The data is clear: 80% of operational technology cyber attacks begin as IT network breaches
The Evidence: IT-to-OT Lateral Movement is the Dominant Attack Pattern
I've spent my career on both sides of this divide - building large-scale IT infrastructure and implementing OT networks worldwide.
The data from 2025 confirms what I've observed in practice: the vast majority of operational technology cyber attacks begin as IT network breaches that enable lateral movement into control systems.
The 80% Problem: IT Breaches Enable OT Attacks
The statistics are unambiguous. A Rockwell Automation report found that as many as 80% of OT attacks originate from compromised IT networks¹. This isn't an accident or a temporary trend - it's the predictable result of network architecture decisions made in boardrooms, not control rooms.
Documented Attack Pattern (2020-2025):
- Colonial Pipeline (2020): DarkSide ransomware compromised IT systems, operational teams shut down pipeline as precaution²
- JBS Foods (2021): IT network breach led to production shutdowns across multiple facilities³
- Toyota (2022): IT compromise forced manufacturing halt at multiple plants⁴
- Nucor Corporation (2025): IT breach cascaded to production systems, taking 25% of US steel capacity offline⁵
- Masimo Corporation (2025): Manufacturing operations running below capacity after IT network unauthorized access⁶
The pattern is consistent: attackers compromise IT networks using standard techniques, then leverage trust relationships, shared credentials, and network connectivity to move into operational environments.
Why IT Security Models Fail in OT Environments
The fundamental incompatibility lies in opposing security philosophies:
IT Security Approach:
- Assumes breach will occur
- Focuses on data confidentiality and integrity
- Accepts system downtime for security updates
- Prioritizes remote access and centralized management
- Uses signature-based detection and response
OT Security Requirements:
- Must prevent operational disruption
- Prioritizes availability and safety
- Cannot tolerate unexpected downtime
- Requires local control and manual overrides
- Needs deterministic, predictable behavior
When organizations implement "IT security best practices" in OT environments, they create systematic vulnerabilities:
Shared Authentication Systems
Connecting OT networks to Active Directory creates a single credential that, when compromised, provides access to both environments. The Nucor attack exemplified this vulnerability - once attackers obtained domain credentials, they could authenticate to industrial control systems using the same identity infrastructure⁷.
Network Trust Relationships
IT/OT convergence establishes network paths that enable lateral movement. Security monitoring systems designed for IT environments often lack visibility into industrial protocols, allowing attackers to move undetected between environments⁸.
Centralized Management Platforms
"Single pane of glass" management systems create single points of failure. When these platforms are compromised, attackers gain control over both IT and OT systems simultaneously.
The Convergence Fallacy: Efficiency vs. Security
The push for IT/OT convergence promised operational efficiency through centralized management, real-time data sharing, and reduced infrastructure costs. However, the cybersecurity data reveals these benefits come at the expense of operational security.
Fortinet's 2025 OT Security Report found:
- 75% of OT organizations experienced at least one intrusion
- Manufacturing accounts for 68% of industrial ransomware incidents
- Organizations with mature OT security programs experienced 23% fewer attacks⁹
The critical insight: organizations that maintained infrastructure independence - keeping OT systems isolated from IT networks - demonstrated significantly better security outcomes.
Network Architecture Reality
From a pure network engineering perspective, IT/OT convergence violates fundamental isolation principles:
Protocol Bridging: Converting industrial protocols (Modbus, DNP3, Ethernet/IP) to TCP/IP eliminates protocol-based security boundaries. Attackers can now use standard networking tools to target industrial systems.
Broadcast Domain Expansion: Connecting OT networks to corporate LANs expands broadcast domains, enabling network reconnaissance techniques that were previously impossible in isolated industrial networks.
Attack Surface Multiplication: Each IT system connected to OT networks increases the total attack surface. A vulnerability in any connected IT system becomes a potential pathway to industrial control systems.
The Evidence: Internet-Exposed Industrial Systems
Shodan and Censys regularly document the extent of industrial system exposure. As of 2025:
- Over 145,000 industrial control system devices exposed globally
- 48,000 in the United States alone
- Many using default credentials or unpatched vulnerabilities¹⁰
These exposures result directly from IT-style network management applied to OT systems. The assumption that industrial devices can be safely connected to corporate networks, managed remotely, and updated automatically has proven catastrophically incorrect.
Case Study: Water Sector Vulnerabilities
The water sector provides clear evidence of convergence-related vulnerabilities. EPA findings show 70% of water utilities fail federal cybersecurity compliance standards, with most failures related to internet-connected industrial control systems¹¹.
American Water (2024): The vulnerability of the water sector was highlighted when American Water, serving 14 million people, suffered a significant IT network breach. While the company stated that its core water and wastewater operations were not compromised, the incident forced it to take non-operational IT systems offline and underscored the immense risk posed by IT/OT convergence. The event serves as a stark warning: attackers successfully breached the corporate network of the nation's largest water utility, demonstrating that the primary pathway to the operational environment is actively being exploited. It highlights the razor-thin margin that can separate a contained IT event from a potential public safety crisis, making it a clear example of the "80% Problem" in action.12
Multiple Pro-Russian Attacks: Hacktivist groups successfully targeted Unitronics PLCs across multiple water treatment facilities using basic credential attacks against internet-exposed systems¹³.
These incidents share common characteristics: industrial control systems connected to corporate networks for "efficiency" became attack vectors for operational disruption.
The Organizational Dimension
Beyond technical vulnerabilities, IT/OT convergence creates organizational security gaps. Only 52% of organizations place OT security under CISO authority, fragmenting incident response and security oversight¹⁴.
This organizational structure reflects the complexity of managing converged environments where different teams have different security priorities and operational understanding.
Conclusion: The Pattern is Clear
Fifteen years of IT/OT convergence data reveals a consistent pattern: the majority of operational technology cyber attacks begin as IT network breaches that enable lateral movement into control systems. The 80% lateral movement statistic isn't an anomaly - it's the predictable result of applying IT security models to OT environments.
The evidence is unambiguous, and it forces us to question the very foundation of convergence and consider a future where critical infrastructure is once again governed by the principle of operational independence.
🌊
Sources:
- Anatomy of 100+ Cybersecurity Incidents in Industrial Operations: A Research Study With Recommendations For Strengthening Defenses in OT/ICS
- Colonial Pipeline Congressional Testimony, 2021 (available via congressional records)(CEO Testimony Details)
- JBS Foods, 2021
- Toyota Motor Corporation Incident Reports, 2022
- SOCRadar Manufacturing Attacks Report, 2025
- Masimo Corporation Public Disclosures, 2025
- Dragos Industrial Ransomware Analysis Q1 2025
- Claroty State of CPS Security 2025
- Kaspersky ICS CERT Q1 2025 Industrial Cybersecurity Overview
- Censys Internet-wide Scanning Data, 2025 (referenced in multiple security reports)
- EPA Water Sector Cybersecurity Concerns
- American Water Incident Response Documentation, 2024
- Multiple CISA Alerts regarding water sector attacks, 2025 (available at cisa.gov)
- Volt Typhoon Critical Infrastructure Attacks
© 2025 Riverman Enterprises, LLC