Everything this series has celebrated — connected instruments, unified namespaces, cloud twins, AI agents — has a shadow. Every connection is an attack path. And the attackers have noticed.
Industry reporting has put manufacturing at the top of the most-attacked sector tables for five consecutive years, with ransomware incidents against industrial organisations up more than 60% in 2025, affecting roughly 3,300 organisations. These are figures from annual threat reports rather than our own measurements, and the underlying counts differ between publishers. Direction and order of magnitude, not decimal places.
This is not an IT-department problem. When the plant stops it is an everyone problem — and increasingly a board problem with regulatory teeth.
Why OT security is not IT security with hard hats
The two disciplines want opposite things first, and almost every practical disagreement between them traces back to this one inversion.
- Confidentiality
- Integrity
- Availability
- Safety
- Availability
- Integrity, then confidentiality
Because the worst outcome is not a leaked file but a tripped plant or a hurt person, the consequences cascade. You cannot simply patch a controller on Tuesday: it may not restart cleanly, and the vendor may void support. You cannot run aggressive scans against fragile legacy devices, because some of them fall over when probed. Equipment lifecycles run twenty to thirty years, so Windows XP boxes still hum away behind glass.
Every OT security control has to answer one prior question: does this keep the plant running and the people safe?
How attackers actually get in
The romantic image is a nation state burrowing through a firewall. The statistical reality is duller. Attackers walk through the connections convergence created: compromised IT networks that bridge into OT, remote-access tools set up in a hurry during COVID and never hardened, a contractor’s laptop, a vendor’s update server, the engineering workstation that browses the internet at lunch.
Supply chain is the fastest-growing vector in the same reporting, with third-party incidents roughly doubling in 2025 and about 70% of organisations reporting at least one material third-party incident in a year. Again: reported figures, not ours.
AI is accelerating the attacker side too — better phishing, faster vulnerability discovery — which raises the tempo of the whole contest rather than changing its shape.
The playbook: boring, layered, effective
The good news is that the defence playbook is mature and standardised. IEC 62443, the reference framework for industrial control system security, organises the plant into zones — groups of assets with similar criticality — connected only through conduits, which are controlled and monitored pathways. Segmentation along these lines is the single most effective defence against lateral movement.
Around that core sit five unglamorous things. A plant either has them or it does not.
An accurate asset inventory. You cannot defend what you do not know exists, and most sites discover they own more than they thought.
Hardened, monitored remote access. The single most common way in, and the one most often set up under time pressure.
OT-aware network monitoring that understands industrial protocols, rather than IT tooling that treats them as noise.
Tested, offline backups. The word doing the work is tested.
An incident-response plan rehearsed with operations, not only with IT. The people who will be running the plant at 3 a.m. need to have done it once already.
Regulation is forcing the pace. The EU’s NIS2 directive places cybersecurity obligations on essential and important entities, including personal liability for management, with IEC 62443 and NIST 800-82 as the auditable baselines of choice.
A note for engineers early in their careers
OT security may be the single best specialisation bet of the decade. Demand is desperate, supply is thin, and the skill set — control systems fluency plus security discipline — is close to impossible to hire ready-made. You cannot teach a security specialist what a trip means to a running column in a fortnight, and you cannot teach a control engineer threat modelling in one either. Whoever holds both gets to name their price.
Key takeaways
- Manufacturing has topped the most-attacked sector tables for five years running, with industrial ransomware reported up more than 60% in 2025.
- OT security inverts IT priorities: safety and availability first. Patching, scanning and response all work differently as a result.
- The real attack paths are convergence paths — IT-to-OT bridges, remote access, and the supply chain.
- IEC 62443 zones and conduits, plus asset inventory, monitored remote access, OT-aware detection and rehearsed response, is the proven playbook.
- NIS2 makes it a legal obligation in the EU, with personal liability for management.
- OT security is arguably the decade’s best specialisation for control engineers.
What’s your take?
Has your site ever rehearsed an OT incident with operations in the room — or only with IT? Join the conversation.
A 12-part journey from the sensor to the self-driving plant.
All twelve parts — building from the 4–20 mA loop all the way to plants that run themselves. Brought to you by SynapseAI.
Not sure where your zones actually are?
We advise on OT security, industrial data architecture and digitalisation — vendor independent.