Growing Cyber Risks from IT-OT Convergence Threaten Critical Infrastructure

• •Experts warn of increased cyber risks due to IT-OT convergence.
• •Attackers are now capable of operational sabotage, impacting critical services.
• •Congress may need a crisis to enforce cyber liability for vendors.

As the convergence of IT and operational technology (OT) accelerates, cybersecurity experts warn of increasing cyber risks to critical infrastructure. During the Cyber Leaders Exchange 2026, experts highlighted how attackers are now capable of operational sabotage, including modifying programmable logic controller (PLC) code and bypassing safety systems. The Cybersecurity and Infrastructure Security Agency (CISA) noted that threat actors have evolved from website defacements to more advanced tactics that can disrupt essential services. Experts also pointed out that organizations often lack a comprehensive understanding of risks in their OT environments, which can lead to a false sense of security. The situation is exacerbated by adversaries like China, who are reportedly pre-positioning themselves within U.S. critical infrastructure sectors. Calls for Congress to enforce cyber liability for technology vendors are growing, but action is unlikely without a significant incident. The current political climate and workforce reductions at CISA further complicate the response to these threats.