Topic
All articles on OT.
Cybersecurity
OT networks are repetitive and predictable, in theory the ideal environment for anomaly detection. In practice, legitimate-but-anomalous behavior generates a false-positive noise that is the main cause of failure for industrial monitoring projects.
Cybersecurity
There is no single best OT cybersecurity platform — there is the right one for your ICS network, your protocols, and your maturity level. Concrete criteria for choosing without being guided by marketing.
Cybersecurity
APT actors targeting industrial environments do not break in and act immediately: they settle quietly, build hidden command channels, and wait. How they work and how to detect them.
Regulations
The Cyber Resilience Act introduces security obligations for manufacturers of products with digital elements. For OT and IoT device makers, the compliance scope is broad and the deadlines are approaching.
Cybersecurity
Patching everything in an OT environment is impossible. CVSS alone is not enough to set priorities. EPSS adds the missing dimension: the probability that a vulnerability is being actively exploited today.
Risk Management
Insurers increasingly demand specific technical controls for OT environments. What they assess, how it affects the premium and how to prepare for the insurance assessment.
Cybersecurity
Admin/admin, 1234, the vendor's factory credentials: how many OT installations still have access protected by default passwords? More than you would expect. How it happens, how attackers find it, and how to fix it without stopping production.
Cybersecurity
The firmware in OT field devices is a prime target for persistent, hard-to-detect attacks. How tampering happens, why it is so insidious and what countermeasures exist.
Cybersecurity
In Italian manufacturing SMEs the OT network is often a flat network with no up-to-date inventory. Unknown devices, undocumented expansions, knowledge held only in the technician's head: any industrial security project starts with understanding what's on the network.
Cybersecurity
Hospitals are OT environments in their own right: thousands of connected medical devices, often unmanageable with traditional IT tools. How to secure the IoMT fleet under NIS2.
Regulations
IEC 62443 is the reference standard for industrial control system cybersecurity. How to use it concretely: structure, gap assessment and a first five-step remediation plan.
Cybersecurity
Modbus, DNP3, OPC UA, and PROFINET underpin industrial communications. Designed for reliability in closed networks, they carry intrinsic vulnerabilities that become critical in increasingly connected environments.
Compliance
IEC 62443 is often seen as out of reach for SMEs. Yet zones and conduits are practical tools you can apply to real plants, starting from visibility and reaching formal segmentation step by step.
Compliance
Many industrial organizations already hold ISO 27001 for IT. Extending it to OT environments demands a specific approach: different threat models, operational constraints and integration with IEC 62443.
Cybersecurity
The pivot from IT into the OT network is the critical phase of nearly every documented industrial attack. Understanding the techniques used to cross this boundary is the first step to detecting it early.
Cybersecurity
Ports and ships are complex, under-protected OT ecosystems: automated cranes, onboard systems, terminals and intermodal logistics. A map of risks and obligations for a critical sector that is often overlooked.
Cybersecurity
MITRE ATT&CK for ICS is not a document to skim once and file away. Turning its techniques into concrete detection rules means knowing what you can really see on your network and what stays out of reach without endpoint visibility.
Cybersecurity OT
Placing an inline monitoring system between SCADA and PLC introduces latency that industrial systems cannot tolerate. The right answer is passive out-of-band monitoring, with isolation and network changes as the response tool.
Compliance
NIS2 is not proven with policies: it is proven with technical evidence. What auditors look for in an OT audit, how to prepare evidence before they arrive, and the role of continuous monitoring as documentary proof.
Cybersecurity
NIS2 sets tight deadlines for notifying significant incidents: 24 hours for the early warning, 72 hours for the detailed notification. In OT, being ready to meet them takes preparation that starts long before the incident.
Compliance
NIS2 is not just for large companies. Manufacturing SMEs within scope have concrete obligations: OT asset inventory, vulnerability management, detection, incident notification. A practical checklist.
Compliance
NIST CSF 2.0 adds the Govern function to the original five. How to map OT capabilities onto the framework's six functions and use it as a self-assessment tool and roadmap to prioritize industrial security investments.
Cybersecurity
OPC-UA is the de facto standard for communication in modern SCADA systems, but it is often deployed with degraded security settings for legacy client compatibility. Here is what shows up in the traffic and what an attacker can exploit.
