Waterfall Security Solutions

8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors

Waterfall team — Wed, 01 Apr 2026 05:26:23 +0000

OT Insights Center8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors

8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors

Ask different questions, get different answers: What should you be asking your OT “secure” remote access (SRA) vendor?

Waterfall team

April 1, 2026

Terminology first. The word “secure” is in quotes, because cybersecurity (like safety) is a continuum, not a pair of discrete yes/no states. We can always be safer, or less safe. We can always be more secure, or less. The question “Are we secure?” is meaningless. The question “How secure are we?” has an answer. The question “How secure should we be?” is even more important. Anyone who uses “secure” as an adjective is selling something – “secure” communications (really: encrypted and/or authenticated), “secure” boot (really: cryptographically authenticated firmware), “secure” by design (really: better security by designing security in), and so on.

There is no such thing as “secure” remote access.

Want to learn more about OT remote access? Join our next webinar: “13 Ways To Break “Secure” OT Remote Access Systems”

Question 1: For SRA into OT systems, does your vendor provide IT-grade protection we HOPE can detect attacks in time, or do they provide hardware-enforced, engineering-grade protection?

What is IT-grade protection? Imagine a long suspension bridge has dangerous harmonic frequencies – people simply walking over the bridge risk setting up oscillations that build up, eventually to the point of tearing the bridge apart. See the 1940 Tacoma Narrows disaster for an example. Imagine that a bridge you cross every day on the way to work has this problem, and so is stabilized by hydraulic dampers – multiply redundant dampers, redundant power supplies and “secure” control systems. How happy would you be driving across that bridge every day if you knew the design engineer HOPED that, if there was a cyber attack on the control system, HOPED we could detect the attack before the bridge tore itself apart. How happy would you be knowing the design engineer HOPED that, if we detected the attack in time, HOPED we could scramble an incident response team fast enough to prevent disaster?

Hope is not what we expect of design engineers. we expect bridges to carry a specified load, in a specified operating environment, for a specified number of decades, with a large margin for error. Engineering-grade solutions, like over-pressure relief valves and unidirectional gateways, behave deterministically, no matter how sophisticated a cyber attack is launched at them.

Question 2: If someone phishes an SRA credential, can they exploit a vulnerability in the Multi-Factor Authentication (MFA) to get into the protected OT systems?

“Secure” Remote Access vendors boast about their MFA, but MFA is software. Yes, the little dongle on our keychain looks like hardware, but the “secure” SRA system we are logging into with the dongle is software. All software has defects, and some defects are security vulnerabilities. Some of those vulnerabilities are known to the SRA product developers, who are madly trying to develop patches / security updates for the vulnerabilities. Others are known only to our enemies, who are using these zero-day vulnerabilities against us without our knowledge. Our attackers phish our “secure” password, ignore our RSA dongle or cell phone authentication app, and exploit a zero-day in the “secure” system to break in with our credentials and work their will upon our OT networks. Is this possible in the “secure” system we are using or considering using?

Question 3: Is that SRA a H2M solution, or an M2M solution?

Terminology:

H2M = human-to-machine = sends keystroke & mouse movements in / receives screen images back out.
M2M = machine-to-machine = software talking to software – for example: an HMI running on our remote laptop, talking through a VPN to PLCs or OPC servers in the OT network, or a PLC programming tool on our remote laptop, talking through a VPN to update firmware in our safety-instrumented systems (SIS).

When “secure” remote access supports M2M, then any malware that might be present on our laptops can reach across the M2M/VPN and connecting to any vulnerable, out-of-date (eg: XP) OT systems in our OT network. Such systems are a bonanza to common malware that relies on exploiting known vulnerabilities.

Question 4: Can users override SRA encryption / certificate warnings?

Many “secure” OT solutions use industry standard Transport Layer Security (TLS) to protect their connections across the Internet. This is the same technology used by web browsers, M2M applications, and the vast majority of Internet and IT applications. TLS uses certificates. If an attacker intercepts our communications, they can substitute their certificates. Our software – eg: our web browsers – are supposed to diagnose the substitution. A lot of these applications, like many web browsers, caution their users when they see an unexpected certificate and ask if the user really wants to proceed. Most users answer, “yes of course – override the warning / force the connection to complete / finally I’m connected through this nonsense!” And they successfully use their MFA and other credentials to log into the “secure” remote access system in a way that lets the bad guys take over their session.

