OT cybersecurity: Geopolitical risks and resilience: PwC

Key takeaways:

Geopolitical tensions and advancing AI capabilities are making operational technology (OT) a more attractive and accessible target for cyber attacks, increasing the risk to critical infrastructure, safety, and business operations.

Technology debt, especially prevalent in OT systems, compounds that risk, making regular reviews of vulnerabilities essential.

Organizations should align leadership on responsibilities and resources, implement strong network segmentation, gain clear visibility across their environments, and limit internet exposure of control systems and critical OT.

To build long-term operational resilience, organizations should assess their OT cybersecurity maturity and scale capabilities over time.

Owners and operators of industrial and critical infrastructure face escalating cyber threats from foreign state-linked threat actors, cybercriminals, and hacktivists. Sophisticated actors are developing capabilities to disrupt physical processes, while AI-assisted tools are lowering the technical barriers for less capable adversaries to target industrial control systems.

In August 2026, five US agencies warned that threat actors were using AI-generated exploitation scripts disguised as legitimate monitoring tools to target programmable logic controllers (PLCs). In the past year, cyber threat actors have disrupted industrial operations in the US and other countries through ransomware, exploitation of internet-facing devices, and coordinated destructive attacks. Nation-state threat actors are conducting long-term campaigns, using credential harvesting and living-off-the-land (LOTL) tactics to infiltrate IT and OT systems for sabotage, espionage, or both. At the same time, AI systems in the wrong hands are finding end-of-life and unpatched systems to exploit.

Recent incidents show how these threats are affecting organizations across critical infrastructure and industrial sectors:

What happened: Threat actors exploited a security flaw in refrigeration control panels, affecting multiple supermarket chains across Europe. These panels often manage several refrigeration units and are typically set up to be accessed from any location, leaving them reachable over the internet. France's Computer Security Incident Response Team (CERT-FR) reported many compromised remote controllers and the vendor said the affected units ran outdated firmware. The attack followed refrigeration failures in August at commissaries on at least six US military bases, where freezers also entered defrost mode and spoiled inventory. US military investigators are treating the incidents as a suspected cyber attack.

Impact: Freezers and refrigerators at affected stores in Europe reached 50°C (122°F), causing spoilage. Industry estimates place total losses in food waste and structural damage in France at tens of millions of euros.

Learn more

What happened: A wave of attacks targeted internet-exposed PLCs at US water utilities, including systems in Minnesota and at two small Colorado utilities. These attacks were largely orchestrated through direct connection to equipment and PLCs. In Colorado, configuration settings were changed directly on equipment, disabling remote access and alarms and altering pumping cycles.

Impact: Attackers changed PLC configurations and credentials, causing operator lockouts, manual operations, and boil-water notices. Minnesota authorities reported malicious activity affecting remote monitoring and control technology. In Colorado, attackers manipulated equipment controlling drinking-water systems.

Learn more

What happened: Attackers launched a coordinated cyber attack against Polish energy sector organizations, including renewable energy facilities, a large combined heat and power (CHP) plant, and a manufacturing company. At the manufacturing company, attackers gained unauthorized privileged access to the environment using credentials exfiltrated through a script deployed on a perimeter device. A later investigation disclosed a parallel attack on a second, smaller CHP plant, where attackers used a private APN to gain access to the OT network.

Impact: Thirty wind and solar facilities temporarily lost remote monitoring, communications, and control, and affected systems required manual restoration. At the smaller heating plant, a steam turbine and a water treatment system were shut down, disrupting the cogeneration process that produces electricity and community heating at the same time.

Learn more

As threats to OT environments evolve, security strategies are being tested, and many organizations are struggling to protect critical systems. These challenges go beyond individual threats. They expose interconnected weaknesses in governance, operations, compliance, and physical security that can compound OT cyber risk. Broader pressures, including geopolitical conflict, regulatory change, legacy technology, and physical security exposure, can intensify those weaknesses. Understanding how these pressures intersect helps organizations move from reactive security measures to proactive, resilient OT security.

OT systems remain exposed to disruption in global cyber conflict. Sometimes they’re the intended target, sometimes collateral damage.

Critical infrastructure organizations continue to face challenges with vulnerable OT systems, particularly as frontier AI models mature.

Critical infrastructure sectors such as energy, utilities, and transportation remain strategic cyber targets.

