Industrial cybersecurity is not only an issue for power stations, refineries, manufacturing plants, mines or other environments traditionally associated with operational technology (OT).Water supply systems, data centers, public transportation services, warehouses and commercial buildings can all depend on digital systems that monitor, control or directly influence physical operations.
The technology may be similar from one environment to another; what changes is the impact when it fails, becomes unavailable or can no longer be trusted.
The same cyber incident can play out very differently depending on the process it reaches. An unavailable controller can stop a production line; manipulated process data can call pharmaceutical quality into question; loss of visibility in water treatment may force operators to take systems offline. In a data center, even unaffected servers can become unavailable if the systems supporting their physical environment are compromised.
Industrial cyber risk is therefore ultimately about operations. An IT incident becomes an industrial incident when it affects the organization's ability to monitor, control, trust or restore a physical process.
Recent telemetry gives a sense of the scale of exposure. Kaspersky ICS CERT recorded malicious objects being blocked on 19.2% of ICS computers protected by Kaspersky technologies globally in Q2 2026, with exposure varying by geography and industrial sector.
What turns a cyber incident into an operational technology incident?
A cyber incident becomes an OT incident when it starts to affect an organization's ability to run, observe, trust or restore a physical process.
The impact can be very direct. In a 2025 Ponemon Institute study conducted with Siemens Energy across manufacturing, energy, water, oil and gas and petrochemicals, 77% of surveyed organizations reported a successful cyberattack that had compromised confidential data or disrupted OT during the previous 12 months. Almost a quarter of detected attacks required OT workflows to be halted.
Six consequences are particularly important:
- Control: Can authorized operators still control equipment and processes?
- Visibility: Can they accurately see what equipment and processes are doing?
- Availability: Can production or service delivery continue?
- Integrity: Can operators trust commands, configurations, measurements and process data?
- Safety: Could a cyber event create risk to people, equipment or the environment?
- Quality: Can the organization still demonstrate that physical outputs or process conditions meet required standards?
These effects rarely occur in isolation. Losing visibility of a process may force an organization to stop production even though the equipment itself is still running, and systems can remain available while corrupted configurations make their output unreliable.
This is why in industrial environments, conventional measures of IT impact don’t always tell the full story. Recovery is not just about bringing systems back online; the organization also has to know that the physical process is safe, stable and trustworthy.
Why industrial cybersecurity risk differs by type of operation
Different industries often use similar automation technologies, but those technologies play very different roles. The same programmable logic controller (PLC) might manage a continuous production process, a robotic manufacturing cell or a water pump. The technical compromise may be similar in each case, but the operational consequences are not.
That makes the operating model a more
useful starting point for assessing industrial cyber risk than the industry
label alone.
| Operating environment | What matters most operationally | A cyber incident may affect | Typical security emphasis |
| Continuous production | Stable operation and graceful degradation | Production availability, process stability, equipment and safe restart | Visibility, segmentation, change detection and recovery planning |
| Discrete manufacturing | Coordination between automated production stages | Robotics, sequencing, throughput and quality | Asset visibility, access control, endpoint and network protection |
| Batch manufacturing | Correct parameters and repeatable production conditions | Product integrity, traceability and recipe/configuration integrity | Change control, integrity monitoring and identity and access management |
| Essential process services | Continuous or reliable service delivery | Public service, environmental conditions and operational continuity | Remote-site visibility, secure access, resilience and recovery |
| Digital infrastructure with physical dependencies | Reliable power, HVAC and physical access control | Availability of digital services | IT/OT dependency mapping, building-system protection and segmentation |
There is no single hierarchy of industrial cyber risk. Different operating environments create different combinations of operational, financial, safety, environmental and quality consequences.
Continuous production: When stopping safely is part of cybersecurity
Continuous-process industries are designed to operate for long periods without interruption. Examples include metallurgy, petrochemicals, pulp and paper and glass production.
In continuous production, availability is about much more than lost output. An unplanned shutdown may have to follow a controlled sequence to prevent equipment damage, wasted material or unsafe process conditions, and restarting production can itself be complex and costly.
Nor does an attacker have to manipulate a physical process directly. If operators lose reliable visibility of production conditions or access to the systems used to supervise them, stopping the process may be the safest option.
This also changes how incidents can be contained. Disconnecting an affected machine may be routine in corporate IT, but abruptly isolating or rebooting equipment in a continuous process could make matters worse. Security, engineering and operations teams therefore need to agree in advance how the process can continue safely, how a controlled shutdown would work and how systems will be restored to a known-good state.