Question 5: Can you paste or file-transfer arbitrarily complex files into OT equipment remotely?

A lot of OT equipment is sensitive – it malfunctions if anti-virus is running on it, so we do not run AV on it. It costs a lot of money to re-certify for safety if anything changes, so we have not applied any security updates, nor upgrade the operating system. These systems are often found still running obsolete versions of Windows XP. What risk is there in downloading a PDF file to this device? Or a software update executable? Or a clever new OT tool we just found on the Internet that claims it can “clean the hard drive” on this very old, very vulnerable, very important OT system? If people can transfer files that can contain malware, sooner or later they will do so. Does our “secure” remote access permit this very dangerous operation?

Question 6: Is there a session timeout?

Many users find session timeouts to be really annoying. Users must log in repeatedly when they get distracted by other emergencies during OT SRA sessions. But what happens if there is no session timeout? We log in and finish a job in the evening on our home computer. We go to work the next day. Our kids log into the home computer to do their homework. They find our session still open, still connected. What harm could that cause? Or – we put no password on our cell phones, because constantly entering PINs is annoying. Now open a “secure” remote access session, set the phone down and forget it. A stranger picks it up. There is no PIN. The remote session is still active into our critical infrastructure operations. What harm could be done?

Question 7: Do you require deny-by-default on firewalls protecting OT networks?

Many “secure” remote access vendors claim we can install their software on the OT computer of your choice, and the software will connect straight out to the Internet through IT/OT and IT firewalls, without needing to do anything to reconfigure the firewalls. This design assumes that OT firewalls are configured like most IT firewalls are configured – they allow any outbound connection by default, disallowing only inbound connections and outbound connections to known-dangerous destinations.

Such configuration means the “secure” remote access solution counts on a firewall configuration that any well-meaning technician on the OT network can use to install their own rogue remote access solution, among other things. For example: open a persistent SSH connection to a home Linux computer that is able to forward connections back into OT systems or download a “free” remote access / support solution, connect it out to the cloud and at home, rendezvous with this solution from a home computer. Well-meaning technicians imagine that there is no need to “bother” IT or engineering with matters like this when anyone with the most modest of computer skills can download and install whatever “secure” remote access software they wish, using their XP admin credentials.

Question 8: Does your OT SRA need a firewall?

Most SRA vendors assume there is a firewall between the IT and OT networks, and their SRA software relies on establishing connections through this firewall. Firewalls, however, are vulnerable to many attacks. For examples, see Thirteen Ways to Break a Firewall. In contrast, hardware-enforced remote access (HERA), for example, is compatible with, but does not require a vulnerable firewall at the IT/OT interface.

Question 8 1/2: Does your SRA support MFA?

We count this as only half a question, because all commercial-grade OT SRA supports MFA. The only SRA without MFA is the “roll your own” kind, where you are hard-pressed to find any vendor to ask these questions of in the first place. Internet-exposed, and even IT-exposed OT facilities should all support MFA and we must enable that MFA without fail.

Digging Deeper

To better understand why these questions are important, or to dig deeper into the simple attack scenarios that lie behind these questions, please join us in our April webinar 13 Ways To Break “Secure” OT Remote Access Systems – And questions you should be asking your OT SRA vendor about these attacks”.

About the author

Waterfall team

8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors

April 1, 2026

Webinar: 13 Ways To Break “Secure” OT Remote Access Systems

March 29, 2026

Webinar: 2026 OT Cyber Threat Report

March 25, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post 8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors appeared first on Waterfall Security Solutions.

Webinar: 13 Ways To Break “Secure” OT Remote Access Systems

Andrew Ginter — Sun, 29 Mar 2026 10:58:06 +0000

OT Insights CenterWebinar: 13 Ways To Break “Secure” OT Remote Access Systems

Webinar: 13 Ways To Break “Secure” OT Remote Access Systems

and the questions you should be asking your OT SRA vendor...

