OT Cybersecurity Year in Review & Key Takeaways for 2025

This article explores key OT cybersecurity developments in 2024 and offers actionable initiatives that manufacturers and critical infrastructure operators should prioritize to strengthen their cybersecurity posture in 2025.

8 major trends in OT cybersecurity

1. The rise of ransomware attacks and ICS intrusions
   

   In 2024, ransomware attacks continued to target the manufacturing sector more than any other industry globally. Manufacturers in Europe and North America were particularly affected, with many attacks leveraging supply chain vulnerabilities.

   73% of organizations experienced intrusions impacting their Operational Technology (OT) systems, a sharp increase from 49% in 2023, as revealed by Fortinet’s 2024 State of Operational Technology and Cybersecurity Report.

   Global OT intrusions rose notably, with the most significant spikes seen in North America, Europe, and parts of Asia. These breaches often exploited weak perimeter defenses and outdated OT systems, underscoring the vulnerability of legacy systems that were not built to withstand modern cyber threats.

2. Critical infrastructure risks persist in the industry
   

   The cyber intrusion at American Water Works Co.—the largest publicly traded US water and wastewater utility covering 14 states and about 15 million people—served as a stark reminder of the industry’s unresolved vulnerabilities and the ripple effects on supply chains. Although water and wastewater systems remained operational, the incident raised concerns among North American manufacturers dependent on clean and reliable water supplies for production. 

   This cyber incident is just an example of the enduring threats to essential services and the increasing overlap of operational technology (OT) and information technology (IT), which underscores the urgent need for stronger protection in critical infrastructure.

3. The impact of global IT outages on OT environments
   

   With crashes across about 8,5 million Microsoft Windows systems, the global IT outage caused by the CrowdStrike software update failure in July 2024 impacted all sectors, from banking and media to healthcare and retail – not to mention the cancellation of over 7,000 flights for 1,3 million passengers. The cumulative financial damage from the outage is estimated to be at least $10 billion globally.

   OT environments around the world faced substantial challenges, with some plants forced to halt production lines entirely, while others experienced significant slowdowns as IT teams worked to isolate affected devices and roll back the faulty update. Manufacturers experienced significant financial losses—not only from production downtime but also from the expense of hiring external cybersecurity experts to recover systems.

   It goes without saying that testing software updates in isolated environments before deployment is critical for manufacturers. Additionally, adopting diverse software ecosystems can help mitigate the risks of over-reliance on a single vendor.

   The incident also highlighted the need for vendors to improve their crisis communication strategies, providing faster fixes and more transparent guidance during such events.

4. The exploitation of IT-centric remote access technologies
   

   In 2024, many organizations rapidly rolled out remote monitoring tools like VPNs, focusing on maintaining operations but overlooking security. In regions adopting aggressive Industry 4.0 initiatives, such as Germany and Japan, this haste led to configurations with insecure default settings and inadequate patch management.

   Cybercriminals took advantage of VPNs’ weaknesses to infiltrate OT networks, causing interruptions in manufacturing operations and exposing sensitive information.

   In response to this, manufacturing companies are shifting toward Secure Remote Access solutions tailored to OT environments, moving away from generic IT-based VPNs to address the specific challenges of operational technology.

5. Regulators across regions are focusing on OT cybersecurity

   • in the EU:

     The deadline for EU member states to transpose the NIS2 Directive into national law was October 17, 2024. However, only a few countries successfully incorporated NIS2 into their local laws by the deadline; many others followed by the end of the year, while some governments are still at different stages of their transposition process.

     This crucial EU cybersecurity legislation is designed to strengthen critical infrastructure against mounting cyber threats. Delays in the NIS2 transposition process create uncertainty for businesses and citizens, limit the law’s benefits, and disrupt the EU’s internal market.

     2025 will be pivotal as EU countries finalize the NIS2 Directive’s incorporation into national laws, strengthening Europe’s cybersecurity defenses.

     October also marked the official adoption of the Cyber Resilience Act (CRA), setting mandatory cybersecurity standards for products with digital elements and placing obligations on manufacturers, importers, and distributors.

     Manufacturers of industrial control systems (ICS) in EU member states must now ensure compliance to remain competitive.
     Starting in 2027, only products meeting CRA standards and bearing the CE marking can be marketed in the EU and EEA.

