Nozomi Networks Labs recently released its Hot Summer Cyber Trends report, which analyzed this summer’s threat landscape for operational technology (OT) systems. It provides a critical roadmap for where threat actors are setting their sights this year.
Notably, the report found that manufacturing continues to be the top targeted sector for threat actors, followed closely by the transportation and utilities sectors. The report also looks into the top target regions, the vulnerability landscape, and provides mitigations and recommendations for original equipment manufacturers (OEMs) working to secure their systems against these threats.
What’s different this year
Because Nozomi creates its report annually, we looked at last year’s report to see what’s different in 2026. Here’s what we found.
- Speed: Artificial intelligence (AI) is “rapidly increasing the speed of vulnerability discovery, exploit development and threat evolution,” says Nozomi. This creates particular challenges for systems where patching is often constrained by safety, availability and operational requirements. That means exploitation windows are shrinking while OT patching still depends on maintenance windows, which may need to be planned months ahead.
- Geopolitical and physical vulnerabilities overlap: This summer’s threat landscape was shaped as much by geopolitics and global attention as by technology, says Nozomi. Examples include Russian actors hacking cameras to track NATO supply routes, attacks on water, power and hospitals, and major events such as the FIFA World Cup.
- Severity: The share of “high” and “critical” vulnerabilities is 10 points higher than last year.
- Fundamentals still matter: Attackers mostly use basic methods like weak credentials, but they now do so faster and at greater scale.
Keeping up with the fast-changing threats to manufacturing and infrastructure facilities, as well as the evolving strategies to mitigate those threats, is no easy task. It requires casting a wide net. ISA’s annual Automation.com Monthly cybersecurity trends issue is one place to start, because it’s a window into the range of insights and advice available from ISA and the wider industrial automation community.
ISA OT cybersecurity resources
Automation.com is the place to search for the latest on OT cybersecurity topics. You can find the latest research, information on emerging topics such as the European Union’s Cyber Resiliency Act and much more.
ISA is the globally vetted source for unbiased, vendor-neutral information on automation cybersecurity. Its community, standards, educational materials and products can help you maintain a strong OT cybersecurity culture. Start with the ISA website to explore standards, training, certification and other resources.
Other resources include:
OT Cybersecurity Summit: This year’s annual event was held in Prague, Czech Republic. Sessions covered the use of AI to support OT cybersecurity, regulation and compliance, collaboration and governance, and cyber-physical safety strategies. If you missed it, catch up on the highlights via ISA’s Podomation podcast.
The 2027 OT Cybersecurity Summit is scheduled for 16-17 June in Athens, Greece.
ISA Global Cybersecurity Alliance: ISA created the ISA Global Cybersecurity Alliance (ISAGCA) to advance OT cybersecurity awareness, education, readiness, standardization and knowledge sharing. The group creates white papers, hosts webinars and provides other materials supporting the ISA/IEC 62443 standard and OT cybersecurity developments. There you’ll also find links to ISASecure.
What to do today
Manufacturing and infrastructure facilities know they need to act now. Here are 10 tips from Nozomi Networks and others that should be priorities:
- Close the credential gap. Remove default passwords, enforce strong authentication (especially on remote and third-party access) and monitor for unusual account activity.
- Build complete asset visibility. Cover wired and wireless networks, endpoints and the internet of things (IoT), and use AI-assisted asset matching to fill gaps.
- Prioritize vulnerabilities by risk. Use known exploited vulnerabilities (KEVs), asset criticality and exposure. Where you can’t patch, use virtual patching and network-level compensating controls.
- Segment IT and OT. Most attacks start in IT (information technology) and then pivot into OT.
- Defend against social engineering. Help desks and identity processes are part of the attack surface now.
- Use curated, OT-specific threat intelligence. That means Yara, Sigma and STIX (Structured Threat Information Expression) content, not just indicators of compromise (IOC) feeds, and detection logic you keep updated.
- Prepare response and resilience plans. Align them with operational risk and downtime tolerance, and run exercises that include operations and safety teams.
- Use AI-assisted Security Operations Center (SOC) tooling and intelligence sharing. This helps teams that are new to OT keep up with alert volume.
- Watch regulation. Check your obligations under frameworks such as NIS2 and IEC 62443 if you operate in the EU.
- Subscribe to resource alerts. Automation.com newsletters are a great way to stay on top of the products, news, research and other insights geared toward the OT cybersecurity professional. They deliver the insights IT and automation professionals need to be aware of as trends evolve.