Join us on April 23, 2026, 11am NY Time

How much security do “secure” remote access solutions really provide? We’re laying all the cards on the table.

In this webinar, we’ll explore 13 ways attackers can break OT remote access systems, show which SRAs are most vulnerable & which are most deserving of the “secure” title.

We’ll finish with the questions you should be asking vendors to understand how exposed their solutions are.

Understanding attacks is essential to designing robust defenses. One way to compare the strength of competing OT SRA solutions is to compare the attacks those solutions defeat reliably, vs the attacks they do not defeat.

In this webinar, we cover a lucky 13 ways to break “secure” remote access systems, and look at which kinds of systems are vulnerable to each kind of attack.

We finish with questions to ask “secure” OT remote access vendors to understand how exposed their solutions are to these kinds of attacks.

In this session we cover VPNs, jump hosts and DMZ’s, and we look at the more modern cloud / broker / rendezvous architectures, as well as more deterministic, hardware-enforced solutions.

The 13 Attacks We’ll Be Covering:

1) Shoulder surfing attacks – how attackers capture credentials without hacking

2) Social engineering users – exploiting human behavior to gain access

3) Password guessing & brute-force attacks – why weak credentials still succeed

4) Help desk social engineering – bypassing security through support teams

5) Rogue OT remote access (SRA) – unauthorized remote connections into OT networks

6) Exploiting outdated encryption – breaking legacy crypto protocols still supported

7) Malware passing through VPNs – how threats propagate inside trusted remote connections

8) Malware hiding in file transfer & clipboards – hidden risks in everyday remote workflows

9) Session hijacking & stealing logged-in cell phones – taking over active authenticated sessions

10) Exploiting known vulnerabilities – patching gaps and N-days lead to breaches

11) Stealing cookies to hijack browser sessions – compromising web-based remote access and password vaults

12) Zero-day exploitation in OT remote access – how unknown vulnerabilities are weaponized

13) Bypassing remote access entirely – when attackers go straight through the firewall

Join us on April 23rd to understand attacks and look at questions we should be asking our OT "Secure" Remote Access vendors.

About the Speaker

Andrew Ginter

Andrew Ginter is the most widely-read author in the industrial security space, with over 35,000 copies of his three books in print. He is a trusted advisor to the world's most secure industrial enterprises, and contributes regularly to industrial cybersecurity standards and guidance.

Register Now

The post Webinar: 13 Ways To Break “Secure” OT Remote Access Systems appeared first on Waterfall Security Solutions.

Webinar: 2026 OT Cyber Threat Report

Waterfall team — Wed, 25 Mar 2026 15:30:57 +0000

OT Insights CenterWebinar: 2026 OT Cyber Threat Report

Webinar: 2026 OT Cyber Threat Report

Watch now - on demand!

In 2025, 57 cyber attacks caused real-world damage in heavy industry, world-wide. This is a 25% drop from 2024, but that’s the tip of the iceberg

Most of this reduction is because of temporary factors affecting ransomware attacks. Nation-state and hacktivist attacks doubled, with most attacks targeting critical infrastructures.

This is the only industry report focused exclusively on verified cyber incidents with physical consequences. The data set is public, all the incidents we use are included in the report’s appendix with links to public news reports

Highlighted attacks include:

Jaguar / LandRover – the most costly production shutdown in a decade,
Colins Aerospace – a crippled software system caused flight cancellations and delays for weeks – highlighting the need for rapid recovery or manual fall-backs for critical systems operated and managed by third parties,
Grounded and mis-directed ships – again highlighted the need for multiple independent checks on important external inputs, such as GPS signals, and
Polish distributed generation – a near miss because the lights stayed on, an example of the Russian nation state targeting European critical infrastructures, and a cautionary tale about “bricking” control equipment.

Join Greg Hale of ICS Strive and Andrew Ginter of Waterfall Security as they explore what lies beneath all of 2025's OT breaches with physical consequences.

Key Takeaways:

Record-breaking costs of consequences

What is behind the drop in ransomware attacks

Key defensive developments of 2025, in light of these threats

About the Speaker

Waterfall team

Stream it Now

The post Webinar: 2026 OT Cyber Threat Report appeared first on Waterfall Security Solutions.

