Operational technology (OT) is the hardware and software that monitors and controls physical processes: generators, substations, pumps, valves, compressors, conveyors and safety systems. Industrial control systems (ICS), SCADA, DCS, PLCs and protection relays are all OT.
The consequences are physical
When an office IT system is attacked, data is stolen or locked. When OT is attacked, the result can be a power outage, a water supply interruption, a plant trip, damaged equipment, an environmental release or a safety incident. Recovery is measured in days or weeks of lost production, not hours of downtime.
It has already happened
- Ukraine, 2015 and 2016: attackers gained remote access to distribution companies' control systems and opened breakers, cutting power to hundreds of thousands of customers.
- Middle East petrochemical plant, 2017 (TRITON / TRISIS): malware targeted a safety instrumented system, the last line of defence against dangerous process conditions.
- Norsk Hydro, 2019: ransomware forced the aluminium producer to switch parts of its production to manual operation.
- Colonial Pipeline, 2021: a ransomware attack on IT systems led the operator to shut down the largest fuel pipeline in the United States as a precaution, causing fuel shortages.
Most of these attacks started in IT networks and moved into OT through weak segmentation, shared accounts or remote access. That path is the one most operators still need to close.
Why risk is rising
- Connectivity: remote monitoring, cloud analytics and vendor support connect control systems that were once isolated.
- Long lifecycles: many control systems run for 15–25 years, on software that can't easily be patched.
- Insecure protocols: common industrial protocols such as Modbus and DNP3 were designed without authentication.
- Capable attackers: state-linked groups and ransomware gangs now target critical infrastructure specifically.
Regulators now expect evidence
Governments treat the security of critical infrastructure as national security. India's power-sector cyber security regulations, Saudi Arabia's OT Cybersecurity Controls, Qatar's National ICS Security Standard and the UK's NIS Regulations all expect operators to assess their OT, fix gaps and prove it.
What good looks like
OT security isn't about copying IT security into the plant. It means understanding the process, protecting safety and availability first, and applying proven frameworks such as IEC 62443 with care. The next guides explain how OT differs from IT, the basic concepts, and the essential controls every operator should have.