Discrete manufacturing: protecting interconnected production
Discrete manufacturing creates individual products or components through defined production stages. Automotive manufacturing is a familiar example, but the model also applies to machinery, electronics, industrial equipment and many other manufacturing environments.
Production may depend on industrial robots, programmable logic controllers, machine-vision systems, conveyors, manufacturing execution systems, and other connected equipment. The cybersecurity challenge is often not one individual asset, but dependency between production stages.
A single line can rely on multiple vendors, automation platforms and supporting IT systems. If one critical element becomes unavailable, upstream and downstream production may also be affected.
An attack doesn’t have to reach the lowest-level industrial controller – the loss of a manufacturing execution system, or conveyor belt controller can prevent a production stage from operating or leave the organization unable to verify its output.
Supplier and maintenance connections add another dependency. Highly automated plants may depend extensively on systems integrators, equipment vendors and remote support. Those connections can be operationally necessary while still creating routes that need explicit authorization, monitoring and control.
Broader enterprise data indicates significant cyber exposure across production-oriented sectors. The UK government's Cyber Security Breaches Survey 2025/2026 found that 49% of businesses in the utilities or production category, which includes manufacturing, had identified a cyber breach or attack during the previous 12 months, compared with 43% of businesses overall.
Kaspersky ICS CERT data provides a more OT-specific view. Its Q2 2026 telemetry continued to identify malicious activity on protected industrial systems across manufacturing and other sectors, illustrating how conventional malware, phishing and other threats reach operational environments as well as enterprise IT.
For discrete manufacturing, the priority is not simply to protect individual machines, but to understand how disruption could move through the production system as a whole.
Batch manufacturing: When process integrity matters as much as availability
Batch production creates defined quantities of a product according to controlled recipes, parameters and processing stages. Pharmaceutical and life-sciences manufacturing is a particularly important example.
In batch manufacturing, availability is only part of the problem. A production system can continue operating while the organization loses trust in the parameters, environmental conditions, configurations or digital traces behind the finished product.
That can turn a cybersecurity incident into a product-quality or compliance issue without causing an obvious outage.
Production systems may also depend on laboratory systems, environmental monitoring, historian databases and corporate IT. The data they generate can be important not only for running the process, but also for demonstrating that it remained within the required conditions.
Security controls therefore need to protect integrity alongside availability. Changes to recipes, configurations and environmental settings require appropriate authorization and traceability. Monitoring should identify unexpected changes, while recovery planning needs to cover the systems and information required to re-establish a trusted production environment.
Wherever product quality depends on tightly controlled digital parameters, keeping systems available is not enough.
Water and wastewater: Securing distributed essential processes
Water and wastewater operations add another challenge: critical equipment may be spread across many locations.
Treatment facilities can depend on SCADA systems, pumps, dosing equipment, sensors, remote terminal units and communications links far from the central control room. Remote connectivity is consequently essential, but distant sites may also have less local oversight and fewer security controls.
If communications or remote access are compromised, operators may lose the information or control they need to manage treatment, pumping, dosing or reservoir operations safely. The consequences can be operational, environmental and public-facing.
Security teams need reliable visibility of remote assets, controlled remote access and monitoring that understands industrial communications. Incident plans also need to establish how essential processes will be managed if centralized digital systems or communications are unavailable.
Data centers: industrial cybersecurity behind digital services
Data centers are usually viewed as IT environments, but their availability also depends on physical infrastructure. Servers need reliable power, cooling and environmental control, supported by building-management systems, UPS equipment, generators, electrical distribution and monitoring systems. A failure or compromise in those systems can produce the same end result as an IT outage: unavailable digital services.
It’s not that data centers should be treated like conventional industrial plants, but that their resilience depends on cyber-physical systems as well as servers and networks.
Security teams need to understand which physical systems digital availability depends on, how those systems are connected and who can access them. A remotely accessible building-management system, shared identity service or contractor connection may create a pathway into systems that indirectly determine whether the facility can operate.
Data centers show why industrial cybersecurity extends beyond traditional industrial sectors.
Building automation and other cyber-physical environments
Commercial buildings, warehouses and logistics facilities increasingly depend on connected automation too.
Building-management systems can control heating, ventilation, cooling, access and lighting, while warehouses may rely on robotics, automated material handling and environmental systems. And logistics environments can combine operational equipment with enterprise planning, tracking platforms and third-party services.
These environments may not describe themselves as industrial, but the security principle is the same: digital systems are influencing physical operations that matter to the business.
Kaspersky ICS CERT's Q2 2026 telemetry separately tracks building automation alongside more traditionally recognized industrial sectors, reflecting the exposure of these environments to many of the same threat sources found elsewhere in OT.