80K Stryker Devices Wiped Following Iran-Attributed Attack

Andrew Ginter — Tue, 24 Mar 2026 17:21:31 +0000

OT Insights Center80K Stryker Devices Wiped Following Iran-Attributed Attack

80K Stryker Devices Wiped Following Iran-Attributed Attack

Stryker produces medical devices. An Iran-attributed attack erased 80,000 corporate and personal devices (cell phones? laptops?) as a result of an intrusion into the Microsoft cloud and an instruction from that cloud to erase / reset the devices.

Andrew Ginter

March 24, 2026

https://www.bleepingcomputer.com/news/security/stryker-attack-wiped-tens-of-thousands-of-devices-no-malware-needed/

Stryker’s product shipping has stopped for now, but it is not clear yet whether manufacturing was also impaired. This is the kind of attack I’ve worried about for years – bad guys who get into IT or industrial cloud systems can wind up with the ability to affect thousands of devices via their encrypted cloud connections, in what might otherwise be heavily-defended sites.

Given the data available today, we will probably count this incident in next year’s OT Cyber Threat Report – we count incidents in the public record in manufacturing, heavy industry, critical industrial infrastructure and large building automation systems (eg: data centers). This year’s report is about to release – you can request your copy here.

About the author

Andrew Ginter

80K Stryker Devices Wiped Following Iran-Attributed Attack

March 24, 2026

Cyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact

March 18, 2026

Waterfall Security Solutions recognized by Gartner®

March 9, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post 80K Stryker Devices Wiped Following Iran-Attributed Attack appeared first on Waterfall Security Solutions.

Cyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact

Waterfall team — Wed, 18 Mar 2026 14:02:45 +0000

OT Insights CenterCyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact

Cyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact

Waterfall team

March 18, 2026

The growing importance of Cyber-Informed Engineering (CIE) was recently recognized with a Cyber Policy Award for Research Impact from the Institute for Security and Technology.

The award honors a team whose work has helped advance CIE as a framework for addressing cyber risk in critical infrastructure. Among those honored were:

• Virginia Wright and Benjamin Lampe, leading the development of CIE at Idaho National Laboratory,

• Cheri Caddy of Savannah River National Laboratory who led the development of the CIE strategy and worked in the Whitehouse with the Department of Energy to secure funding for the CIE initiative,

• Andrew Ohrt of West Yost who led the deployment of CIE in the water sector and developed a number of publically-available resources to illustrate how to use CIE in critical infrastructures, and

• Our own Andrew Ginter, VP Industrial Security at Waterfall Security Solutions, who contributed industry perspectives to the CIE initiative, and whose book, speaking & podcast helped increase awareness of CIE in the OT security community at large.

The recognition of CIE highlights a broader shift in how cyber risk is being understood and managed in industrial environments.

What is Cyber Informed Engineering?

Cyber-Informed Engineering is “the big umbrella” – bringing together relevant parts of safety engineering, protection engineering, automation engineering, network engineering, and most of cyber security into a comprehensive body of knowledge for addressing cyber risks to physical operations. The body of knowledge looks at the problem of OT cybersecurity from the engineering perspective:

• Addressing high-consequence risks first, consistent with industrial engineering practices, and addressing high-frequency, low-impact irritants only secondarily,

• Encouraging modest design changes to physical processes to take entire sets of consequences and attack vectors off the table – avoiding / eliminating risk rather than merely mitigating the risk / reducing frequency of high-consequence events,

• Recognizing that the key objective in terms of preventing most truly unacceptable outcomes is preventing sabotage rather than espionage, and recommending strong oversight / control of online and offline communication channels that can transmit attack information into sensitive systems.

In short, CIE is positioned as “a coin with two sides.” One side is cybersecurity – teach engineering teams about cyber threats, about cybersecurity tools, and about the intrinsic limitations of such tools, so that these teams can evaluate residual risks. The other side is engineering – overpressure relief valves, manual fall-backs and other “unhackable” mitigations for all types of risk – including cyber risks. This engineering side of the coin has been under-represented in most OT security advice to date, and represents a big opportunity to dramatically improve OT security outcomes.

