Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security
Summary: Joint research by Palo Alto Networks' OT Threat Research Lab, Siemens Cybersecurity Lab and Idaho National Laboratory, drawing on global OT network telemetry and decades of incident data, finds that roughly 70% of attacks affecting OT operations begin in IT environments and that 82.8% of adversary activity occurs during precursor phases. Attackers remained present an average of about 185 days before impact-level activity, while unique exposed OT devices and services rose 332% between 2023 and 2024, with nearly 20 million OT-related assets observable on the public internet.
What's compelling: If adversaries average 185 days inside an environment before disrupting operations, then the 70% of OT incidents that start in IT are detectable long before the plant floor is touched - the question is whether your monitoring and response reach the IT-OT edge where those signals appear.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026