Companies in industries such as manufacturing, aerospace, and consumer products face spillover risk from similar challenges and shared original equipment manufacturer (OEM) components and supply chains.

Ransomware groups are targeting OT environments to disrupt production and safety systems.

Governments and industry groups are issuing stricter cyber and OT-specific security requirements and standards, but not consistently across borders. For organizations operating in multiple countries, that can mean designing different architectures to meet local regulations, managing suppliers and vendors differently by site, and applying protections unevenly based on local interpretation of regulations.

The EU’s NIS2 Directive expands mandatory controls for critical infrastructure organizations as well as incident reporting timelines and executive accountability.

US agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the Transportation Security Administration (TSA), and the Environmental Protection Agency (EPA), are introducing OT-specific expectations for resilience and incident response.

IEC 62443 is becoming a global cyber standard for industrial automation and control systems (IACS), but adoption varies widely. A recent update underscores the importance of adopting consistent standards across critical infrastructure industries.

Decades-old OT systems carrying tech debt are being connected to modern digital infrastructure, making vulnerabilities remotely accessible.

Many OT environments were designed with a focus on operational efficiency, not security.

Third-party integrators, vendors, and maintenance providers often access OT networks, frequently remotely. That extends the attack surface and introduces risks that are difficult to monitor or control. High-profile supply chain attacks such as Axios npm and LiteLLM show how these vulnerabilities can have major downstream impacts on OT environments.

Edge computing for on-site analytics and data modeling can create new, highly connected endpoints inside OT environments, often without the hardened security controls applied to core systems.

OT systems often need people on site to operate and maintain them, making physical access a key risk. Unlike IT systems in secure data centers, OT equipment can be spread across many sites with varying security controls, and employees without a security background sometimes maintain it.

OT assets sit in factories, plants, and other critical infrastructure sites that often lack strong physical security or monitoring controls.

People on site, including operators, contractors, and vendors, can bypass controls or make errors that put systems at risk.

Physical access can give attackers a way to connect directly to devices (USB plug-and-play, direct connection, etc.), tamper with equipment, or introduce malware.

Commonly overlooked aspects of OT cybersecurity

While many organizations are making progress on OT cybersecurity, significant gaps can still hide in plain sight. These aren’t technical lapses but governance, visibility, and organizational weaknesses that can undermine otherwise strong security measures.

IT/OT convergence
Issue: IT and OT systems continue to converge, sharing networks, data flows, and infrastructure. Although OT environments are critical to revenue-generating processes and outputs, many organizations treat OT as separate from or subordinate to IT. That can lead to uneven security safeguards and an uneven allocation of resources and remediation investment. Convergence also creates pathways for IT-based threats to reach critical OT assets (and vice versa), often without adequate segmentation, visibility, or protection.

Action: Start by designing your strategy around the operational impact of convergence. Build the case for OT cybersecurity investment as a way to protect revenue-generating assets. Approach IT/OT convergence with security as a priority. Keep OT environments and network services as separate as possible to reduce the attack surface and limit the potential blast radius.
OT asset management
Issue: Many OT environments lack strong asset inventories because of limited network visibility, unmanaged networks, and a lack of telemetry compatible with modern security information and event management (SIEM) or network detection tools. Aging OT equipment often can’t tolerate intrusive monitoring, which restricts the use of active discovery methods. Without overall visibility, identifying vulnerabilities and applying security measures across the environment becomes challenging.

Action: Prioritize OT network security monitoring (NSM) solutions that enable passive scanning of network traffic. This approach helps generate reliable asset inventories, identify vulnerabilities, and produce alerts you can use to identify, monitor, and respond to threats. Review your environment with modernization in mind and choose components designed to support robust security controls.
Security ownership and skills
Issue: While responsibility for OT cybersecurity typically falls to the CISO, accountability for risk typically spans security, operations, engineering, and compliance. That fragmentation can lead to funding gaps, decision-making paralysis, and disorganized incident response. It can also undermine efforts to attract and retain the specialized, hybrid talent OT environments require. Many organizations struggle to find specialists who understand the unique mix of engineering, safety, security, and IT constraints. Without focused investment in training and development, and without leadership’s commitment to these efforts, gaps in skills and collaboration will likely continue to undermine OT security.

Action: Assign clear executive ownership with budget authority. Build specialized OT skills through cross-training and hands-on learning.
Vendor transparency and risk
Issue: Many critical OT systems are managed through opaque vendor relationships. OEMs control firmware updates, diagnostics access, and visibility into device behavior. That can leave internal teams with limited ability to investigate incidents, monitor assets, and confirm controls.

