What is OT security? The definitive guide to operational technology cybersecurity

A practical guide for OT engineers and IT security leaders managing industrial risk: what OT security protects, how it differs from IT security, who is attacking industrial environments and which controls reduce operational exposure.

OT security (operational technology security) is the practice of protecting programmable systems and devices that monitor or control physical processes and interact with the physical environment. It covers industrial control systems (ICS), SCADA, PLCs and the plant-floor computers that operate them, with safety and process availability prioritized alongside integrity and confidentiality.

• OT security protects systems that cause physical change. A failed control loop can become a safety event, not simply a data-loss event.
• NIST places OT security objectives in this order: safety, availability, integrity and confidentiality. The popular “AIC triad” is useful shorthand, not a separate formal standard.
• The number of ransomware groups affecting industrial organizations rose 49% year over year, from 80 in 2024 to 119 in 2025, affecting 3,300 industrial organizations.
• Much of the industrial disruption reported in 2025 began in IT systems with operational dependencies rather than through confirmed controller compromise. The two patterns require different defenses.
• Detection is improving faster than recovery. Nearly half of OT incidents were detected within 24 hours, but almost 1 in 5 took more than a month to remediate.
• Brownfield constraints shape every control decision. Long-lived assets, OEM-qualified configurations and legacy operating systems cannot always be upgraded or patched on an IT timetable.
• Asset discovery, segmentation, monitoring and recovery solve different parts of the problem. A defensible OT security program needs all of them.

OT security protects programmable systems and devices that monitor or control physical processes. It includes industrial control systems, building automation, transportation, physical access and environmental systems, along with the computers and networks that support them.

The defining characteristic is not a protocol, vendor or industry; it is the consequence. NIST defines operational technology as programmable systems or devices that interact with the physical environment, or manage devices that do so, by detecting or causing direct changes through the monitoring or control of devices, processes and events. That is broader than ICS alone. A building-management system, physical-access controller or environmental-monitoring array belongs inside the OT boundary because a cyber incident can produce a physical outcome.

That changes the risk model. In enterprise IT, the worst credible outcome is often unauthorized disclosure, encryption or destruction of data. In OT, it may be an unsafe physical state: an overpressured vessel, a de-energized substation or a production batch that fails Good Manufacturing Practice validation.

OT security therefore extends beyond prevention. It also covers operational continuity: withstanding an incident, restoring affected systems to a validated state and resuming production safely. Metrics such as mean time to repair (MTTR), recovery time objective (RTO), recovery point objective (RPO) and mean time between failures already belong to plant reliability. Effective OT security programs express cyber risk in those operational terms.

The main difference between OT and IT security is the order of priorities. IT security typically emphasizes confidentiality, integrity and availability. OT security starts with safety, followed by availability, integrity and confidentiality.

“IT uses CIA, OT uses AIC” is a useful teaching device, but it is incomplete. NIST places safety above the other objectives rather than simply reversing the CIA triad.

Availability-first thinking is a legitimate engineering requirement. A continuous-process plant that cannot tolerate an unplanned restart is not behind on security; it is operating within the physics of the process. The same applies to patching. An OEM-qualified control-system configuration may require recertification after an update, so the right response can be compensating controls and a planned maintenance window rather than an immediate patch mandate.

These constraints explain why OT cannot rely on prevention alone. When patching is gated by OEM qualification, a legacy engineering workstation cannot run a modern agent or a control network cannot tolerate active scanning, the remaining risk has to be managed through resilience: validated backups of configuration and logic, tested restoration and a measured MTTR for the assets whose loss stops production. For a deeper look at protecting older platforms, see securing legacy OT systems without disrupting operations.

OT includes the components that execute, supervise and coordinate physical work, plus the operational systems between the plant floor and the enterprise. For a broader architecture overview, see OT and ICS cybersecurity explained.

• ICS (industrial control system) is the umbrella term for SCADA, DCS and other configurations in which control components work together toward an industrial objective. ICS is not a synonym for SCADA.
• SCADA (supervisory control and data acquisition) is an architecture for geographically dispersed assets, combining data acquisition and transmission with centralized HMI monitoring and control.
• PLC (programmable logic controller) is a solid-state controller with user-programmable memory for functions such as I/O control, logic, timing, counting, PID control, communications and data processing.
• RTU (remote terminal unit) is a computer with radio or other communications capability for remote sites where conventional wired links may be impractical. Some PLCs with radio communications serve the same role.
• HMI (human-machine interface) is the hardware or software through which an operator interacts with a controller. Losing an HMI can remove process visibility even while equipment continues to run.
• DCS (distributed control system) is an integrated control architecture generally used for production systems in one geographic location, with supervisory control over localized controllers and processes.
• MES (manufacturing execution system) sits above the controllers. Siemens describes MES as software that monitors and synchronizes manufacturing activity, manages shop-floor production and provides real-time information on production, resources and materials. ISA-95 places this manufacturing-operations-management activity at Level 3, between process control and Level 4 business functions. NIST SP 800-82 Rev. 3 does not define MES separately, so this definition comes from Siemens.

