The Operational Technology Threat Landscape, 2026: From Access to Action

Attacks on industrial systems are no longer rare or theoretical. Across 2025, survey and incident data describe a sector under sustained pressure, with operational disruption a common outcome. The pattern behind the totals matters more than the totals themselves. Adversaries increasingly reach industrial networks through legitimate access and then act like operators, issuing commands that are valid at the protocol level and consistent with normal use. Defences built to check whether traffic is well formed, whether a sender is authorised, or whether activity is statistically unusual do not answer the question that now decides the outcome: is this otherwise valid action appropriate for the state the plant is in? This briefing sets out the evidence for that shift and the gap it leaves.