   • In the UK:

     The UK introduced a proposed Cyber Security and Resilience Bill to modernize cybersecurity requirements for critical industries such as manufacturing, energy, transport, and healthcare. It’s part of the UK’s broader strategy to update security requirements, especially after Brexit, ensuring the country remains competitive and aligned with global standards and international frameworks like the EU’s NIS2 Directive.

     UK companies will need to comply with new mandatory incident reporting requirements and strengthen supply chain security. A particular focus will be placed on mitigating vulnerabilities in connected systems, such as OT and IT networks, to enhance resilience in critical sectors.

   • in the US:
     North America’s heavy reliance on rail and pipeline systems for the transportation of oil, gas, and raw materials makes these sectors high-value targets for cyberattacks. Manufacturers in the automotive, chemical, or food and beverage industries could face severe disruptions if transportation systems experience security breaches—such as widespread delays, supply chain setbacks, and production slowdowns with significant financial implications.

     To address the increasing threats to these essential services, the Transportation Security Administration (TSA) proposed new cybersecurity rules targeting railways and pipelines—critical infrastructure sectors in the US.

     The proposed regulations emphasize preventing unauthorized access, mitigating ransomware attacks, and ensuring operational resilience in critical infrastructure networks.

     This involves mandatory risk assessments, incident reporting, and implementation of secure systems.

     Proactive steps for companies include working with suppliers and logistics partners to secure transportation networks and investing in technologies that enhance resilience and monitoring.

     The new TSA cybersecurity rules signal a growing recognition of the interconnected nature of transportation, supply chains, and manufacturing. Ensuring the security of pipelines and railways will not only protect infrastructure but also safeguard economic stability and operational efficiency for manufacturers and industries dependent on raw material transport.

6. Zero-Trust gaining momentum across Europe and the US
   

   The “Zero Trust” model, which assumes no implicit trust for users or devices within a network, gained significant traction in manufacturing environments throughout 2024.

   Within OT, manufacturing organizations are implementing:

   • granular access control: role-based privileges to ensure employees and systems only had permissions aligned with their tasks;
   • continuous verification: devices interacting with OT systems are constantly monitored for compliance with security policies;
   • micro-segmentation: networks are divided into smaller segments, isolating critical OT components from the broader IT network.

7. Heightened emphasis on supply chain security

   • In the EU, the Cyber Resilience Act in Europe directly addressed supply chain risks, holding manufacturers accountable for the cybersecurity of their vendors and partners. This was particularly relevant for industrial control systems (ICS) vendors and machine builders.

     Manufacturers are now required to assess and monitor the cybersecurity posture of their suppliers and partners. At the same time, vendors are mandated to prove their compliance with CRA guidelines through detailed documentation and certifications.

     These mandates, while adding costs for audits, certifications, and technology updates, have already proven beneficial for proactive manufacturers. Organizations that prioritized supply chain security early experienced fewer disruptions caused by cyber incidents.

   • In North America, the increased complexity created by the higher interconnection of global supply chains created opportunities for cyberattacks. Proof of this was the rise in ransomware targeting logistics providers, which exposed vulnerabilities that could cascade into manufacturing operations.

     In the US and Canada, manufacturers began partnering more closely with logistics providers, technology firms, and cybersecurity vendors to improve visibility and threat detection across supply chains.

     Among key initiatives were joint threat intelligence, integrated security tools (combining GPS tracking with cybersecurity systems for real-time monitoring), and government involvement (agencies like the US Department of Homeland Security facilitated public-private partnerships to strengthen infrastructure defenses).

     These efforts resulted in better detection and response to cyber threats across interconnected systems, reduced production delays due to third-party vulnerabilities, and stronger collaboration between manufacturers and their partners, building trust and resilience across the supply chain.

8. Worldwide shortage of OT cybersecurity professionals

   The gap between the demand for OT cybersecurity expertise and the availability of qualified professionals is growing.

   In North America and Europe, manufacturers have struggled to find skilled workers with knowledge of both IT and OT environments, leaving critical roles unfilled.

   In contrast, companies in regions like India and Southeast Asia have focused on equipping their existing teams with the necessary skills through targeted training and development programs to address this talent shortfall.

