OT and ICS Security in 2026: Why the Networks Running Water, Power, and Factories Became the Softest Target in Enterprise Technology
- Internet Pros Team
- August 12, 2026
- Networking & Security
Most security budgets are still shaped by an assumption that stopped being true years ago: that the valuable, exposed systems are the ones running email, finance, and customer data. Meanwhile, the equipment that actually produces revenue - the pumps, boilers, conveyors, chillers, filling lines, and elevator controllers - sits on networks built by people who were solving a completely different problem. Those systems were designed for determinism and uptime, not for a hostile network, and in 2026 almost all of them are on one.
Two Networks, Two Completely Different Rulebooks
The single biggest cause of failed industrial security programs is importing an IT playbook wholesale. The two environments share protocols and hardware vendors, but almost nothing about their priorities matches.
| Dimension | Traditional IT | OT / ICS |
|---|---|---|
| Top priority | Confidentiality of data | Availability and physical safety |
| Asset lifespan | Three to five years | Fifteen to thirty years, sometimes longer |
| Patching | Monthly, largely automated | During a scheduled outage, if the vendor allows it at all |
| Downtime cost | Inconvenient | Measured per hour, occasionally in safety terms |
| Scanning | Routine and harmless | Can crash a controller that has run fine for a decade |
That last row is not folklore. Plenty of older programmable logic controllers have fragile network stacks, and an ordinary vulnerability scan has been enough to fault them. This is why an engineer who has been running a plant for twenty years pushes back on a security team that wants to "just run a scan" - and why the security team, having never watched a line stop, reads the pushback as obstruction.
Why the Air Gap Stopped Being Real
Ask most organizations about their control network and you will hear that it is air gapped. Walk the plant and the gap turns out to be a story people tell about a network diagram drawn a long time ago. In practice it has been eroded by ordinary, reasonable business decisions:
- Production data needed to reach the business. Dashboards, OEE reporting, and predictive maintenance all require the historian to talk to something on the corporate side.
- Vendors needed remote access. Equipment support contracts increasingly assume the manufacturer can dial in, and that access is often a shared account with a standing tunnel.
- Cellular quietly bypassed everything. Modern equipment ships with an LTE or 5G modem for telemetry, creating a path that never appears on the firewall the security team manages.
- Someone needed a file moved. USB drives and engineering laptops remain the most reliable transport layer in any industrial facility.
- Buildings got smart. HVAC, access control, lighting, and metering are now IP systems, frequently installed by a contractor and never handed to anyone in IT.
The air gap rarely fails all at once. It fails one justified exception at a time, and nobody ever redraws the diagram.
What Attacks Actually Look Like
Industrial incidents get reported as though every one involves a nation-state writing custom controller malware. A small number do. The overwhelming majority are far less exotic, which is good news, because unglamorous attacks are stopped by unglamorous controls.
The Common Pattern
The most frequent scenario is not an attack on the control system at all. Commodity ransomware lands on the corporate network through a phished credential or an unpatched edge device. The control network is technically separate, but nobody can prove how separate, so production is halted as a precaution while the environment is assessed. The plant stops for days without a single controller being touched. The financial damage is identical to an OT attack, and it is caused by the absence of confident segmentation rather than by the malware.
The Direct Route
When control systems are reached directly, the entry point is usually mundane: a human-machine interface exposed to the internet with a default password, a vendor remote access tool with no multi-factor authentication, or a flat network where a compromised office laptop can reach a controller because the two were never separated. These require no specialized knowledge of industrial protocols, because most of those protocols have no authentication to defeat - a valid command from a reachable device is simply obeyed.
The Controls That Actually Move the Needle
The published frameworks - IEC 62443 above all - are worth following, but a program has to start somewhere. In order of return on effort:
- Know what is there. Nearly every industrial environment contains devices nobody can account for. Passive discovery, which listens to network traffic rather than probing it, builds an inventory without the risk of active scanning. You cannot protect an asset list you do not have.
- Segment, then prove it. A firewall between the corporate network and the control network, with an intermediate zone for shared services such as the historian and remote access broker, is the highest-value control available. Then test it - the assumption that a rule set matches the diagram is wrong more often than not.
- Fix remote access first. Shared vendor credentials with permanent tunnels are the most common serious finding in any assessment. Replace them with brokered, time-limited, individually attributed, multi-factor sessions that are recorded.
- Back up what nobody thinks to back up. Servers are backed up. Controller logic, HMI projects, drive parameters, and engineering workstation configurations usually are not - and those are exactly what you need to rebuild a line. Store them offline and verify a restore.
- Monitor passively. Industrial traffic is highly repetitive, which makes anomaly detection far more effective here than on a corporate network. A controller that suddenly receives a configuration write outside a maintenance window is a genuine signal, not noise.
- Accept that some things will never be patched. An unsupported operating system running a critical process is not always fixable this budget cycle. Isolate it, restrict what can talk to it, monitor it closely, and document the decision - compensating controls honestly applied beat a patch plan that everyone knows is fiction.
A Realistic First 90 Days
Walk the facility with an operations engineer and write down every network connection into and out of the control environment, including cellular modems and contractor-installed building systems. Pull the firewall rules and compare them to what you found. Inventory every remote access path and who owns it. Then confirm you can restore one production line from backups without the original vendor on site.
That work needs no new product, and it routinely uncovers more real risk than a year of tooling. The organizations that handle industrial incidents well are almost never the ones with the most software - they are the ones whose IT and operations teams had already met, agreed on who makes the shutdown call, and rehearsed it.
Regulation Is Closing the Gap Between Advice and Obligation
For most of the last decade, industrial security guidance was voluntary and therefore competed with every other capital request. That is changing. Sector rules across energy, water, and manufacturing increasingly carry incident reporting deadlines and named accountability, and IEC 62443 is showing up in procurement language - which shifts part of the burden onto equipment vendors, where a good deal of it always belonged. If your customers are large industrial buyers, expect security questionnaires about your own products and services to become steadily more specific.
The Honest Summary
Operational technology is not insecure because the people running it were careless. It is insecure because it was engineered brilliantly for a threat model that no longer applies, and then connected to the internet incrementally by people solving legitimate problems. The fix is not to bolt an IT security stack onto a plant floor and hope nothing stops. It is to rebuild the boundary deliberately, know what is behind it, control who crosses it, and be able to recover when something does.
If your organization runs anything physical - a production line, a warehouse, a fleet, a building full of connected systems - the useful question this year is not whether your control network is secure. It is simpler and more uncomfortable: can anyone in the building draw the current diagram, and would the firewall agree with it?