The Purdue Model organizes industrial and enterprise functions into levels so network segmentation can follow function instead of treating the plant as one flat network.

NIST SP 800-82 Rev. 3 presents this hierarchy:

• Level 0: field I/O devices
• Level 1: controller network
• Level 2: area control and HMI
• Level 3: operations and control
• Level 4: business planning and logistics
• Level 5: enterprise

Demilitarized zones sit at major enterprise and operations boundaries. NIST notes that organizations may use the Purdue model and ISA-95 levels when designing segmentation, and explains that ISA-95 developed from the Purdue Enterprise Reference Architecture.

“Level 3.5” is widely used industry shorthand for the industrial DMZ, but it is not a formally numbered level in the NIST figure. Policies that use the term should define it locally rather than cite NIST for the number.

Industrial IoT sensors and cloud analytics also create paths that bypass a strict hierarchy. Many organizations now layer identity-based access controls over level-based segmentation rather than relying on the model alone. Acronis examines that shift in Is the Purdue Model for operational technology security outdated?.

Two patterns dominate the current threat landscape: adversaries deliberately targeting control environments, and IT-originating incidents whose operational dependencies halt production. Treating them as the same problem leads to poor control choices.

Dragos assessed a coordinated late-December 2025 attack against Polish combined-heat-and-power and renewable-energy-management systems as activity consistent with ELECTRUM. It described the incident as the first major coordinated cyberattack against distributed energy resources at scale and reported deliberate attempts to affect operational assets.

Dragos also reported that activity tracked as TAT25-95 compromised a state-owned Pakistani power-transmission company in July 2025, searched for SCADA exploits, scanned Modbus ports and exfiltrated roughly 100 operational files. That kind of process reconnaissance is what asset visibility and protocol-aware monitoring are designed to detect.

For more attack-pattern detail, see the Acronis Threat Research Unit entry on operational technology and SCADA attacks.

Several 2025 incidents show how IT disruption can stop production without evidence of controller compromise:

• Nucor told the U.S. Securities and Exchange Commission that unauthorized access to IT systems led it to halt some production operations as a precaution. A later filing said production was restored and affected data recovered from backups.
• Masimo detected unauthorized activity on its on-premises network on April 27, isolated affected systems and operated some manufacturing facilities below normal levels. Order processing, fulfillment and shipping were temporarily affected, with manufacturing near full capacity by late May.
• Jaguar Land Rover extended a manufacturing pause after its September 2025 cyber incident through October 1, then began a phased restart on October 8, bringing engine and battery facilities back before additional vehicle lines.
• Asahi Group said ransomware deployed on September 29, 2025 encrypted servers and terminals supporting ordering and shipment. Manual processes continued while logistics restoration extended into December and normalized by February 2026.

None of these cases establishes controller compromise. All show that dependence on IT systems is itself an OT risk.

Dragos tracked 119 ransomware groups affecting 3,300 industrial organizations in 2025, up from 80 groups in 2024. Manufacturing accounted for more than two-thirds of victims.

Siemens estimates that unplanned downtime costs the world’s 500 largest companies nearly $1.4 trillion a year, equal to 11% of annual revenue. This is an industry survey and extrapolation based on 181 online interviews with maintenance, engineering and IT professionals, not a census.

Dragos modeled $329.5 billion in global losses from a severe but plausible 1-in-250-year OT cyber event, including $172.4 billion in business-interruption loss. It is a tail-risk scenario, not an expected annual loss.

The SANS Institute found that 21.5% of surveyed organizations had experienced a cybersecurity incident in the previous year, and 40% of those incidents disrupted operations. Only 13% had fully implemented advanced ICS-aware remote-access controls such as session recording or real-time approval. Nearly half of incidents were detected within 24 hours, but almost 1 in 5 took more than a month to remediate. The survey drew 330 responses.

The operational lesson is clear: detection is maturing faster than recovery. An organization that identifies an incident within an hour but needs five weeks to restore a validated production state has a continuity problem. MTTR, rather than MTTD, is the remaining exposure.