“CIE is the most important innovation in OT security in 20 years – bringing the engineering risk-management perspective and powerful engineering tools and approaches to bear on the problem of assuring safe, reliable and efficient physical operations, in an increasingly hostile cyber threat environment.”

Andrew Ginter, VP Industrial Security, Waterfall Security

Waterfall and Cyber Informed Engineering

At Waterfall Security Solutions, we believe in the principles of CIE. Just as the public expects bridges to carry a specified load, in a specified operating environment, for a specified number of decades, with a large margin for error, increasingly society demands that automation systems for physical operations carry a specified threat load, until at least the next opportunity to upgrade our defenses, with a large margin for error. And society generally expects that “carry a specified threat load” means to carry that load deterministically, with a very high degree of confidence.

This philosophy is very compatible with Waterfall’s own Unidirectional Gateways and hardware-enforced solutions. Our solutions are part of the Network Engineering body of knowledge – hardware-enforced / deterministic tools to prevent cyber attacks from pivoting through consequence boundaries: connections between networks with dramatically different worst-case consequences of compromise.

To learn more about Cyber-Informed Engineering and the work of Andrew Ginter, who was recognized with the Cyber Policy Award for Research Impact, you can request a copy of his book, Engineering-Grade OT Security: A Manager’s Guide.

About the author

Waterfall team

Consequential OT Breaches Dropped in 2025 – What Happened?

March 5, 2026

How to Apply the NCSC/CISA 2026 Guidance

March 1, 2026

Webinar: 2026 OT Cyber Threat Report

February 25, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post Cyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact appeared first on Waterfall Security Solutions.

Waterfall Security Solutions recognized by Gartner®

Waterfall team — Mon, 09 Mar 2026 10:07:27 +0000

OT Insights CenterWaterfall Security Solutions recognized by Gartner®

Waterfall Security Solutions recognized by Gartner®

Waterfall team

March 9, 2026

Waterfall Security, the leader in hardware-enforced OT security and remote access for cyber physical systems (“CPS”), is pleased to announce our inclusion in Gartner’s recent Market Guide for CPS Secure Remote Access report.

Gartner points out that “traditional remote access methods, such as VPNs, jump boxes or emerging approaches such as IT remote privileged access management (RPAM) products, lack the granularity and contextual knowledge needed for production or mission-critical environments,” and recommends organizations “replace VPNs and proceed with caution with IT-centric tools”. In the representative vendors section, the report identifies Waterfall for its new HERA (Hardware-Enforced Remote Access) product as a Representative Vendor.

Hardware-Enforced Remote Access

How Does HERA’s “physics” work? The Waterfall HERA product is a pair of a-symmetric cooperating Unidirectional Security Gateways, each physically able to send information in only one direction. The outbound gateway sends encrypted screen images out of the OT network. The inbound gateway sends encrypted keystrokes, mouse and other HERA protocol information into the OT network. The inbound gateway contains a hardware filter that passes only HERA information – all IP packets are discarded. In addition, login/encryption credentials are stored securely in TPM hardware in the remote HERA client computer, as well as TPM hardware in the HERA hardware on the OT side of the HERA – this in addition to conventional software-based multi-factor authentication (MFA) mechanisms.

“We are pleased to be recognized in the Gartner Market Guide. Waterfall’s hardware-enforced solutions, including Unidirectional Gateways and HERA are designed to eliminate entire classes of network-borne attack vectors.”
Lior Frenkel, CEO

Modern OT Remote Access

Today’s industrial operations expect remote access products with modern features, including: zero-trust-style granular access, MFA, a guaranteed protocol break, just-in-time session control, and the ability to inspect and terminate existing sessions, especially in NERC CIP and other regulated environments. Waterfall’s HERA provides all of these industry-leading features, in addition to the unique hardware-enforced security measures.

OT remote access is increasingly common and is increasingly seen as a serious threat to the security of industrial operations. The latest advice from CISA, CCCS and other government authorities regarding OT remote access states that the risk of exploiting VPN and other software vulnerabilities can “become detrimental to business operations.” As a result, these authorities recommend that “business owners should consider hardware-enforced solutions.” The era of “physics-based” and hardware-enforced solutions is upon us.

