Intrusion detection in Industrial Internet of Things (IIoT) environments is a risk-asymmetric problem: false alarms increase analyst workload, but false negatives may allow malicious activity to persist in safety- and operation-sensitive systems. Although recent deep learning-based intrusion detection systems report high aggregate accuracy, near-ceiling performance can obscure the residual errors that remain under class imbalance and fine-grained label settings. This study investigates missed-attack-risk-oriented IIoT intrusion detection through CKAN-AFG, a compact non-recurrent Kolmogorov–Arnold Network (KAN)-centered architecture that combines KAN-based feature transformation, residual multi-head feature attention, feature gating, adaptive pooling, and a compact KANLinear classifier. The model is evaluated on the CIC IIoT Dataset 2025 (DataSense) as the main benchmark, with TON-IoT used as a secondary benchmark for cross-dataset comparison and continuity with prior IIoT evaluation. The evaluation uses a leakage-controlled repeated-seed protocol with fold-confined RF-RFE, a final 55-common-feature DataSense protocol, operational error decomposition, KAN-isolation and component-level ablation, repeated-seed stability analysis, and CPU-based deployment-oriented profiling. Under the final DataSense protocol, CKAN-AFG achieves a weighted F1-score of 99.8146% and an FNR of 0.2636%, corresponding to an approximately 5.6% relative FNR reduction compared with the CKAN–BiLSTM continuity baseline. Operational error decomposition shows that CKAN-AFG produces the lowest attack-to-benign count, with 33.8 mean true missed attacks, and the lowest total off-diagonal error count among the retained models. KAN-isolation results show that replacing the KAN-specific feature-transformation and classifier components with conventional CNN or LSTM alternatives increases FNR, while removing attention, feature gating, or both also degrades the false-negative-aware profile. CPU profiling shows that CKAN-AFG remains compact, with 247,005 trainable parameters, a 0.956 MB FP32 footprint, and throughput of approximately 1,691 samples/s under CPU-only profiling. These findings suggest that compact KAN-centered feature refinement can provide a practical operating point for missed-attack-risk-oriented IIoT intrusion detection while avoiding overclaims of universal dominance or direct zero-shot transfer.