In late February 2026, Munich hosted ManUSec Europe, one of Europe's leading industrial cybersecurity conferences. On the agenda: an overview of the OT/ICS threat landscape, regulatory pressure (NIS2, IEC 62443, CRA), and an in-depth debate on the future of network segmentation, featuring speakers from Zscaler, Dragos, Secomea, Swidch, GSK, Triovega, and KPMG. Here is our intelligence briefing on what is changing in the industrial threat landscape, alongside key organisational and technical measures highlighted in the presentations.
Why OT security differs from IT
OT (Operational Technology) refers to systems that monitor and control physical equipment: programmable logic controllers (PLCs), human-machine interfaces (HMIs), SCADA systems, sensors, and actuators. Unlike in IT, an OT failure has immediate physical consequences: shut-down production lines, chemical processes exceeding safety limits, or disrupted power grids.
The figures presented in Munich show the scale of the problem. According to the Dragos 2025 report, 68% of industrial cyber incidents directly halted or degraded production lines. Cumulative losses from major documented OT incidents since 2017 (Merck, Maersk, TSMC, Norsk Hydro, Colonial Pipeline...) exceed $2.4 billion. In addition, the Allianz Risk Barometer 2026 ranks cyber as the top global business risk for the fifth consecutive year, with 42% of insurance claims now linked to cyber.
The fundamental difference between the two worlds lies in their constraints:
| Criterion | IT (corporate IT) | OT (industrial IT) |
|---|---|---|
| Priority | Data confidentiality | Availability and process safety |
| Equipment lifespan | 3 to 5 years | 15 to 25 years (PLC, HMI, SCADA) |
| Patch application | Regular cycles, routine reboots | Patch = reboot = production shutdown (costing millions/hour) |
| Protocols | HTTPS, SMBv3, modern standards | Modbus, Profibus, OPC-UA: often without authentication |
| Authentication | MFA, SSO, centralised directory | Static passwords, shared accounts, sometimes none |
| Consequence of an incident | Data breaches, service downtime | Physical impact: plant shutdown, human and environmental risk |
To structure this boundary, the industry relies on the Purdue model: Levels 0 to 2 cover the shop floor (sensors, PLCs, SCADA supervision), Level 3 hosts the MES and engineering workstations (a key pivot zone coveted by attackers), and Levels 4-5 represent corporate IT (ERP, Active Directory, Internet). Between the two, the iDMZ (Level 3.5) acts as a critical boundary. A finding echoed throughout the conference: 73% of OT compromises start on the IT side, via VPNs, phishing, or software supply chains.
IT/OT convergence compounds the dilemma. An air gap (physical isolation) provides protection, but Industry 4.0 (predictive maintenance, digital twins, AI) requires connectivity. Furthermore, corporate IT security investments (EDR, SIEM, firewalls) are bypassed by Living off the Land techniques: attackers use legitimate tools (remote maintenance, jump servers, VPNs) and stay undetected. As Triovega summarised: 'Delivered today. Out of support yesterday.' The solution is not to patch what cannot be patched, but to segment, monitor, and authenticate around legacy equipment.
2025 OT/ICS threat landscape
The annual Dragos report presented at the conference tracks 26 threat groups, including 11 active in 2025 and 3 new ones, alongside 3,318 industrial ransomware attacks (+25% year-on-year). Key highlights include:
- 73 % of incident responses begin with VPN exploitation or credential reuse: the No. 1 initial access vector.
- 88 % of organisations fail to detect simulated OT attacks during exercises.
- 56 % of OT environments cannot detect lateral movement between network segments.
- 13 weeks: average recovery time following an OT incident.
Among the tracked groups, three newcomers illustrate an industrialised division of labour: SYLVANITE, an access broker that exploits Ivanti VPNs within 48 hours of a CVE disclosure before selling access; AZURITE, a specialist in long-term persistence via compromised SOHO routers that exfiltrates OT network diagrams and alarm data without any malware signatures; and PYROXENE, which pivots from IT to OT via social engineering (fake LinkedIn recruiters targeting aerospace subcontractors). Among established groups, VOLTZITE (also known as Volt Typhoon) extracts SCADA configurations to identify process shutdown conditions, while in 2025 ELECTRUM carried out the world's first incident targeting distributed energy resources (DER) in Poland, using the destructive wiper PathWiper.
The defining trend of 2025 according to Dragos: adversaries are shifting from reconnaissance to attempting operational effects. They now map complete industrial control loops at the process level (SCADA configurations, alarm thresholds, shutdown conditions) rather than just at the network level. This is no longer espionage: it is preparation for physical effects.
Regarding vulnerabilities, Dragos proposes the NOW / NEXT / NEVER prioritisation framework: only 2% of ICS/OT vulnerabilities published in 2025 require immediate action (active exploitation + direct OT impact). For the 71% in 'NEXT', segmentation, monitoring, and MFA provide viable mitigation measures without production downtime. This is an essential principle when 119 new CVEs appear every day and 26% of ICS/OT advisories have no vendor patch available upon publication.
Organisational measures: governance before technology
A central theme across the KPMG and Secomea presentations: technology cannot solve a governance problem. Most of the incidents presented could have been contained had clear processes existed beforehand. Three key priorities emerge:
- Leadership involvement. NIS2, which Member States were required to implement by October 2024, holds management bodies accountable for cybersecurity measures (Art. 20) and allows executives to be temporarily banned from exercising management functions (Art. 32), with incident notifications due within 24 hours (early warning) and 72 hours (incident report). This is no longer a purely IT matter: a production shutdown directly affects EBITDA and reputation.
