The frustrating reality after an OT cyberattack: no data, no trail, and no history.
August 28, 2026
There are three statements that sum up the frustrating reality for defenders responding to a cyberattack on operational technology (OT) systems: The attack data is not there. There is no trail to follow. There is no history to sort through.
While these dynamics will always be true for OT, defenders are getting help from cyber deception as it matures beyond honeypots to a more sophisticated, proactive cyber-defense tool.
To illustrate the problem, let's go back in time. Nearly 12 years ago, portions of Ukraine's electric grid went dark. It was an IT-to-OT attack, one that originates in the IT portion of the network and moves to the OT network. The adversary first established a position in enterprise systems, performed extensive reconnaissance, harvested credentials, found the paths toward operational systems, and then crossed into the technology that controlled the key components of the grid.
