Geopolitical shifts amplify OT security risks

Industrial and critical infrastructure systems are facing mounting cyberattacks from foreign adversaries, cybercriminals, and activists. Malware targeting OT environments is becoming more sophisticated and AI-enabled, disrupting numerous areas from energy grids to manufacturing and logistics. Nation-state rivals are running long-term campaigns, using credential harvesting and living-off-the-land (LOTL) tactics to infiltrate IT and OT systems for sabotage and/or espionage. Recognising these evolving threats, the US and other countries recently issued joint guidance outlining principles for the secure integration of AI into operational technology to help reduce emerging risks.

Some examples of recent OT attacks:

• Jaguar Land Rover manufacturing disruption (March 2025): A cyberattack disabled manufacturing operations, causing major production outages and exposing vulnerabilities within automotive supply chains.
• US water and wastewater infrastructure exploitation (September 2024): Threat actors used basic tactics to exploit vulnerabilities in critical water and wastewater systems, underscoring ongoing risks to essential services.
• Ukraine power grid attacks (2024–2025): Multiple cyberattacks throughout this period disrupted power distribution, leading to significant outages and highlighting the vulnerability of energy infrastructure in conflict zones.
• US electrical substation attacks (2023): Cyber intrusions targeted substations in California and North Carolina, raising alarms over the security of the nation’s electrical grid.
• Israel-Iran cyber conflict (2024–2025): Ongoing cyberattacks targeting critical infrastructure illustrates the geopolitical tensions and risks to OT environments in this region.

As these threats to OT environments evolve, security strategies are being tested, leaving many organisations struggling to protect critical systems. The challenges often go beyond individual threats, touching on weaknesses in governance, operations, compliance, and physical security that form an interconnected web of vulnerability. Understanding where these pressures collide is key to moving from reactive firefighting to proactive, resilient security.

While many organisations are making progress on OT cybersecurity, significant gaps can still hide in plain sight. These aren’t technical lapses, they’re governance, visibility, and organisational weaknesses that can undermine otherwise strong security measures.

1. IT/OT convergence
   IT and OT systems continue to converge, sharing networks, data flows, and infrastructure. Although OT environments are critical for revenue-generating processes and outputs, many organisations treat it as a domain that's separate from or subordinate to IT. This can lead to uneven security safeguards, investment in remediation, and allocation of resources to address this issue. What’s more, convergence introduces pathways for IT-based threats to reach critical OT assets (and vice versa), often without adequate segmentation, visibility or protection.
   To address these vulnerabilities, start by designing your strategy around the operational impact of convergence. Build the case for investment in OT cybersecurity as a way to protect revenue-generating assets. Approach IT/OT convergence with security as a priority. Keep OT environments and network services as separate as possible to help reduce the attack surface and limit the potential blast radius.
2. OT asset management
   Many OT environments lack strong asset inventories due to limited network visibility, unmanaged networks, and a shortage of telemetry compatible with modern SIEM or network detection tools. Moreover, aging OT equipment often cannot tolerate intrusive monitoring, restricting the use of active discovery methods. Without overall visibility, it can become challenging to apply security measures across the environment.
   
   To overcome these challenges, prioritise implementing OT network security monitoring (NSM) solutions that enable passive scanning of network traffic. This approach helps generate reliable asset inventories, identify vulnerabilities and produce alerts that can be used to identify, monitor, and respond to threats within your connected OT environment.
3. Security ownership and skills
   While responsibility for OT cybersecurity typically falls to the CISO, accountability for risk typically spans security, operations, engineering, and compliance. This fragmentation can lead to funding gaps, decision-making paralysis, and disorganised incident response. It can also undermine efforts to attract and retain the specialised, hybrid talent that OT environments require. Many organisations struggle to find specialists who understand the unique mix of engineering, safety, and IT constraints. Without focused investment in training and development, and leadership commitment to these efforts, gaps in skills and collaboration will likely continue to undermine OT security.
   
   Getting ahead of this can require assigning clear executive ownership with budget authority. It also requires developing specialised OT skills through cross-training and practical learning opportunities.
4. Vendor transparency and risk
   Many critical OT systems are managed through opaque vendor relationships. OEMs control firmware updates, diagnostics access, and visibility into device behaviour. This can leave internal teams with limited ability to investigate incidents, monitor assets, or confirm controls.
   
   To manage this risk, confirm that your vendor SLAs include strong transparency and security provisions. Push for shared telemetry and access standards.
5. OT network segmentation
   OT and IT networks are often comingled across flat networks, leaving both sides susceptible to attacks. OT network segmentation divides an organisation’s OT environment into isolated security zones, helping reduce the risk of threats spreading across critical assets and processes. This structured approach can strengthen defences by containing potential breaches, maintaining continuity of essential operations and reducing financial impact during an attack.
   
   To implement segmentation within your OT environment, divide the shopfloor into multiple security zones. This helps to contain potential breaches, protect critical processes, and reduce operational disruption in the event of an attack.
6. Cloud connectivity and edge devices
   As part of digital transformation initiatives, organisations are pushing to move operational data and control capabilities to the cloud for predictive maintenance, AI-driven optimisation and remote operations. This can introduce new dependencies on internet connectivity, third-party cloud security, and identity federation across previously isolated environments.
   
   As digital transformation initiatives continue to increase connectivity within operational environments, it’s important to build cybersecurity into your transformation plans by design. Incorporate network segmentation controls, where technically feasible, and monitor advancements in edge security standards (e.g., OPAS standards).

Securing OT isn’t a one-time project, it’s an evolving discipline. Organisations should move beyond reactive fixes and toward a scalable, forward-looking OT cybersecurity programme. Below is a four-tiered approach to secure your OT environments, with each level building the technical and governance maturity required for long-term resilience.

Maturity model