Action: Confirm that your vendor service level agreements (SLAs) include strong transparency and security provisions. Push for shared telemetry and access standards.
OT network segmentation
Issue: OT and IT networks are often commingled across flat networks, leaving both sides susceptible to attacks. OT network segmentation divides an organization’s OT environment into isolated security zones, helping reduce the risk of threats spreading across critical assets and processes. This structured approach can strengthen defenses by containing potential breaches, maintaining continuity of essential operations, and reducing disruption and financial impact during an attack.

Action: Adopt a recognized standard (such as ISA/IEC 62443) to assess risk and map critical process dependencies and data flows before establishing logical and physical zones. Implement an industrial DMZ to break direct communication between IT and OT, and enforce traffic filtering across all interconnecting conduits.
Cloud connectivity and edge devices
Issue: As part of digital transformation initiatives, organizations are pushing to move operational data and control capabilities to the cloud for predictive maintenance, AI-driven optimization, and remote operations. That can introduce new dependencies on internet connectivity, third-party cloud security, and identity federation across previously isolated environments.

Action: Build cybersecurity into your transformation plans by design. Incorporate network segmentation controls where technically feasible, limit internet exposure of control systems and critical OT, and monitor advances in edge security standards (e.g., O-PAS standards).

Building adaptable OT cybersecurity capabilities

Securing OT isn’t a one-time project. It’s an evolving discipline. Organizations should move beyond reactive fixes and toward a scalable, forward-looking OT cybersecurity program. The four tiers below build upon each other, adding the technical and governance maturity needed for long-term resilience.

Maturity model

Build the essential infrastructure and visibility to secure core OT environments.

Asset visibility and monitoring: Establish continuous, real-time monitoring of OT devices and systems, including unmanaged and vendor-owned assets, so you gain an accurate and dynamic understanding of your operational environment and can enable cyber monitoring.
Governance: Develop and implement a formal OT cybersecurity governance framework that defines operational models; clarifies roles and responsibilities using responsible, accountable, consulted, informed (RACI) matrices; establishes robust policies; and sets enforceable standards with executive oversight.
Incident response plans: Build OT-specific playbooks for cyber events that involve industrial systems and run cross-functional tabletop exercises.
Board-level oversight: Include OT cyber risk in board-level risk reporting and strategic planning discussions.

Move from visibility to response. Strengthen operational readiness to detect and contain threats.

Network segmentation: Create strong perimeters between IT and OT networks to help limit cross-contamination and lateral threat movement.
Vulnerability management: Identify and assess known vulnerabilities in OT systems, even when patching isn’t possible, and apply compensating controls.
Secure remote access: Implement strong remote access controls tailored for OT environments, including multifactor authentication, encrypted communication channels, and strict access permissions to protect against unauthorized intrusion.
Integrated risk management: Embed OT cybersecurity risk management into the broader enterprise risk framework, creating ongoing identification, assessment, and mitigation of OT-specific risks aligned with business objectives.

Shift from detection to proactive defense, reducing attacker dwell time and enhancing visibility.

Threat detection: Deploy sensors and analytics to monitor for abnormal behavior across OT environments.
Resiliency: Design backups to be secure and tested, so you can restore operations after a cyber event, not just a technical failure.
Identity and access management and active directory segmentation: Implement strong identity and access management (IAM) controls and segment directory services to limit access and reduce the attack surface within OT environments. Enforce multifactor authentication throughout your systems, even on service accounts machines use to log in.
Microsegmentation within OT networks: Limit movement within OT environments by creating internal zones of control tied to function and risk.

Embed OT cybersecurity into enterprise risk and governance structures at the highest level.

Metrics and automated reporting: Define and track key OT cybersecurity performance indicators and implement automated reporting systems that provide timely, actionable insights for continuous improvement and executive oversight.
Targeted training and awareness: Develop and deliver specialized training on OT cybersecurity risks, leading practices, and operational constraints to build staff competence and reduce human error.
Third-party risk management: Establish more defined and rigorous processes to assess and manage cybersecurity risks posed by OT vendors and service providers, including contract requirements, transparency, and shared security responsibilities.
Compliance certification readiness: Prepare for formal audits or certifications tied to regulations and standards (e.g., NIS2, IEC 62443, ISO 27001 extensions).