The Prevention Bias Problem: Why Standards Are Failing OT Defenders
Summary: Dragos analyzed dozens of cybersecurity standards and found every one overweights preventative controls: NIST CSF 2.0 devotes 60% of controls to Identify and Protect, NIST SP 800-53 is 95% preventative, and ISA/IEC 62443 averages 75% prevention against 25% detection, response, and recovery. Dragos reports it handled more OT incident response cases last year than in the prior three years combined, and that adversaries weaponized exploits in a median of 24 days while multiple threat groups moved into mapping control loops and executing code to cause physical disruption.
Bottom line: Dragos estimates fewer than 10% of OT networks worldwide have visibility and monitoring in place, and finds organizations fail to account for nearly 30% of connected devices on their networks - so the standards most programs were built on leave them blind to the failures that precede operational impact.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026