Governance is changing too. Fortinet reported that 52% of surveyed organizations put the CISO or CSO in charge of OT in 2025, up from 16% in 2022, and that 95% placed OT responsibility somewhere in the C-suite. Its global survey included more than 550 OT professionals.

Recovery is the measurable gap. When detection improves faster than restoration, the cost is production time. Acronis Cyber Protect for OT is designed around backup, recovery and endpoint protection for brownfield systems, including legacy and air-gapped OT environments.

Three references carry most of the weight: NIST SP 800-82 Rev. 3 for U.S. guidance, ISA/IEC 62443 for industrial cybersecurity lifecycle and system requirements, and NIS2 for EU legal obligations.

Published in September 2023, NIST SP 800-82 Rev. 3 superseded Rev. 2 and remains the main U.S. government reference for OT architecture, risk, controls and OT-specific security constraints.

ISA/IEC 62443 is a multipart series, not one standard with a single publication date. It defines requirements and procedures for secure industrial automation and control systems across stakeholders and the operational lifecycle. Key parts include:

• 62443-2-1: asset-owner security programs
• 62443-3-2: system security risk assessment
• 62443-3-3: system security requirements and security levels
• 62443-4-1: secure product-development lifecycle requirements
• 62443-4-2: technical component requirements

Each part has its own edition and date, so policies should cite the applicable part rather than the series in general.

NIS2 is Directive (EU) 2022/2555, adopted on December 14, 2022 and published in the Official Journal on December 27, 2022. Member States had until October 17, 2024 to transpose it into national law and were required to apply the necessary measures from October 18, 2024. Saying that “NIS2 became effective in October 2024” is less precise than saying national application of transposed measures began then.

NIS2 does not establish a separate OT regime, but it covers OT-intensive sectors including energy, transport, drinking water, wastewater, health and manufacturing. Article 21 addresses incident handling, business continuity, backup management and disaster recovery, supply-chain security, secure acquisition and vulnerability handling, control assessment, cyber hygiene and training, cryptography, access control and appropriate multifactor authentication.

See OT cyber resilience for IEC 62443 and NIS2 compliance for the data-protection implications at plant level.

NIST CSF 2.0 has six top-level Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern became a distinct Function in version 2.0, while Recover covers restoring assets and operations affected by an incident.

• Govern: assign OT cyber-risk ownership and establish accountability.
• Identify: maintain an asset inventory covering controllers, engineering workstations, historians, network infrastructure and process criticality.
• Protect: segment by function, secure remote access and apply compensating controls where OEM qualification constrains patching.
• Detect: use passive-first, protocol-aware monitoring that does not introduce unsafe traffic or latency.
• Respond: pre-authorize safe-state decisions. In OT, containment actions can carry process risk and require engineering sign-off before an incident.
• Recover: execute tested restoration procedures against verified backups, followed by safety validation before restart.

One point is often misstated: creating, protecting and testing backups sits under PR.DS-11 in Protect, while recovery-plan execution and restoration sit under RC.RP in Recover. NIST’s OT Backup Quick Start Guide bridges the two by treating backup management as essential to both response and recovery.

The guide recommends backing up PLC logic, DCS and SCADA configurations, HMI files, network-device configurations, firmware, engineering software and supporting documentation, with recurring restoration tests. A detailed OT backup and recovery strategy should cover both the data and the sequence required to resume safe production.

Brownfield environments make recovery harder. The systems that need restoration are often the same ones that could not be patched, could not run a modern agent or could not be taken offline for testing. Replacement hardware may no longer exist. A recovery plan that assumes a like-for-like machine, a connected management plane and an IT engineer on site is not realistic for many plants.

Acronis Cyber Protect for OT addresses this part of the framework with image-based backup and recovery for HMI workstations, SCADA servers, engineering workstations and historians. It supports dissimilar-hardware recovery, legacy Windows and Linux platforms, on-premises and air-gapped deployments, and behavioral detection that can operate without cloud connectivity. Immutable storage can reduce backup-tampering risk, but it does not address data exfiltrated before encryption. Every restoration still requires engineering validation and a safe-restart procedure. Related reading: When a cyberattack stops production: How OT teams can recover faster.

