mining industry was unprepared. The reason, he explained, is almost cultural: IT is a more developed and open world, while OT — the SCADA systems, the trucks, the physical assets of the mine— is traditionally more static and closed. Making these two philosophies coexist within a single security strategy was, in Elizondo’s words, as difficult as convincing the organization itself that cybersecurity involved additional steps, from hiring specialists to investing in technology that was previously not considered necessary.
Álvaro Pizarro, from SQM, agreed that IT and OT remain «completely different worlds» that start from different assumptions about what needs to be protected. His recipe was not technological but organizational: setting up discussion tables where both worlds understand their positions, incorporating IT teams into collaborative initiatives such as CCMIN, and resolving the balance between innovation—the technology plants need, teleoperation—and cybersecurity, always prioritizing availability, along with confidentiality and integrity.
«Active waiting»: how SQM decides when to get involved in AI
One of the most concrete concepts left by the panel was the term «active waiting,» which Pizarro uses to describe SQM’s stance regarding the adoption of artificial intelligence. The company’s conscious decision is not to commit to long-term positions yet or lock in with a single AI provider, because models evolve too quickly to bet everything on one. Instead, SQM is taking small but constant steps, preparing to migrate services to the cloud and maintain others on-premises, with segmentation and zero trust as the foundation: knowing what assets exist and where they are before deciding how to monitor them.
Schipmann offered the other side of the same coin. For miners, he said, the question of whether to move forward with AI no longer exists: the decision has been made, and much of the price of copper itself is driven by the demand generated by artificial intelligence globally. The real question, the three agreed, is how to adopt it responsibly, and that responsibility is directly aligned with each organization’s cybersecurity maturity.
| Panelist | Company | Central challenge pointed out |
|---|---|---|
| Carlos Schipmann | Anglo American | Unequal maturity of suppliers in the supply chain |
| Miguel Ángel Elizondo | Antofagasta Minerals | Cultural and technical convergence between IT and OT |
| Álvaro Pizarro | SQM | Responsible and gradual adoption of AI («active waiting») |
Source: panel «Digital Mining: Cybersecurity in the Era of Automation and Autonomy», Industrial Cyber Summit Chile 2026.
CCMIN: why it is advantageous for competitors to join forces
The figure of CCMIN permeates much of the conversation, and not by chance. Lucchini explained the logic from the perspective of the corporation: today there are seven major mining companies participating, and in the future there could be twenty or thirty. For a technology provider that provides services to several of them, it is much simpler to report an incident to CCMIN once than to coordinate separately with each affected miner. That centralization not only saves time: it improves the response speed of the entire industry in the face of a single attacker who, as Pizarro described with a vivid image, «is like a black cloud that moves around everywhere,» while the defenders are just learning to build their own cloud to defend themselves in a coordinated manner.
That same collaborative logic is activated when an incident has already occurred. Schipmann recounted that when Anglo American identifies a gap in a supplier, the protocol is not punitive but of alliance: they immediately get in touch and work together, based on the understanding that anyone can be affected and that what really matters is how they react, how they detect it and how they recover the operation. In cases where warranted, they must also inform the National Cybersecurity Agency (ANCI), because many of these companies are Critical Infrastructure Operators under the new regulations. Law 21.663.
New regulatory frameworks as allies, not as obstacles
Elizondo was particularly direct about the impact of the cybersecurity framework law and the upcoming Personal Data Protection Act on Antofagasta Minerals: rather than imposing specific solutions, those frameworks served to confirm or correct the path the company had already been following, and to internally leverage the conversation with management and users about what controls and behaviors to adopt. His assessment of the standards was positive, although he acknowledged that «there are always hands missing» to bring theory into practice, especially in an industry where stopping operations to conduct a cyberattack simulation is extremely costly.
Lucchini connected that point to something that the national director of ANCI, Michelle Bordachar, had said that same morning in her own opening talk: «let's go back to the basics». It's the same idea that runs through this entire panel about Cybersecurity in critical infrastructuresNeither the most sophisticated technology nor the most comprehensive regulatory framework are of much use if the awareness of the teams—both internal and across the entire supply chain—does not become ingrained as a daily habit.
The closing of the panel fell to Elizondo, with a phrase that sums up the spirit of the entire talk: in cybersecurity, you should never be arrogant, because no one is 100 percent protected, and the correct question is not whether something will happen, but how quickly the organization—and its entire supply chain—will realize, react, and recover when it does. For those who want to delve deeper into how this same IT/OT convergence challenge is addressed in other critical infrastructure sectors, it is also worth reviewing the work of Segmentation of IT/OT networks that Cyber Summit has been publishing.
