Industrial OT environments have always been targets, but 2026 marks a shift in the kind of attack we are seeing on customer networks. The pattern that defined 2023–2024 — opportunistic ransomware crossing from corporate IT — is giving way to targeted, OT-aware intrusions that demonstrate prior reconnaissance of plant-floor systems.
This report summarises what we are seeing across our customer base — primarily automotive, pharmaceutical, and process-industry plants in India, the Gulf, and Europe — and what OT security leaders should be prioritising for the rest of 2026.
Three threat patterns to watch
1. Vendor-account compromise
The single most common entry vector we have responded to in the last 12 months is compromise of a vendor or contractor remote-access account. Most plants still rely on shared credentials, persistent VPN connections, or — most concerning — direct exposure of HMI workstations to the internet for "remote support". Attackers do not need to penetrate your perimeter; they log in.
The fix is not glamorous: zero-trust remote access for vendors, individual identities, and time-bound session approval. We have helped several customers implement this without disrupting their service contracts.
2. Living-off-the-land in the OT DMZ
Once attackers establish a foothold, they increasingly use legitimate OT protocols and tools — the same scripts your engineers run for diagnostics — to move laterally. This is harder for traditional IT-trained SOCs to detect because the activity looks operationally normal.
Passive OT monitoring (Claroty, Nozomi, Dragos, or open-source equivalents) is now table-stakes. Without it, you cannot tell the difference between an engineer running a diagnostic and an attacker doing the same.
3. Targeted ransomware with safety-system awareness
The most concerning trend: ransomware groups specifically reconnaissance-mapping safety instrumented systems (SIS) before deployment. The intent is to hold not just data, but production safety, hostage. We have seen this pattern at three customer sites in the last six months.
Priorities for OT security leaders
If your plant has not addressed the following, these are the highest-value items for the rest of 2026:
- Asset inventory. Most plants we engage with do not have one. You cannot defend what you cannot see.
- Vendor access overhaul. Replace shared VPNs with per-identity, time-bound zero-trust remote access.
- Network segmentation review. Purdue model on paper is not the same as Purdue model in deployed firewall rules.
- OT-specific incident response. Your IT IR plan likely does not contemplate "we cannot just turn off the affected systems."
- SIS isolation review. Treat your safety-instrumented systems as the most-isolated zone in your facility, with separate authentication, separate monitoring, and separate change control.
What we have learned
The single biggest factor distinguishing OT environments that recover quickly from those that do not is whether they had practised the response in advance. Tabletop exercises — even short ones — produce more value than another network appliance.
WSC offers an OT-tabletop service for customers in India, the Gulf, and Europe. Two-day engagements, on-site, with your operations and security teams in the same room. Most customers run them once a year.
Back to all insights