You don’t have to run a power plant to have Operational Technology (OT). If your organization relies on elevators, building access systems, HVAC or backup generators, you have operational technology. Yet many security teams associate OT with critical infrastructure or industrial environments and don’t recognize it in their own buildings.
That means systems essential to keeping a building running may not get the same security attention as the rest of the organization’s technology.
Key takeaways
OT cyberattacks are no longer only a utility or manufacturing problem, because any organization with connected physical systems is exposed.
Attackers reach OT through internet-exposed devices, remote and vendor access, and IT compromises that spill into operations.
An attack does not have to touch a control system to stop physical work.
MITRE ATT&CK v20 now maps a real 2026 attack on U.S. water utilities step by step, giving defenders a ready-made scenario.
The first time IT and OT teams work an attack together shouldn't be during the attack.
What is OT?
OT is the hardware and software that monitors or controls physical processes. If IT moves data, OT moves the physical world: it makes things flow, heat, cool, open, shut and run.
At the center of OT sit industrial control systems (ICS). These are the parts most people picture:
SCADA (supervisory control and data acquisition) watches and controls equipment spread across wide areas, such as pipelines, water systems and power grids.
DCS (distributed control systems) run a continuous process inside one site, such as a refinery or chemical plant.
PLCs (programmable logic controllers) are rugged computers that run one step of a process, like opening a valve or starting a motor.
HMIs (human-machine interfaces) are the screens operators use to see and steer the process.
Sensors and actuators measure things like temperature and pressure, then move the valves, motors and pumps.
OT is wider than ICS. It also covers building automation, physical access control and other connected equipment. NIST's Guide to Operational Technology (OT) Security treats all of these as OT, with safety, reliability and performance needs that ordinary IT does not have.
The stakes are different because OT runs physical work. In IT, the first concern is usually protecting data. In OT, it is keeping people safe and processes running. A step as routine as rebooting a system to apply a patch can interrupt a process, and in some plants a restart takes hours of safety checks.
Many organizations that would never call themselves OT operators still run it. Think heating and ventilation, badge readers, elevators, cold storage, conveyors and gate systems. If a cyberattack can stop something physical in your business, you have OT.
Why are OT cyberattacks rising across every industry?
OT cyberattacks are rising because more physical systems are connected, ransomware groups use operational disruption to force payment, and many organizations still can't see much of their OT.
More connections mean more paths in. IT/OT convergence, remote monitoring, cloud services and cellular gateways now link systems that were once isolated. Each connection helps operations and also gives attackers a route. CISA has warned that operators, vendors and integrators sometimes install cellular modems that nobody documented.
Disruption raises the pressure to pay. Stopping production or services puts pressure on leadership fast. Dragos's 2026 OT Cybersecurity Year in Review counted roughly 3,300 industrial organizations hit by ransomware in 2025 and three new OT threat groups.
Visibility lags behind. Teams can't defend what they can't see. In Palo Alto Networks' 2026 critical infrastructure research, a survey of more than 1,600 security leaders, 68% said they lack full, real-time visibility of OT assets, and 74% said their IT and OT security operations are disconnected.
AI is speeding attackers up. Attackers use AI to accelerate reconnaissance, phishing and tool building. MITRE's latest update documents an AI-generated toolkit used in a breach that reached a municipal water utility.
How do attackers reach OT systems?
Most OT cyberattacks start somewhere ordinary: an exposed device, a remote connection, a vendor or an IT system that operations depend on. These five paths show up in nearly every industry.
Internet-exposed devices. PLCs, HMIs or building controllers reachable online, often with default passwords. Utilities, buildings and remote sites are most exposed.
Remote and vendor access. VPNs, remote desktop tools and third-party maintenance connections. Any operation with outside support is exposed.
IT compromise that spreads. Ransomware or stolen credentials moving from business systems toward operations, common in manufacturing, healthcare and logistics.
IT outage that halts work. Scheduling, ordering, gate or monitoring systems go down, so physical work stops in production, distribution and ports.
Supply chain. Compromised software, updates or vendor tools, which affects every industry.
The fourth path is the easiest to miss. An attack never has to touch a controller to stop physical work. That makes OT readiness an IT and security question as much as an engineering one.
What do recent OT attacks look like?
Recent attacks across six industries show these entry paths in action. Some reached control systems directly. Others never touched OT and still slowed or stopped physical work. Together, they help explain why MITRE updated its framework this fall.
Minnesota water systems (July 2026). Attackers used default credentials on internet-exposed PLCs at more than 30 Minnesota water systems and locked operators out, according to a CISA alert. It is the clearest recent case of an exposed device with a default password.
Polish energy sites (December 2025). Attackers reached remote terminal units at wind, solar and combined heat and power sites in Poland, and the attack was stopped, according to Dragos. Distributed sites like these widen the attack surface.
