Out of Sight
There is a small box, somewhere you will never see it, with a blinking green light.
It sits in a pump house at a water plant, on a rail beside a bottling line, or in a substation feeding half a city. It does not look like the computers we see and use every day. It has no screen, no keyboard, and no apps. Instead, it does one thing: it reads the physical world and acts on it, opening a valve when pressure climbs, slowing a motor when a line backs up, or cutting the gas when the flame in a furnace goes out.
That box is a programmable logic controller (PLC). PLCs are a core building block of industrial control systems (ICS): the controllers, sensors, and software that run physical processes. Together with the networks that connect them, they make up operational technology (OT). While information technology (IT) moves data, OT moves matter. The water you drank this morning, the power in the wall, the fuel in your tank, the food on the shelf: none of it arrives without millions of these controllers doing their one job, quietly, around the clock.
OT is one of the largest and most consequential layers of technology, and it is largely unguarded. According to the most recent industry estimates, fewer than one in ten OT networks worldwide have meaningful security monitoring [1].
From Isolation to Exposure
OT systems were never built for the world they now operate in. The digital controllers that replaced mechanical relays and analog dials were designed to be self-contained: isolated within a single plant, communicating in private languages, and built with no notion of an attacker.
Over the past two decades, operators connected those once-isolated controllers to networks, and for good reasons. A sensor that flags a failing motor can save a plant millions by avoiding unplanned downtime. Remote access lets one expert cover twenty sites instead of driving between them. Data from equipment in OT environments turns invisible bottlenecks into measurable issues a plant could fix.
The gains were real, but so were the trade-offs. Connecting decades-old, unsecured controllers introduced risks that few had priced in.
The Falling Cost of an Attack
Whether a cyberattack could reach into the physical world and break something had been an open question outside the lab until 2010, when Stuxnet answered it. Stuxnet, the first landmark cyber-physical attack, was malware designed to sabotage Iran's nuclear program. Its target was air-gapped, deliberately cut off from any outside network, so the malware was carried in on a USB drive. Once inside, Stuxnet drove Iranian centrifuges past their limits until they tore themselves apart, all while feeding operators readings that looked perfectly normal. Stuxnet was the work of a nation-state, exquisitely engineered.
What has changed since Stuxnet is that an attacker no longer needs anything like that level of effort. The same connectivity that made plants more efficient stripped away the isolation Stuxnet had to defeat. Many controllers are reachable from the public internet, discoverable by anyone who looks, and some still run with the default passwords they shipped with. Remote access goes unsecured, credentials are shared and reused, and protections like multi-factor authentication remain sparsely used or unavailable. For a growing number of attackers, breaking in is barely an obstacle because so many doors are already left open.
The Shrinking Window
As these attacks multiply, the way operators have historically defended against them is starting to lose its footing. For as long as anyone has secured these environments, the working assumption has been that detection buys time: an attacker gets in, moves around, and somewhere in that window, a monitoring system flags an anomaly and an incident response team steps in before real harm is done. That assumption, however, is breaking down. AI is changing how attackers work, automating the slow, manual reconnaissance that once took weeks of skilled effort and steadily compressing the time between gaining access and causing damage.
As that window shrinks, a defense built around detection and response starts to look like a carbon monoxide detector that only sounds once the level in the house is already fatal. It is working exactly as designed, but it arrives too late to matter.
That is why OT security has to change. Instead of waiting to detect an attack in progress, the focus must shift to hardening systems against the weaknesses that make them easy to compromise.
The challenge, however, with hardening OT systems is that the methods built for IT, refined over twenty years, fall apart in OT. Why they fail, and what works in their place, is what we will discuss next.
[1] Dragos, Inc. “OT Threat Landscape 2026: What OT Cybersecurity Defenders Need to Know.” Dragos Blog, March 24, 2026. https://www.dragos.com/blog/ot-threat-landscape-2026