   To manage the strain caused by limited personnel, manufacturers in regions like North America and East Asia are leading the adoption of AI-driven cybersecurity tools for threat detection. These technologies accelerate the identification of unusual activity in OT networks, easing the burden on overstretched teams and enhancing overall operations’ security.

The road ahead: learning from 2024 to prioritize in 2025

Based on the events, trends, and developments reported so far, we can infer the following 8 mitigation strategies that manufacturers and machine builders can adopt to counter OT cybersecurity challenges:

1. Implement Zero Trust Architectures (ZTA)

   Adopting a zero-trust approach ensures that no user or device is automatically trusted, even if it’s inside the network perimeter.

   Every access request undergoes strict verification, reducing the risk of unauthorized access. Granting access on a “need-to-know” basis limits lateral movement: if attackers compromise one part of the network, ZTA prevents them from reaching other critical OT environments.

   With multifactor authentication (MFA), micro-segmentation, and software-defined perimeters (SDPs), OT systems can remain invisible to unauthorized users—and protected from them.

2. Establish a patch management policy specific to OT environments

   OT environments often use legacy systems that are not designed to be updated frequently. Moreover, downtime for patching can disrupt critical operations in manufacturing processes. Still, timely security patches are crucial to protect against known vulnerabilities, especially in remote access technologies, close exploited loopholes, and reduce the attack surface.

   Patch scheduling tools can help automate and streamline updates during planned maintenance windows without manual oversight. And with intrusion prevention systems (IPS), you can implement virtual patching to shield vulnerabilities when updates are not possible.

3. Invest in advanced monitoring solutions and SIEM for OT

   
   Security Information and Event Management (SIEM) systems tailored for OT networks are today a must.

   Deploying AI-driven monitoring tools can enhance the detection of anomalies within OT systems, enabling proactive threat mitigation.

   With 24/7 surveillance, such tools can identify unusual patterns or behaviors in network traffic, signaling potential threats before they escalate—even when human operators are unavailable.

   Intrusion detection systems (IDS) and firewalls specifically designed for OT systems will also help you monitor and filter traffic.

4. Strengthen remote access security

   Remote access tools are non-negotiable today—but the market offers a variety of solutions that present big differences when it comes to technology, use cases, security, and scalability.
   OT systems require specific protection that IT-centric solutions simply can’t offer.

   Secure Remote Access solutions purpose-built for OT, on the other hand, prevent unauthorized entry, reduce insider threats, and encrypt communication while offering features addressing compliance and security—such as session recording and audit logs.

5. Cover both IT and OT systems in your regular security assessments

   With periodic reviews of both IT and OT environments, you can uncover outdated configurations, unpatched devices, and other security gaps.

   Partner with OT cybersecurity experts for in-depth penetration testing and risk assessments and use tools like vulnerability scanners specifically designed for OT environments.

6. Continuously review your incident response plan and conduct regular cybersecurity drills to test it

   A formalized plan detailing how to respond to and recover from cybersecurity incidents needs to recognize the interconnected vulnerabilities between OT and IT networks and establish unified security policies for both environments.

   Your incident response needs to be regularly updated and improved to address emerging threats. Only with periodic reviews can you ensure it will help you effectively contain threats before they spread across the network, resume operations quickly, and minimize downtime.

   Conduct tabletop exercises to simulate attack scenarios and refine readiness across teams. Make sure to include OT and IT teams to promote coordination and maintain offline backups of critical OT data and configurations.

7. Train and educate the workforce on OT-specific risks

   As surprising as it might sound, most breaches still start with phishing or social engineering attacks targeting employees.
   Promoting awareness and educating your staff on the unique risks associated with OT, such as the consequences of unsafe USB device usage, gives your employees and contractors the knowledge needed to recognize and respond to cyber threats.

   Make sure to involve all levels in your organization, from leadership to frontline operators. You can gamify training with phishing simulations and interactive exercises to keep employees engaged.

8. Prioritize supply chain security and regulatory compliance

   Building resilient supply chains starts with stronger collaboration with vendors to improve end-to-end visibility and security. Establish cybersecurity requirements for suppliers, ensuring adherence to frameworks like the NIS2 legislation and the Cyber Resilience Act (CRA).

   You can invest in compliance management tools to track regulatory requirements, align operations with evolving regional cybersecurity regulations, and streamline reporting.