Cybersecurity
In oil & gas, cybersecurity is intertwined with process safety: a cyber incident can become a physical one. Risks, safety systems and strategies for refineries, pipelines and terminals.
Business Continuity
Operational resilience and cybersecurity are not separate programs: one without the other is incomplete. How to integrate ISO 22301 and IEC 62443 into a coherent approach for critical infrastructure.
Cybersecurity
Before launching an attack, threat actors look for publicly available information about their targets. Shodan, Censys and other OSINT tools can find OT systems exposed on the internet in seconds. Understanding what they see is the first step to reducing your own exposure.
Cybersecurity
An OT network assessment is not a vulnerability scan run on corporate IT. Different methodology, different risks, and often surprising results: here is what to expect from a properly conducted industrial assessment.
Business Continuity
When a controller fails or ransomware hits, only one question matters: how long until you restart? In OT, backup is not copying files, it is being able to rebuild a plant.
Cybersecurity
Management wants numbers. But which OT metrics communicate real risk instead of mere compliance? How to build a dashboard of KPIs and KRIs that speaks of potential downtime, not checklists.
Cybersecurity
Automotive is among the sectors most exposed to OT attacks: robotic lines with proprietary protocols, MES/ERP integration and vendor remote access create a wide, hard-to-control attack surface.
Risk Management
The OT cybersecurity budget is often an afterthought next to IT, even when operational risk is far higher. How to build a convincing business case and measure the ROI of industrial security investments.
Cybersecurity
In the chemical industry a cyber incident can cause the release of hazardous substances, explosions and harm to people. Safety/security convergence is no abstraction: the Triton attack on Safety Instrumented Systems proved the last physical line of defense can be compromised.
Cybersecurity
Italian food & beverage has a wide, poorly protected OT attack surface: dosing lines, digital HACCP systems, connected cold rooms for traceability. An OT attack here can compromise food safety and brand reputation.
Cybersecurity
Modern automated warehouses run complex OT networks: a WMS wired to the automation, heterogeneous PLCs from many vendors, AGVs and mixed protocols. High turnover and frequent vendor work break segmentation, and downtime hits the supply chain instantly.
Cybersecurity
IT incident response playbooks do not work in OT. Isolating a compromised system can halt production; powering off a device can cause physical damage. How to build OT IR that actually works.
Cybersecurity
Local utilities (water operators, power distributors, waste treatment plants) are NIS2-regulated entities with security resources close to zero. SCADA systems 15 to 20 years old connected to the internet, run by a single technician: how to set up OT security from this starting point.
Cybersecurity
PLCs with 2008 firmware, HMIs running embedded Windows XP, systems that cannot be touched by contract: the reality of Italian plants. How to manage risk when patching is not an option.
Cybersecurity
An MSSP offering OT monitoring needs more than a single-plant product: real multi-tenancy, clean SOC integration and alert handling at scale are what matter.
Compliance
IEC 62443 does not mandate a product, but many of its requirements can only be met with serious OT monitoring: asset inventory, anomaly detection, logging and verified segmentation. Which requirements map to which monitoring capabilities.
Cybersecurity
Network segmentation is the OT security control with the best cost/effectiveness ratio. From the Purdue model to IEC 62443 zones, how to implement it in production without stopping the plant.
Cybersecurity
OT network topology often lives only in a technician's head, or in a 2014 diagram that was never updated. Rebuilding it from scratch with passive traffic monitoring: why it is necessary and how it is done in practice.
Cybersecurity
A practical four-level framework to assess OT security maturity and build a concrete roadmap. Each level has clear prerequisites, measurable goals and a defined next step.
Cybersecurity
Many companies already run a SIEM or a managed SOC, but these systems are blind to OT. How to feed OT monitoring events into the SOC, which formats to use and which alerts to escalate.
Cybersecurity
An IT SOC cannot see OT environments. Building monitoring capabilities for industrial networks requires different sensors, different skills, and playbooks specific to OT protocols and threats.
Cybersecurity
Reactive monitoring waits for an alert to fire. Threat hunting goes looking for the attacker the alerts never saw. How to apply threat hunting to OT environments, and why finding nothing is a good result.
Cybersecurity
In OT environments, traditional patch management is often impossible. Legacy systems, certifications to maintain, very rare maintenance windows: how to build a VM program that actually works.
