Explore the data from Dragos’s 2026 OT Cybersecurity Report, our 9th Annual Year in Review – the go-to report for industrial control systems (ICS) and operational technology (OT) vulnerabilities, threats targeting industrial environments, and lessons learned from customer engagements worldwide.
Adversaries moved beyond prepositioning to actively mapping control loops, understanding how to manipulate physical processes. Three new threat groups emerged, established groups expanded globally, and ransomware caused significant operational disruptions. Yet only a small number of OT networks have the visibility to detect these threats before operational impact occurs.
Adversaries targeting OT are progressing through the ICS Cyber Kill Chain at different speeds. While some focus on initial access, others have reached Stage 2. These threat groups conduct reconnaissance, development, and testing activities inside OT environments to understand control loops and position for future manipulation of industrial processes.
The 2026 OT Cybersecurity Year in Review report provides a panoramic view of the most significant cyber trends, threats, and lessons learned during cybersecurity events from the past year.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