For security teams, the label matters less than the dependency. If compromising a connected system could interrupt or alter an important physical process, it belongs within the organization's operational cyber-risk model.
Different industries, recurring industrial cybersecurity problems
The operational consequences may differ, but several cybersecurity challenges recur across sectors.
Incomplete asset and dependency visibility
Just knowing that an OT asset exists is not enough; organizations also need to understand what process the asset supports, what systems it depends on and what depends on it. The scope includes conventional IT technologies used in operations, remote systems, third-party connections and shared infrastructure.
Long-lived and difficult-to-patch systems
Industrial technologies can remain operational for many years, while updates may require testing, supplier involvement or planned downtime. This is why vulnerability management needs risk-based prioritization and compensating controls rather than assuming every issue can be patched immediately.
Remote and third-party access
Suppliers, engineers and maintenance organizations frequently require access to operational systems, and this is a significant attack path. SANS found that 50% of the ICS/OT incidents reported by respondents in its 2025 survey started with unauthorized access. The important control question is not simply whether remote access is permitted, but who can connect, to what, under which conditions and with which privileges.
IT/OT dependencies
Industrial operations increasingly rely on enterprise identity, virtualization, remote-access platforms, cloud services and business applications.
Today’s OT connectivity is therefore a dependency-management problem as much as a network-security problem. Modern operational demands have increased OT connectivity with enterprise systems, third-party vendors and cloud services, making it more important to understand and secure those pathways.
Limited visibility into industrial activity
A conventional security tool may identify suspicious network behavior or malicious files without understanding the process around them. OT monitoring needs additional context: which device is communicating, which industrial protocol is being used, whether the behavior is expected and what operational consequence could follow.
Incident response and recovery designed for IT rather than operations
Standard IT procedures may call for immediate isolation, shutdown or reimaging. Those actions can be inappropriate in OT if they interrupt a process, remove operator visibility or affect safety. This is why industrial incident response requires predefined cooperation between cybersecurity, engineering, operations and, where relevant, safety teams.
Recovery can also be prolonged. In the 2025 Ponemon Institute/Siemens Energy OT study, 62% of successful attacks took more than a month to discover and respondents reported an average recovery time of seven months.
This makes industrial recovery more than a backup problem. Organizations need to restore digital systems, re-establish trusted configurations and verify that the physical process is safe to resume.
How should organizations prioritize industrial cybersecurity?
The first priority should follow operational consequence, not industry label.
Start by asking:
| Question | What it reveals |
| Which physical processes would create the greatest business, environmental or safety impact if disrupted? | Where security effort should be concentrated first |
| Which digital systems are required to operate and supervise those processes? | Critical OT, IT and cyber-physical dependencies |
| Which systems or third parties can reach those environments? | Realistic attack pathways |
| Which systems cannot be patched or replaced easily? | Where compensating controls are required |
| What activity can we see inside the operational environment? | Detection and investigation gaps |
| What happens if operators lose control, visibility or trust in process data? | The real operational consequence of compromise |
| How would we restore the process and validate it before restart? | Whether cyber recovery translates into operational recovery |
These questions turn an abstract OT-security program into priorities based on the operation itself. They also map naturally to the broader eight-step industrial cyber-resilience approach: Inventory, Assess, Secure, Detect, Audit, Enhance, Monitor and Prepare.
- An organization with poor knowledge of its OT estate needs to start with Inventory.
- One with legacy systems that cannot be patched quickly may place greater emphasis on Assess and Enhance to prioritize exposure and introduce segmentation.
- Extensive vendor access increases the importance of Secure and Monitor
- And weak OT-specific incident and recovery capability puts Prepare much higher on the agenda.
These steps can remain consistent across industries, and their priority and implementation should change according to the process being protected.
Industrial cybersecurity should follow the process, not the sector label
There is no single industrial cyber-risk profile because the same technology can have very different consequences depending on the process around it.
The answer helps security teams identify the dependencies that matter, control the routes into them, monitor the right activity and prepare for recovery around the realities of the operation. The sector may change, but the principle does not: cybersecurity priorities should follow the physical process they are there to protect.
Sources and further reading
- Kaspersky OT CyberSecurity
- Threat landscape for industrial automation systems, Q2 2026
- How energy and manufacturing can stay ahead of cyber threats and protect their tech
- Cyber security vulnerabilities of operational technologies
- Cyber Security Breaches Survey 2025/2026
- Creating and maintaining a definitive view of your OT architecture
- State of ICS/OT Security 2025