Health Sciences Centre, Winnipeg (August 2026). Ransomware disrupted doors, HVAC and elevators at the hospital while clinical care continued, BankInfoSecurity reported. Building systems are OT too.
Fairlife (July 2026). Ransomware on systems supporting manufacturing paused U.S. production at the Coca-Cola-owned dairy brand, Bitdefender reported. An attack on the IT side was enough to stop the line.
North Carolina Ports (August 2026). An IT outage delayed gate operations and truck traffic, BleepingComputer reported. When the systems that schedule physical work go down, the work stops too.
Hasbro (March 2026). After finding unauthorized access to its network on March 28, the toy maker took some systems offline and switched to business continuity plans to keep taking orders and shipping product, according to its SEC filing. Hasbro warned the workarounds could last several weeks and cause delays. For a commercial enterprise, an attack that never touches a controller can still slow orders and shipments.
Two of these attacks reached OT directly. Three began on the IT side and still slowed or halted physical work. One hit building systems that most people never think of as OT. For a closer look at one case, read our analysis of the 2026 U.S. water system cyberattacks.
What did MITRE ATT&CK v20 change after these attacks?
MITRE ATT&CK v20, released in October 2026, turned the July 2026 attacks on U.S. water utilities into a named campaign and added new ICS techniques, detections and AI-related entries. For defenders, that means a real OT attack is now mapped step by step in a framework your team already uses.
The updates most relevant to OT security:
Campaign C0066, 2026 U.S. Water Utilities Attacks. It maps default credentials, changed passwords, Loss of View, Loss of Control and Modify Program to a real incident.
Campaign C0064. An AI-assisted breach of Mexican government infrastructure reached a municipal water utility, using an AI-generated attack toolkit.
New ICS techniques. Command and Scripting Interpreter (T1701) arrives with six sub-techniques, plus new command-and-control sub-techniques for DNS and publish/subscribe protocols.
New ICS detections. Nine detection strategies and 22 analytics are tuned to filter out vendor software, engineering workflows and approved maintenance.
The takeaway is practical. C0066 gives your team a ready-made scenario to test detection and response against an attack that actually happened.
How can you tell if your teams are ready for an OT cyberattack?
You can tell only by watching your teams respond to a realistic attack, because plans and controls show intent, not performance. Start with five steps:
Map the OT you depend on. Include building systems, remote sites and any undocumented cellular modems, which CISA flagged in its water-sector alert.
Close the obvious doors. Remove PLCs and other OT from direct internet exposure and replace default passwords.
Settle who decides. Define roles, escalation paths and containment authority across IT, security, OT and engineering.
Practice manual operations and recovery. Confirm teams can run critical processes by hand and restore them in a safe order.
Run a realistic attack. Use a mapped campaign such as C0066 as the scenario, then measure how quickly and how well teams respond.
Step five is where Cloud Range comes in. Cloud Range gives IT, security, OT and engineering teams a safe place to work a live attack together without touching production. Its OT/ICS live-fire cyberattack simulations run on flat and Purdue-model industrial networks with SCADA, HMIs and PLCs, and scenarios align to MITRE ATT&CK for ICS. Teams investigate, make decisions and see measured results, so readiness becomes evidence instead of assumption.
Learn how Cloud Range supports OT cyber readiness for critical infrastructure, or read analyst perspectives in our eBook, Establishing ICS/OT Cyber Resilience.
Got OT? Yes, you do. Join our experts on Wednesday, December 2, at 11 a.m. CT (12 p.m. ET) for a live webinar on why OT attacks are rising and how to get IT and OT teams ready to respond together. Register for the webinar. Next week, we'll also release a free OT Cyber Readiness Assessment to help you check where your teams stand.
Frequently asked questions
What is an OT cyberattack?
An OT cyberattack targets or disrupts operational technology, the systems that monitor or control physical processes. Examples include PLCs, SCADA systems, building automation and access control. Some attacks reach those systems directly through exposed devices or remote access. Others begin in IT and force operations to stop when the systems they depend on go down.
Which industries are at risk of OT cyberattacks?
Any industry that relies on connected physical systems is at risk. Utilities and manufacturers are the obvious examples, but hospitals, food producers, ports, transportation, campuses and commercial buildings all run OT. If a cyberattack could stop a pump, a production line, a door or a gate in your organization, you are exposed.
What is MITRE ATT&CK for ICS?
MITRE ATT&CK for ICS is a public knowledge base of adversary tactics and techniques used against industrial control systems. Security teams use it to map attacks, plan detections and build realistic test scenarios. Version 20, released in October 2026, added a campaign entry for the 2026 U.S. water utility attacks, new ICS techniques and new ICS detection strategies.
How is OT incident response different from IT incident response?
OT incident response must protect safety and physical operations, not only data. A containment step that is routine in IT, such as isolating a host, can stop a process or create a safety risk in OT. That is why IT, security, OT and engineering teams need shared decision rights and practice responding together before a real incident.