Six practices deliver most of the risk reduction while respecting OT constraints:

1. Maintain a validated asset inventory. Use passive-first discovery, with selective and safe active querying only where the asset class can tolerate it.
2. Segment by function. Use Purdue or ISA-95 levels as the frame, with enforced boundaries at the enterprise-to-operations junction.
3. Control remote access with ICS-aware mechanisms. Session recording and real-time approval remain a major measured gap; only 13% of surveyed organizations had fully implemented them.
4. Apply compensating controls where patching is constrained. OEM qualification and recertification are legitimate blockers. Use a documented industrial patch-management process for legacy Windows systems.
5. Back up OT configuration and logic, not just business data. Include PLC logic, DCS and SCADA configurations, HMI files, network-device configurations and firmware.
6. Test restoration and measure MTTR. Scheduled recovery exercises close the gap between fast detection and slow return to production.

For clause-level mappings and additional controls, see 8 OT security best practices for industrial environments.

OT security includes several distinct problem categories. Vendors usually specialize, so architecture should begin with the problem being solved rather than with one supplier’s product list. The summaries below reflect each vendor’s public positioning and are not a ranking.

• Claroty focuses on cyber-physical-system asset visibility, multiple discovery methods, exposure management and continuous threat detection. It also uses asset context to support network-policy definition and segmentation.
• Dragos combines passive-first discovery with optional targeted active collection to maintain inventories across OT, IT, IoT and IIoT, alongside ICS-aware network monitoring and deep packet inspection of industrial protocols.
• Nozomi Networks describes automated OT and IoT discovery using passive and active collection, deep packet inspection and other data sources, with continuous network, threat and anomaly monitoring.
• Tenable OT combines cyber-physical-system visibility with vulnerability and exposure prioritization, threat detection and monitoring for configuration changes and anomalous behavior.

• Fortinet combines asset discovery with segmentation and secure networking, including microsegmentation, per-switch-port policies and isolation of OT devices and zones.
• Cisco positions Cyber Vision and its industrial networking stack around OT visibility and segmentation, with recommended zones and policies aligned to IEC 62443 zones and conduits.
• Forcepoint states that its NGFW supports microsegmentation, while its Layer 2 Firewall and inline IPS can transparently segment networks and control access. Its public positioning is less OT-specific than Fortinet’s or Cisco’s.
• Waterfall Security Solutions uses Unidirectional Security Gateways to enforce one-way information flow in hardware, replicating OT data outward while preventing an inbound network path through the gateway.

Acronis focuses on resilience and continuity for the PC-class assets whose failure can stop production: HMI workstations, SCADA servers, engineering workstations, historians and jump servers. Acronis Cyber Protect for OT combines image-based backup, dissimilar-hardware recovery, behavioral anti-ransomware protection that can operate without cloud connectivity, support for legacy Windows and Linux systems, and operator-led restoration.

Its design target is MTTR to a validated production state rather than backup completion alone. It does not replace ICS protocol discovery or network segmentation; it is deployed alongside those controls. See the Acronis Cyber Protect for OT technical overview for scope and legacy operating-system coverage.

OT security protects programmable systems and devices that monitor, control or otherwise interact with physical processes. It covers industrial control systems and other operational systems where cyber events can affect physical operations.

IT security traditionally emphasizes confidentiality, integrity and availability. OT gives greater weight to safe, continuous physical operation. NIST places the priorities in this order: safety, availability, integrity and confidentiality.

OT includes SCADA and DCS environments, PLCs, RTUs and HMIs, as well as building automation, transportation, physical-access control and environmental-monitoring systems where programmable technology interacts with physical operations.

The Purdue Model organizes industrial and enterprise functions into layers, from field devices at Level 0 through controllers, area control, HMIs and operations, to business-planning and enterprise systems at Levels 4 and 5. It is commonly used as a reference for industrial network segmentation.

ISA/IEC 62443 is a multipart cybersecurity standards series for industrial automation and control systems. It covers organizational security programs, system risk assessment and requirements, secure product development and component-level technical controls.

NIS2 does not create a separate OT security regime, but it applies to many OT-intensive sectors, including energy, transport, water and specified manufacturing activities. Covered entities must implement measures for incident handling, business continuity, backup and disaster recovery, supply-chain security and access control. The Member State transposition deadline was October 17, 2024.

OT backups preserve the configuration, logic, software and documentation needed to restore industrial systems after a cyber incident. NIST recommends regular backup creation and protection, plus recurring restoration testing for PLCs, SCADA and DCS systems, HMIs and network infrastructure.

A defensible OT program combines accurate asset inventory, segmented architecture, secure remote access, continuous monitoring, incident-response preparation and tested recovery. NIST SP 800-82 provides OT-specific guidance, while ISA/IEC 62443 provides lifecycle and system-security requirements.

Ready to close the recovery gap? See how OT-aware backup, recovery and endpoint protection work in brownfield industrial environments with Acronis Cyber Protect for OT.