Industrial cybersecurity is at an inflection point.
After attending S4 in the US and ManuSec in Europe, one thing became clear: OT security discussions are shifting.
The conversation is no longer centered only on segmentation, firewalls, and compliance checklists. It’s moving away from isolated technical controls and toward broader questions about connectivity, visibility, compliance, and identity.
Organizations are facing pressure from several directions at once.
Here are the biggest themes that stood out.
Key takeaways from S4x26 and ManuSec Europe
- AI will likely improve visibility and analysis across fragmented OT environments
- Industrial environments are becoming harder to defend as connectivity increases
- Penetration testing often reveals weaknesses in perimeter defenses and lateral movement controls
- Compliance frameworks such as NIS2 and IEC 62443 are influencing security investments
- Identity validation is becoming more complex as AI lowers the barrier for attackers
- Many OT environments are still working through foundational cybersecurity controls
1. Is AI really going to change OT security?
Short answer: yes – but not necessarily in the way many expect.
In IT, AI is already a disruptor. In OT, its impact may be even more meaningful because many environments still rely on older infrastructure. It is not unusual to find SQL 2000 servers or infrastructure that is 20–30 years old.
The industry has seen waves of promised transformation before. Industry 4.0 platforms and blockchain were widely discussed, but adoption often stalled because existing infrastructure could not realistically support them.
Why will AI be any different? You might ask.
Because AI has a different advantage.
It does not always require replacing existing systems. Instead, it can sit on top of fragmented environments and help interpret the data they already produce.
Examples include:
- correlating audit logs from multiple systems,
- connecting remote access activity with production impact,
- reviewing recorded remote sessions without someone watching hours of footage.
These use cases focus on improving visibility into existing systems rather than replacing them. For many OT teams, that makes AI immediately relevant.
AI will not magically modernize OT on its own.
But it may finally help us understand what’s already there.
2. Why are OT environments becoming harder to defend?
Another consistent theme across both conferences was the growing number of connections entering OT environments.
Factories are integrating more technologies than ever before:
- AI agents
- Monitoring platforms
- Remote access solutions
- External service providers
- Compliance-driven integrations
- Open-source tooling
- Data aggregation platforms
The long-standing assumption that OT environments can remain isolated is becoming less realistic.
The security challenge is no longer whether connections will increase. The challenge is managing these connections securely.
Each new integration, service, or connection expands the attack surface. Yet many factories are still working toward basic visibility into what systems are connected and who can access them.
As OT sites grow more connected, maintaining control becomes significantly more difficult.
And most environments aren’t ready for this level of complexity.
3. How likely is an OT cyberattack?
Quantifying cyber risk in OT environments remains difficult.
In IT, we have statistics. There are strong datasets that measure ransomware frequency, phishing success rates, and attack vectors. In OT, available data is limited because many organizations lack full visibility into their environment.
But when you talk to people running full-scope penetration tests across OT environments, the pattern is consistent:
- Perimeters are often breached faster than expected.
- Once inside, lateral movement is usually easier than anticipated.
- Small, overlooked systems connect to far more than anyone realized – i.e., provide pathways deeper into the network.
These findings reinforce a key assumption in modern security strategy: breach scenarios must be considered realistic.
And if a breach is certain, defense cannot rely solely on perimeter strength.
Security architecture therefore needs to focus not only on preventing entry, but also on containment, monitoring, and response after access is obtained.
Another takeaway from both conferences was the importance of more comprehensive penetration testing. Testing a single product or segment of the network rarely reveals the full exposure of an industrial environment.
4. How are regulations influencing OT security strategies?
Compliance requirements are increasingly influencing security decisions in manufacturing organizations.
At ManuSec, many discussions focused on practical implementation questions such as:
- How can we align with NIS2 requirements?
- What does IEC 62443 implementation actually look like?
- How can we control third-party remote access?
- How can we verify the security of devices delivered by machine builders?
And these questions are not just theoretical. These discussions reflect real operational decisions. Many organizations are actively adjusting their infrastructure and security processes to meet regulatory expectations.
Remote access was one of the most frequently discussed areas. The space is expanding rapidly – and with it, the pressure to secure it properly.
