Cybersecurity challenges continue to be a problem in the industrial automation field. In 2025, 50% of operational technology organisations experienced cyber attacks.[1] Meanwhile the industrial cybersecurity market is projected to grow from $27 billion to $61 billion by 2035.[2] However, the biggest change is what attackers are targeting. While conventional IT hacking often focused on data theft, hackers now target production disruption, extortion, and sabotage. Here is a list of five such threats facing industrial automation.
Ransomware Targeting Production Systems
Manufacturers face a real problem with ransomware. As opposed to traditional attacks on corporate networks, ransomware impacts production directly. In 2026, manufacturing ransomware attacks nearly tripled.[3] The year prior saw nearly 6,000 incidents globally.[4] Any system connected to the OT network, particularly production controllers and SCADA systems makes excellent targets for ransomware.
When ransomware breaches a controller or disrupts an OT network, assembly lines may come to a halt. Manufacturers face expensive downtimes while restoring operations. The longer production remains offline, the greater the pressure to negotiate with hackers.
For manufacturers operating connected OT environments, it requires more than just endpoint protection for ransomware protection. Segmentation and proper backup will help prevent further penetration and assist in recovery.
Phishing & Internet-Based Attacks
Phishing continues to be one of the most common entry points into OT networks. During 2025, 5.91% of industrial control systems computers were blocked from accessing websites on denial lists.[5] This figure reflects more than user error. It indicates malware already running on those systems was attempting to contact attacker-controlled servers. Each blocked connection represents an infected machine trying to communicate back to its command source. The statistic shows how many industrial systems carry active malware infections.
Unlike an attack that exploits a software vulnerability, phishing relies on someone interacting with the message. An email that looks legitimate, a malicious link, or an infected attachment can be enough to get an attacker into the network. In a production environment, that initial access can become a much bigger problem if the OT network is not properly separated from other systems.
Older equipment and limited network segmentation make that problem harder to contain. Once an attacker gets inside, they may be able to move between connected systems and eventually reach production-critical infrastructure. Email filtering, security awareness training, and stronger IT/OT separation can reduce the chances of that happening.
Hardware Trojans & Embedded Cyber-Kinetic Payloads
Hardware trojans and cyber-kinetic malware operate differently compared to phishing attacks and ransomware since the malicious code is embedded into the device’s firmware or control system, allowing the hackers to control the devices through their regular operating procedures.[6]
These attacks are difficult to detect. Compromised devices operate normally, hiding the threat entirely. Security monitoring sees nothing. Logs appear clean. When the payload activates, equipment fails without warning.
Validation of firmware and hardware supply chain verification are priorities for manufacturers. A compromised controller not only disrupts manufacturing but damages equipment, places workers at risk and affects product quality.[6]
Outdated Systems & Unpatched Vulnerabilities
Factories still operate on equipment installed decades ago; cybersecurity was not a design consideration. Outdated controllers, unsupported operating systems, and other legacy systems can leave known vulnerabilities in place for years. Across manufacturing, logistics, transportation, and natural resources, 12% of OT devices carry known exploitable vulnerabilities,[7] and 40% of organisations have those assets connected directly to the internet.
Keeping this equipment patched is not always straightforward. Some industrial controllers are no longer supported by their manufacturers, while taking production equipment offline for an update may not be practical. As a result, facilities can end up relying on systems that attackers already know how to exploit.
Replacing everything is not an easy answer either. Modernising an industrial environment takes money, planning, and time. Until older equipment can be replaced, measures such as network segmentation and access controls can help reduce the exposure created by these systems.[8]
State-Sponsored Targeting & Supply Chain Attacks
Industrial organisations are also attracting attention from state-sponsored groups, particularly those looking to access operational technology and critical supply chains.[9] Unlike financially motivated cybercriminals, these groups pursue different objectives. From espionage, operational disruption, or even establishing continuous access to industrial networks for long-term leverage.
Supply chain vulnerabilities expose manufacturers. The reliance on software vendors, hardware suppliers, system integrators, and maintenance contractors mean a single compromise spreads across multiple facilities through routine software updates, remote services and trusted connections.[10]
IT and OT networks are also more closely connected than they once were. Remote monitoring and maintenance, for example, allow engineers and vendors to access systems from outside the facility. Those connections need to be controlled carefully, particularly where they lead into production networks. Separating critical OT systems from corporate networks and keeping track of third-party access can make it harder for an attacker to move further into the environment.
Conclusion
The cybersecurity risks facing industrial automation are becoming harder to separate from the way modern factories operate. Connected OT systems make production more efficient, but they also give attackers more potential routes into critical equipment and processes. Ransomware, phishing, hardware-level attacks, outdated systems vulnerabilities, and supply-chain compromises each expose a different part of that environment.
There is no single fix for these threats. Manufacturers need to know what is connected to their networks, keep critical systems properly segmented, manage third-party access, and have a recovery plan when something goes wrong. For industrial organisations, cybersecurity is fundamentally different today. The focus is not only data protection, but also production stability, equipment reliability and worker safety.
References:
- Fortinet. (2025). 2025 Operational Technology Security Report. Retrieved on 14 July 2026, from https://www.fortinet.com/blog/business-and-technology/key-findings-from-the-fortinet-2025-operational-technology-security-report
- E-Tech Group. (2026). Industrial Cybersecurity Market Outlook for 2026-2035. Retrieved on 14 July 2026, from https://etechgroup.com/blog/general/what-to-expect-in-the-next-decade-of-automation-ics-cybersecurity/
- Kaspersky ICS CERT. (2026). Threat Landscape for Industrial Automation Systems. Q1 2026 Report. Retrieved on 14 July 2026, from https://ics-cert.kaspersky.com/publications/reports/2026/06/09/threat-landscape-for-industrial-automation-systems-q1-2026/
- Cyble Research & Intelligence Labs. (2025). Global Cybersecurity Report 2025. Retrieved on 14 July 2026, from https://cyble.com/resources/research-reports/annual-threat-landscape-report-2025/
- eSecurity Planet. (2025). Industrial Automation Threats Decline Slightly in Q2 2025 (But Risks Remain). Retrieved on 14 July 2026, from https://www.esecurityplanet.com/threats/industrial-automation-threats-decline-slightly-in-q2-2025-but-risks-remain/
- IIoT World. (2026). Industrial Cybersecurity Threats for 2026. Retrieved on 14 July 2026, from https://www.iiot-world.com/ics-security/industrial-cybersecurity-threats-2026/
- CiberSafety. (2026). Industrial Cybersecurity and Factory Threats 2025-2026. Retrieved on 14 July 2026, from https://cibersafety.com/en/Industrial-cybersecurity-and-factory-threats-2025-2026/
- Claroty. (2025). State of CPS Security 2025: OT Exposures. Retrieved on 14 July 2026, from https://claroty.com/resources/reports/state-of-cps-security-ot-exposures-2025
- Google Cybersecurity Forecast 2026. (2026). State-Sponsored Campaigns Targeting OT Assets and Supply Chains. Retrieved on 14 July 2026, from https://www.blog.google/outreach-initiatives/public-policy/
- PwC. (2025). Emerging Threats to Operational Technology Environments. Retrieved on 14 July 2026, from https://www.pwc.com/gx/en/issues/cybersecurity.html