- Simulation exercises (TTX). KPMG's tabletop framework (context → incident → escalation → debrief) reveals who makes decisions when an incident crosses the IT/OT boundary. A recurring observation: 'in every real incident, the first two hours are lost debating problem ownership'. An annual TTX exposes these gaps before a real incident does.
- Training and a dedicated OT recovery plan. Restarting a factory takes longer than rebooting a data centre. 30% of incidents in the Dragos report were flagged by an operator ('something isn't right') before any automated tool: raising awareness among frontline teams turns them into sensors in their own right. Backup restorations must also be tested regularly to avoid vendor dependency.
Secomea data confirms that regulation is a driver of maturity: critical infrastructure shows an incident rate of ~25-28% compared to 33-37% for general manufacturing, and pharmaceuticals (regulated by the FDA/EMA) outperform comparable sectors. IEC 62443 also distributes responsibility across the entire chain: asset owners, integrators, and component suppliers, complemented by the CRA, which mandates security by design for industrial components.
Technical measures: authenticating and segmenting legacy systems
The most telling demonstration of the conference came from Swidch: Siemens PLCs with default passwords written on a label stuck beneath the equipment. Not an exception, but the norm across most industrial environments. Conventional IT solutions fail in OT: TOTP, RSA tokens, PKI, and SMS-based MFA all require network connectivity or a validation server, which are incompatible with an isolated environment and legacy controllers.
The solution presented, OTAC (One-Time Authentication Code), generates a one-time code using an algorithm shared between the user device and the OT equipment, without any network communication at the moment of authentication. Each code is dynamic, timestamped, and linked to identity, device, and the command executed, making it unusable if intercepted. The entire system operates in completely air-gapped environments across multi-vendor equipment (Siemens, Schneider, Rockwell) via a gateway, without altering existing infrastructure.
The debate: traditional segmentation or zero trust?
The most compelling moment of ManUSec 2026 was the clash of two distinct visions for OT segmentation.
What Zscaler criticises about traditional segmentation
According to Zscaler, beyond the network perimeter, OT is defenceless: the perimeter approach protects up to the iDMZ, but beneath it (where PLCs, HMIs, and RTUs sit), there is no strong authentication. VPNs, MPLS, and SD-WAN extend routable trust into factories rather than securing them; firewalls rarely monitor intra-VLAN traffic; VLANs group together hundreds of devices with differing risk profiles; and 76% of malware targets gateway equipment. Static segmentation is therefore argued to be rigid, creating 'islands' of isolated, unusable equipment while leaving shared credentials in place. Zscaler's answer: agentless microsegmentation of all IP-enabled OT equipment, browser-based remote access with comprehensive auditing, and a blast radius reduced to a single device, preventing ransomware from spreading. Case studies support this: 90 device types segmented without a minute of downtime at Kingston Technology, 15 plants secured, and a 75% reduction in SD-WAN spend for a global pharmaceutical firm.
How Triovega and GSK respond
For Triovega and GSK, the problem is not segmentation itself but its static implementation: modern segmentation relies on dynamic policies, not rigid VLANs. Two practical approaches were presented:
- edge.SHIELDOR (Triovega): an IT/OT container acting as a protocol translator. IT communicates via HTTPS/SMBv3, while the container translates to native OT protocols (unpatchable SMBv1, RDP, Telnet), inspecting every exchange. The OT network remains isolated yet functional: NotPetya's SMBv1 issue solved without patches or replacement. In production since 2025, after three years of R&D.
- Dynamic Edge Segmentation - DES (GSK): metadata-driven policies. Every newly connected device is discovered, classified (type, entity, risk score via existing tools: Active Directory, CrowdStrike, Tenable, ServiceNow), and automatically assigned its policy, enforced at switch level without a network overhaul. GSK's result: a project estimated at 6 years with traditional segmentation (3,500 maintenance windows) deployed in just a few hours per site, with IEC 62443 compliance reaching level 4 on certain segments.
Ultimately, both sides converge more than they differ: both reject the static VLAN/firewall model. The disagreement lies in the approach: cloud-native microsegmentation for Zscaler, dynamic segmentation on existing infrastructure for Triovega/GSK.
Key takeaways from ManUSec 2026
Five key messages run through all the presentations:
- OT is the ultimate target, not the initial vector. 100% of the incidents presented started on the IT side (VPNs, supply chain, phishing, ERP). The right question is no longer "will my OT be attacked?" but "when my IT is compromised, will my OT survive?".
- Segmentation must be dynamic, not static. The VLAN/firewall approach is considered outdated by Zscaler, GSK, and Triovega: policies must adapt in real time, without massive maintenance windows.
- OT endpoints lack strong authentication. Static passwords on PLCs, shared accounts, non-existent traceability: demonstrated live. Offline solutions like OTAC meet this requirement while respecting operational constraints.
- Regulation has arrived. NIS2 is not optional: personal liability for executives, incident notification, and, backed by Secomea data, regulated sectors experience fewer incidents.
- Adversaries are mapping industrial control loops. SCADA configuration extraction, alarm data exfiltration: preparations for physical impact have begun.
For defenders, as well as future SOC analysts, the message is clear: monitor the IT/OT boundary, track supplier remote access, detect lateral movement, and train before an incident occurs. OT security is no longer a niche topic: it is one of the areas where cybersecurity has the most tangible impact on the physical world.