5. Is MFA and SSO enough for OT security?
Perhaps the most forward-looking discussion was around identity, not just authentication. Single Sign-On and Multi-Factor Authentication are now widely accepted security controls – but they’re not the finish line. And they address only part of the problem.
AI is lowering the barrier for attackers. Brute-force automation, credential stuffing, and voice spoofing aren’t advanced nation-state techniques anymore. They are becoming easier to execute. The entry level is dropping.
This raises a broader question for industrial environments: how can organizations verify identity beyond credentials? How do you validate humanity?
- If someone calls from a factory floor requesting access, how do you confirm it’s really them?
- If a third-party technician logs in remotely, how do you understand the context rather than simply validating credentials?
- If AI can imitate voice and behavior, what becomes the trusted signal?
In these situations, validating credentials alone may not be enough. Organizations will need stronger methods to verify users and maintain trust in access decisions.
The attack layer is expanding. The identity one must evolve just as quickly – and become a more important layer of OT security.
And that’s going to be one of the defining challenges of the next few years.
6. Are most organizations prepared for the next phase of OT cybersecurity?
Many don’t seem to be.
Despite all the talk about AI and advanced security tooling, the vast majority of industrial environments are still working through the fundamentals.
Common gaps discussed at both conferences included:
- network segmentation
- firewall configuration
- access control discipline
- visibility into connected systems
- regular, comprehensive penetration testing
If organizations implemented and maintained these top foundational controls effectively, overall risk would drop dramatically.
While improving these controls remains one of the most effective ways to strengthen cybersecurity, new technologies accelerate complexity.
Organizations that have not yet addressed foundational security measures may find the gap between current defenses and emerging threats widening.
The bigger picture: OT security is entering a new phase
Several forces are reshaping the OT security landscape at the same time.
AI is enabling new forms of visibility and context analysis. Connections into OT are multiplying. Regulatory pressure is rising. Attack sophistication is increasing. Identity validation is becoming more complex.
At the same time, legacy systems remain deeply embedded across global manufacturing.
These forces will not drive incremental change. They represent a structural shift in how OT environments will need to be defended.
The next phase of industrial cybersecurity will not be defined by a single product category or regulatory framework. It will be defined by how effectively organizations can:
- embrace contextual visibility across siloed systems
- assume breach and design architectures for resilience
- strengthen identity validation in a world of AI-assisted attacks
- reinforce foundational controls before layering on advanced capabilities
The single most important takeaway from both S4 and ManuSec was that OT security is entering its AI era – and the organizations that adapt early will be far better positioned to manage the risks and complexity that come with it.
Want the full discussion and insights from the conferences?
This special episode, where we break down the key takeaways from S4x26 and ManuSec Europe, along with all other episodes of the Secomea podcast Talk OT to Me, is available to:
- or watch on YouTube:
Frequently asked questions (FAQ)
What OT cybersecurity trends were discussed at S4x26 and ManuSec in 2026?
The most discussed trends included increasing OT connectivity, the role of AI in analyzing industrial environments, growing regulatory pressure, and the need for stronger identity validation for remote access.
Why is AI becoming relevant for OT cybersecurity?
AI can help analyze large volumes of data generated by industrial systems, correlate logs across platforms, and review remote access activity. This can improve visibility in environments that often rely on legacy infrastructure.
Why are OT environments becoming more difficult to secure?
Industrial networks are becoming more connected due to remote access, monitoring platforms, data aggregation tools, and external service providers. Each new connection expands the potential attack surface.
How does compliance influence OT security strategies?
Regulations such as NIS2 and standards like IEC 62443 require stronger security governance, risk management, and access control practices. Many manufacturers are now adapting their infrastructure to meet these requirements.
Is MFA enough to secure OT remote access?
MFA improves authentication security but does not fully address identity validation challenges. Organizations increasingly need additional context and verification to confirm who is requesting access to industrial systems.
Why are foundational security controls still critical for OT?
Basic measures such as network segmentation, firewall configuration, access governance, and visibility into connected systems remain the most effective ways to reduce cybersecurity risk in industrial environments.
