Loading story…
Global cybersecurity agencies have issued a joint call for critical infrastructure operators to conduct comprehensive mapping of their operational technology (OT) environments. The guidance, supported by the United Kingdom's National Cyber Security Centre, the U.S. Cybersecurity and Infrastructure Security Agency, and other allied partners, emphasizes the urgent need for exhaustive OT inventories to combat evolving cyber-physical threats. Operators of essential services such as power grids, water systems, and manufacturing plants are being instructed to catalogue all assets by their criticality, ensuring that every component of their OT environment is accounted for. The framework outlined by these agencies includes documenting system connectivity, validating and maintaining records through structured change management, and rigorously managing third-party access and contractual risks. Security experts highlight that while creating a definitive record of OT assets is both feasible and necessary, it presents significant challenges, particularly for organizations with sprawling, decades-old networks. Legacy systems often lack the real-time visibility required for effective inventory, making the process complex and resource-intensive. Despite these obstacles, the increasing sophistication of cyber-physical threats means that organizations can no longer afford to operate with blind spots in their OT environments. The guidance stresses the importance of asset visibility as a foundational element of OT security, enabling organizations to identify vulnerabilities and respond more effectively to incidents. Agencies recommend that operators implement structured change management processes to ensure that asset records remain accurate and up to date. The guidance also calls for robust management of third-party access, recognizing that supply chain and contractor relationships can introduce additional risks. By following the principles-based framework, critical infrastructure operators can reduce the likelihood of undetected vulnerabilities and improve their overall security posture. The agencies warn that failure to maintain comprehensive OT inventories could leave organizations exposed to major cyber incidents. The call to action reflects a growing consensus among global cyber authorities that asset management is a critical defense against increasingly complex threats targeting industrial control systems. The guidance is intended to drive a cultural shift in how OT operators approach security, moving from reactive measures to proactive risk management. Experts agree that while the task is daunting, the benefits of improved visibility and control far outweigh the challenges. The initiative underscores the need for ongoing collaboration between government agencies, industry stakeholders, and security professionals to protect critical infrastructure from cyber threats. Ultimately, the guidance aims to ensure that operators are not caught off guard by attacks that exploit unknown or unmanaged assets within their OT environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
US government agencies led by CISA released a joint guide, Adapting Zero Trust Principles to Operational Technology, to help critical infrastructure operators apply zero-trust concepts in OT environments. The guidance recommends OT-specific measures such as passive asset inventory, segmentation, adapted identity controls, secure remote access, supply chain risk management, and coordinated incident response.
Australia's cyber authorities published a CI Fortify resource focused on securing operational technology environments. The release provided official guidance for critical infrastructure operators on OT security as a distinct government initiative.
An industry report published on 2025-09-29 warned operational technology operators that inadequate network mapping can create major visibility gaps and increase security risk. The two references appear to be duplicate coverage of the same advisory rather than separate events.
7 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecybersecuritydive.com
Open sourcecyber.gov.au
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcecontent.govdelivery.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA, the UK **NCSC**, and multiple international partners released **Secure Connectivity Principles for Operational Technology (OT)** guidance aimed at reducing risk created by increased connectivity into industrial environments (e.g., industrial control systems, sensors, and other critical services). The guidance is positioned for operators of essential services facing business and regulatory pressure to enable remote monitoring and management, and it emphasizes that formerly *air-gapped* OT is now more exposed due to expanded remote access and IT/OT convergence. The guidance highlights that insecure or exposed OT connectivity is being targeted by a broad range of adversaries, including **ransomware groups**, **state-backed actors**, and **pro-Russia hacktivists** conducting opportunistic attacks against global critical infrastructure. Recommended defensive themes include **network segmentation**, **strong authentication**, continuous monitoring, and minimizing remote access paths to prevent disruptive incidents with potential real-world safety and service-delivery impacts; CISA also solicited stakeholder feedback via a product survey. Separate opinion pieces discussing AI in critical infrastructure and power redundancy risks in OT, and an industry roundup of Chinese cybersecurity companies, do not provide additional reporting on this specific guidance release.
Jun 29, 2026
Industrial control systems (ICS) and critical infrastructure organizations are facing an escalating threat landscape due to the convergence of operational technology (OT) and information technology (IT), which has eroded traditional security boundaries. As ICS environments become increasingly interconnected with corporate IT networks, they are exposed to a broader array of sophisticated cyber threats, including those from nation-state actors. The consequences of a successful cyberattack on ICS can be severe, ranging from equipment failure and production halts to environmental disasters and threats to human safety. The Colonial Pipeline incident, which resulted from a single compromised password, demonstrated how a digital breach can disrupt physical operations and supply chains, affecting millions of people. In addition to direct attacks on ICS, critical infrastructure organizations must contend with the proliferation of unmonitored data across collaboration platforms such as SharePoint, Google Drive, Exchange, Gmail, Teams, Slack, and Box. This 'back-office clutter' creates a vast, largely ungoverned attack surface that is increasingly targeted by sophisticated adversaries. Sensitive documents, including CAD files, PDFs, and chat transcripts, are often left unclassified and unmonitored, making them attractive targets for cybercriminals. Security leaders have traditionally focused on patching and segmenting OT systems, but the rapid growth of data sprawl in enterprise collaboration tools now demands equal attention. The ease of spinning up new sites and channels for business operations has led to petabytes of data scattered across thousands of locations, often without adequate oversight. This situation is exacerbated by the fact that attackers can exploit these unmonitored environments to gain access to critical systems or sensitive information. The need for robust ICS cybersecurity is now a top priority, as the risks extend far beyond data loss to include operational disruption and public safety hazards. Organizations are urged to implement comprehensive monitoring, classification, and governance of both OT and IT environments to mitigate these risks. The evolving threat landscape requires a shift from traditional, static security measures to dynamic, intelligence-driven approaches that can adapt to new attack vectors. Failure to address these challenges could result in significant operational, financial, and reputational damage for industrial organizations. The integration of continuous monitoring and incident response capabilities is essential to detect and respond to threats in real time. As cyber threats continue to evolve, the security of ICS and the management of enterprise data sprawl must remain at the forefront of critical infrastructure protection strategies. The lessons from past incidents underscore the urgent need for a holistic approach to cybersecurity that encompasses both the physical and digital assets of industrial organizations.
Jun 29, 2026
A virtual briefing hosted by the Institute for Critical Infrastructure Technology (ICIT) argued that **telecom networks’ “crown jewels”**—including signaling pathways and subscriber identity/metadata—remain high-value targets, and that traditional perimeter defenses are insufficient against advanced adversaries. The session cited activity associated with China-linked threat actors **Salt Typhoon** and **Volt Typhoon** as illustrative of systemic telecom weaknesses, and promoted *privacy-first mobile-carrier* design choices (e.g., minimizing exposed identifiers and reducing the long-term value of compromised data) as concrete controls to reduce attack surface and limit blast radius. Separately, the U.K. **National Cyber Security Centre (NCSC)**, working with **CISA**, the **FBI**, and other international partners, released guidance titled **“Secure Connectivity Principles for Operational Technology”** aimed at reducing exposed and insecure connectivity in OT environments, including nuclear-sector contexts. The guidance outlines **eight foundational principles** intended to help organizations protect OT networks from highly capable and opportunistic actors, including **nation-state** threats, against a backdrop of accelerating IT/OT convergence and increasing rates of OT/ICS-impacting incidents reported across critical infrastructure.
Jul 12, 2026