Cyberattacks today are no longer just stolen data—they can disrupt entire industries, halt production, compromise essential services, and even jeopardize safety.
Anthropic's Critical Infrastructure Defense Program, with PwC as a founding partner, brings frontier AI models, engineering expertise and threat research to organizations defending operational technology in essential services. It reflects the need for coordinated action to strengthen critical infrastructure resilience.
OT security isn’t just a technical issue anymore; it’s a boardroom priority that demands clear accountability and strategic focus on operational resilience. Are we ready to meet this challenge?
A cyberattack that steals data is serious. A cyberattack that stops production, disrupts power, compromises a water system or affects patient care is something different entirely.
That is why operational technology security needs to move higher on the executive agenda. For years, much of the boardroom cybersecurity conversation has centered on enterprise IT: securing data, identities, networks and systems. Those priorities remain critical. But in many industries, IT supports the business while operational technology runs it.
OT powers factories, energy grids, transportation networks, water systems, healthcare environments and the physical processes that generate revenue and deliver essential services. And those environments are increasingly in the crosshairs.
Threat actors are actively targeting industrial and critical infrastructure environments. Geopolitical tensions are adding urgency. Ransomware is creating operational disruption. And adversaries are increasingly demonstrating an understanding not just of networks, but of the physical processes behind them.
Anthropic’s Critical Infrastructure Defense Program , which counts PwC among its founding partners, brings frontier Claude models, on-site engineers and threat research to providers helping secure power, water and transportation systems. The initiative underscores the need to combine emerging AI capabilities with operational expertise to identify and address vulnerabilities in critical infrastructure.
The potential consequences extend far beyond a traditional data breach. When OT is disrupted, production can stop, equipment can be damaged, supply chains can be affected, and essential services can go offline. In the most serious circumstances, safety can be at risk. Yet many organizations still manage OT security as a specialized technical issue somewhere between cybersecurity, engineering, operations and third-party vendors.
That model is no longer sufficient.
Many industrial environments were built for a very different world - one that assumed greater isolation, predictability and trust. Today, remote vendors connect into facilities. IT and OT environments exchange data. Aging equipment operates alongside cloud-connected platforms. Digital transformation has created enormous value, but it has also created connections and dependencies that were never contemplated when many of these systems were designed.
The answer is not simply to take an enterprise IT security program and extend it onto the factory floor.
Requirements should reflect the criticality of each site. A facility supporting an essential service or critical product may need greater redundancy, faster recovery, and stronger local operating capabilities than a less critical location.
"Through our work with critical infrastructure organizations, PwC's cyber OT practice has seen firsthand the gravity of consequences cyber breaches can have in these environments. I firmly believe that a coordinated, industry-wide effort is necessary to identify vulnerabilities, mitigate risks, and strengthen the resilience of our critical systems."
OT security has to start with the operation being safeguarded rather than the security product being deployed.
That means understanding which processes are truly critical. Knowing the systems, suppliers, and dependencies that support them. Reducing unnecessary exposure. Segmenting environments where appropriate. Controlling remote and privileged access. Improving visibility and detection. And designing recovery around the minimum operations the business should be able to sustain, taking the criticality of each individual site footprint into account.
Most importantly, it requires clear accountability. Executives and boards should be asking:
Do we know which operational processes we absolutely cannot afford to lose?
Do we understand how a cyber event could interrupt them?
Who owns that risk across cyber, operations and engineering?
And if those systems were compromised tomorrow, could we continue operating safely?
Those are no longer questions solely for the CISO or plant engineer. They are questions of operational resilience, business continuity and enterprise risk.
The wake-up call has already sounded.
The question for leaders now is whether we are treating OT security with the urgency, and the operational realism, that the risk demands.
Operational Technology
Strengthen operational technology security with PwC’s OT strategy, architecture, engineering and managed services for resilient industrial operations.
2027 Global Digital Trust Insights: Cybersecurity trends
Explore PwC’s 2027 Global Digital Trust Insights Survey on AI security, cyber resilience, investment priorities, and operational continuity.
Operational Technology
Strengthen operational technology security with PwC’s OT strategy, architecture, engineering and managed services for resilient industrial operations.
2027 Cybersecurity outlook: Financial services
Explore the issues global leaders across financial services face, the threats they feel least prepared to handle, what’s driving security investments, and how emerging technologies are shaping their approach to cybersecurity.
Cyber, Data and Tech Risk
Protect against cyber threats, manage data and technology risk, and build resilience with proactive security strategies designed for today’s digital enterprise
Cyber & Risk Innovation Institute
Through unique surveys, timely thought leadership, and specialized publications, we provide perspectives on the cyber, risk, and regulatory topics that matter most.
US Cyber Data & Tech Risk Leader, PwC US
Principal, Cyber, Data, and Tech Risk, PwC US
Principal, Cyber, Data, and Tech Risk, PwC US
Data Privacy Framework
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