Compliance
Pharma faces strict quality regulations that now overlap with OT cybersecurity needs. How to integrate GMP, FDA 21 CFR Part 11 and IEC 62443 into one coherent program.
Cybersecurity
Railway networks are becoming more connected and more exposed. An analysis of systems at risk, the regulatory framework and defence strategies for an often overlooked critical infrastructure.
Cybersecurity
Sandworm is known for shutting off the lights in Ukraine and launching NotPetya. But its techniques are being replicated against European manufacturing, often as collateral damage. How an APT attack on an industrial OT network works and why SMEs are within range too.
Cybersecurity
Industrial process historians collect data from PLCs and expose it to business systems. This makes them a natural bridge between IT and OT, and a prime vector for lateral movement.
Cybersecurity
Remote access to OT environments exploded after the pandemic, but security practices never caught up. Here is why it became the attackers' favorite entry vector.
Cybersecurity
Maintenance laptops left connected, 4G modems installed by vendors, uncatalogued switches: shadow devices in OT networks are more common than you think and represent concrete blind spots for security.
Cybersecurity
Data centers are cyber-physical environments with OT systems often ignored by IT security programs. BMS, PDUs, cooling systems, and UPS units are critical assets with real vulnerabilities.
Cybersecurity
Supply chain attacks are among the hardest to detect and prevent. In industrial OT, the supplier chain is often long, poorly monitored, and holds privileged access to control systems.
Cybersecurity
Passive OT traffic monitoring depends on where and how traffic is captured. Hardware TAPs and SPAN ports have very different characteristics in industrial environments: a wrong choice means incomplete data or operational risks.
Cybersecurity
Triton/TRISIS is the first documented malware designed to disable Safety Instrumented Systems — the systems that prevent physical industrial accidents. Its impact goes beyond the targeted plant: it changes the perimeter of what must be monitored.
Cybersecurity
Water and wastewater treatment plants are critical infrastructures with often obsolete OT systems and exposed remote connections. A sector that industrial cybersecurity still struggles to reach.
Cybersecurity
Zero Trust is the security framework of the moment, but applying it to OT environments requires pragmatism: here is what actually works and where the model shows its limits.
Cybersecurity
The industrial DMZ is the architectural layer that separates IT and OT and manages data flows between the two worlds. Designing it well is the difference between a secure connection and a direct path to the heart of the production network.
Cybersecurity
New AI models discover vulnerabilities autonomously and at industrial scale. But the tools stay tuned for IT: the OT world risks falling behind just as attackers accelerate.
Cybersecurity
An analysis of over 5 million alerts shows how Sandworm targets OT environments: weeks of ignored signals before the real impact lands.
Cybersecurity
You cannot protect what you cannot see: complete OT/IoT asset visibility is the foundation of every industrial cybersecurity strategy.
Cybersecurity
Artificial intelligence does not create autonomous threats, but it makes attacks faster and more variable. What changes for those defending OT environments.
Cybersecurity
Three chained CVEs in the CODESYS Control runtime let a Service user replace the PLC application with a backdoored version and run code as root.
Cybersecurity
The blackout that brought Spain and Portugal to a standstill shows how fragile energy grids are and why visibility into OT assets is decisive.
Cybersecurity
In spring and summer 2025 ransomware mostly hit manufacturing. Data, active groups and what it means for industrial OT environments.
Cybersecurity
A hands-on guide to building a complete OT/ICS asset inventory: sensors, passive and active discovery, DPI and behavioral baselines without stopping production.
Regulations
The NIS2 directive has been transposed: what matters now is what to do in practice. From entity classification to OT asset visibility, an operational checklist.
Risk Management
Industrial cyber risk is not measured like IT risk. A practical guide for CISOs: consequences, plant context, and managing OT risk.
Risk Management
How to translate cyber risk on industrial systems into business language and bring it to the boardroom table.
Cybersecurity
Eight vulnerabilities in the WAGO 750-8216 PLC can be chained to obtain root privileges on the device. Technical analysis and plant impact.
Risk Management
CISOs no longer judge OT security on technical merit alone, but on the value it creates: uptime, production continuity and reduced risk.
Cybersecurity
Flat budgets and too few, half-expert analysts: how artificial intelligence can close the skills gap in OT security without replacing people.
