New insights into OT cyber threats: this is what the 2026 Threat Report shows

Cybersecurity in industrial environments remains constantly evolving. The new 2026 OT Cyber Threat Report from Waterfall Security Solutions and ICS STRIVE provides an up-to-date picture of cyber incidents with a physical impact on industry and critical infrastructure.

For companies working with industrial automation, this report offers concrete insights and tools to strengthen their security strategy.

Fewer incidents, but greater threat

The number of registered cyber incidents with physical consequences decreased by 25 percent in 2025. At the same time, there is no reason for reassurance. According to the report, this decline is likely temporary, and the threat will increase again in the coming years.

It is striking that attacks by state actors and hacktivists have actually doubled. These attacks are increasingly targeting critical infrastructure, such as energy supply and transport.

Impact on physical processes remains significant

Cyberattacks have long ceased to be limited to IT systems. They are increasingly leading to disruptions in production, logistics, and energy supply. Examples include production stoppages, system failures, or even physical damage to installations.

Dependencies also play a major role. An attack on IT systems or suppliers can have direct consequences for operational processes. This calls for a broader view of cybersecurity across the entire chain.

From software to 'unhackable' solutions

An important development in the report is the shift towards so-called engineering-based security measures. Examples include hardware-based separations and physical security principles that are less susceptible to cyberattacks.

In addition, attention to secure connectivity is growing: limiting and controlling connections between IT and OT environments. This helps to effectively keep attacks at bay.

What does this mean for your organization?

The most important message is clear: OT security requires a different approach than traditional IT security.

• Assume realistic threats, including attacks by state actors.
• Limit dependencies between IT and OT where possible
• Invest in robust, demonstrably safe solutions
• Take into account the recovery and continuity of processes

Read the full report

Do you want to delve deeper into the trends, incidents, and recommendations? Download here the full report: