Why it matters now: The industrial world is pouring unprecedented sums into operational technology (OT) cybersecurity — yet the breach rate has never been higher. A landmark global survey from TXOne Networks and Frost & Sullivan reveals a troubling paradox at the heart of modern industrial automation: nearly 9 in 10 organizations increased OT security budgets by more than 10% last year, but 60% still suffered a confirmed breach in 2025. The gap between investment and protection is no longer a footnote — it is the defining operational risk of the Industry 4.0 era.
Analyst Insight: The breach rate is not evidence that security spending fails — it is evidence that spending categories are misaligned with the threat. Budgets are flowing toward detection and visibility tools, while adversaries are moving laterally from IT networks directly onto programmable logic controllers (PLCs) that lack native security controls.
The Spending-Security Gap: By the Numbers
The TXOne Networks 2026 Annual OT/ICS Cybersecurity Report, based on a survey of 200 C-level OT security decision-makers across six industries and five regions, paints a stark picture. Budgets are rising, teams are growing, but adversaries are moving faster.
Key Survey Findings — Click to Expand
-
88% of industrial organizations increased OT security budgets by more than 10% year-over-year.
-
60% of respondents confirmed their organization experienced at least one OT security incident in 2025.
-
96% of OT security incidents are estimated to originate from IT-level compromises.
- The number of companies with dedicated OT security teams has increased significantly, reflecting a structural shift away from IT-department oversight.
- ENISA's Threat Landscape 2025 report documents OT-related threats accounting for 18.2% of all identified threat categories across nearly 4,900 analyzed incidents.
The European Union Agency for Cybersecurity (ENISA) further reports that over 42,595 new vulnerabilities were disclosed in the 2024–2025 reporting period — a 27% increase from the prior year — with critical vulnerabilities now weaponized within days of disclosure.
PLCs and Safety Controllers: The Crown Jewels Under Fire
At the center of this storm sits the programmable logic controller — the workhorse of industrial automation that governs everything from assembly lines to water treatment plants. Unlike IT servers, PLCs were designed decades ago for uptime and determinism, not cybersecurity. They lack native authentication, encryption, and logging. And they are now directly in the crosshairs.
Market Trend: In July 2026, six U.S. federal agencies — including CISA, the FBI, NSA, and the Department of Energy — updated a joint advisory (AA26-097A) confirming that Iranian-affiliated APT actors have been actively exploiting internet-facing PLCs from Rockwell Automation, Schneider Electric, and Siemens since at least March 2026. Victims span multiple critical infrastructure sectors and have experienced confirmed operational disruption and financial loss.
The attack vector is chillingly straightforward. Threat actors use leased, third-party hosted infrastructure to connect to misconfigured, internet-facing PLCs via the manufacturers' own programming software — Studio 5000 Logix Designer, EcoStruxure Control Expert, and TIA Portal. Once connected, they exfiltrate device project files and, in some cases, disrupt PLC function entirely.
The emergence of ICS-specific malware compounds the threat. ENISA's 2025 report identifies VoltRuptor, a specialized industrial control system malware developed by the Infrastructure Destruction Squad (IDS), which successfully compromised an Italian smart building automation company in June 2025. Meanwhile, Honeywell reported over 2,400 OT-targeted ransomware attacks in a single recent quarter.
PLC Vulnerabilities: Recent CVE Highlights — Click to Expand
-
CVE-2025-15102, CVE-2025-15103, CVE-2025-15358, CVE-2025-15359 — Critical flaws in Delta DVP-12SE11T PLCs identified by OPSWAT Unit 515, including authentication bypass, information exposure, and denial-of-service conditions.
-
CVE-2025-3450, CVE-2025-9970 — ABB B&R Automation Runtime vulnerabilities enabling denial-of-service against Safety Device Manager components and potential remote code execution.
- The SANS Institute reports that nearly 50% of all attack vectors on physical OT assets now originate from IT-side compromises, with USB devices and contractor laptops remaining leading causes of industrial security incidents.
The Noise Problem: When Everything Is Critical, Nothing Is
One of the report's most actionable findings is not about adversaries — it is about defenders drowning in data. Security tools deployed in OT environments flag hundreds of issues as "critical" without distinguishing between a low-impact engineering workstation and a safety-instrumented controller that, if compromised, could cause physical harm.
This lack of asset-aware prioritization creates what TXOne researchers describe as a "visibility without protection" gap. Security teams know something is wrong, but they cannot identify what matters most in operational terms — and meanwhile, production cannot stop for every alert.
Analyst Insight: The industry's obsession with detection has outpaced its investment in prevention. Detection tools generate alerts; prevention architectures stop threats before they reach the PLC. For safety-critical assets where downtime equals six-figure losses per minute, the distinction is existential.
From IT Compromise to OT Catastrophe
The IT/OT convergence that powers smart manufacturing has erased the air gap that once insulated industrial systems. A single phishing email to a human resources workstation can now cascade into a production-line shutdown. The TXOne data — showing 96% of OT incidents originate from IT — confirms that perimeter hardening alone is insufficient.
Ransomware gangs have recalibrated their calculus. Encrypting files is an IT nuisance; locking the PLCs controlling an automotive paint line is a production emergency that costs tens of thousands of dollars per minute. The financial leverage has shifted decisively toward operational disruption.
FAQ: Why Are PLCs So Difficult to Secure? — Click to Expand
Q: Why can't PLCs run traditional antivirus or endpoint detection?
PLCs operate on real-time, deterministic firmware with minimal processing overhead. Traditional security agents would interfere with scan-cycle timing, potentially causing production faults or safety failures.
Q: Why not simply patch PLCs like IT assets?
PLC firmware updates often require production downtime, validated recertification for regulated industries, and coordination across vendor ecosystems. Many facilities run PLCs on firmware versions that are years — sometimes decades — old, with no supported upgrade path.
Q: What does a prevention-first OT architecture look like?
It combines network segmentation with trust-based allowlisting at the device level, ensuring that only authorized commands and firmware can execute on PLCs — regardless of whether the network perimeter is breached.
The Prevention-First Imperative
TXOne Networks' report concludes with a framework urging industrial organizations to shift from detection-focused strategies to prevention-first architectures. This means implementing device-level trust mechanisms — not merely monitoring traffic — so that even if an adversary reaches the OT network, the PLC itself refuses unauthorized commands.
The structural trend toward dedicated OT security teams, noted across the survey population, is encouraging but insufficient on its own. Personnel without the right architectural posture will still face the same impossible triage: hundreds of critical alerts, no operational context, and a PLC that will execute whatever指令 it receives.
For the 60% of firms already breached, and the 40% that have not yet been, the message from the data is unambiguous. The industrial automation sector does not have a spending problem. It has a strategy problem. And the PLC — the silent, unauthenticated, utterly essential device at the heart of every factory floor — is where that problem will be resolved, or exploited, in the years ahead.