To explore Waterfall’s HERA, download the Waterfall Guide: Rethinking Secure Remote Access for Industrial and OT Networks.

Gartner, Market Guide for CSP Secure Remote Access, Katell Thielemann, Wam Voster, Sumit Rajput, 3 February 2026.

GARTNER is a trademark of Gartner, Inc. and/or its affiliates. Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

About the author

Waterfall team

2026 OT Cyber Threat Report

February 18, 2026

Groundbreaking OT Security Guidance

February 5, 2026

Applying the New NCSC / CISA Guidance

January 20, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post Waterfall Security Solutions recognized by Gartner® appeared first on Waterfall Security Solutions.

Consequential OT Breaches Dropped in 2025 – What Happened?

Andrew Ginter — Thu, 05 Mar 2026 03:23:36 +0000

OT Insights CenterConsequential OT Breaches Dropped in 2025 – What Happened?

Consequential OT Breaches Dropped in 2025 – What Happened?

In 2025, 57 cyber attacks caused real-world damage in heavy industry, world-wide. This is a 25% drop from 2024, and the first drop in this statistic in six years. What happened?

Andrew Ginter

March 5, 2026

The OT Data Set

The data set in the Waterfall / ICS STRIVE 2026 OT Cyber Threat Report shows 57 OT attacks with physical consequences world-wide in the industries the report tracks. Most of these attacks were ransomware, and this has been the case since the turn of the decade. Nation-state and hacktivist attacks nearly doubled, but that increase was not enough to make up for the reduction in ransomware attacks. The question of “what happened?” is really “what happened to ransomware attacks?” A definitive answer is not possible – there are a lot of ransomware groups out there, each with different MODUS OPERANDI, motives and circumstances. Speculation is possible however, and there is secondary data available, so let’s speculate a bit.

The Ransomware Data

Ransomware attacks overall seem to have flat-lined or maybe even dropped a little in 2025. There is no such thing as a repository or reliable count of all ransomware world-wide, but there are some indications:

FBI data for ransomware incidents reported to them in 2025 is not yet available, but the 2018-2024 data set shows ransomware increasing overall, but having “ups and downs.” 2021 was an “up” year, 2022 was smaller, and then started increasing again.
The NCC Group tracks ransomware sites where the criminals list the organizations they claim to have victimized. These are criminals though, should we believe them? Reliable or not, the NCC data shows a spike in February, a sharp reduction through most of the rest of the year, with a bit of an uptick in the last two months, with only a small increase in overall claims since 2024.
The German BSI has access to legally-required (confidential) incident disclosures in Germany. Their data shows 2025 nearly flat over 2024.
The Microsoft Threat Report claims that ransomware attacks that reached the encryption stage increased only 7% in 2025 over 2024.

Reasons for this phenomenon are varied – the best speculation world-wide seems to include:

Recent law-enforcement activity took down a number of prominent ransomware C2’s, impairing attack capabilities,
Recent sanctions and arrests of ransomware criminals may have a deterrent effect on individuals not yet fully committed to a criminal lifestyle, and
Mid-2025 saw a major provider in the criminal ecosystem vanish, and other providers jostled and competed to fill the void.

What else might be going on?

Analysis

In the report, the authors look at other hypotheses as well:

Are fewer attacks being reported in public? The data suggests there might be a some this happening. Owners and operators may have become “gun-shy” about disclosing too much information and being sued if any of that information is later shown to be incorrect. Less disclosure is safer and disclosing the minimum the law requires seems to have become the norm.
Have cyber defenses become more capable? But some of the breaches still showed shockingly poor cyber hygiene. Others showed a high degree of sophistication, taking down what we would expect to be well-defended targets.

In addition, the number of zero-days exploited in the wild dropped only a little 2024-2025, and AI-automated attacks started being observed. In short, it seems likely that all of this is in play, with the result that we’ve observed.

Conclusion

None of the effects looked at in the report seem likely to hold attacks constant or declining for any material amount of time:

Law-enforcement actions have not eliminated profitable drug-running or other criminal enterprises, and seem unlikely to be able to eliminate ransomware.
Ransomware criminals have re-organized to recover from their losses, and seem poised to resume their “normal” attack patterns in 2026.
Public disclosures of “material” incidents are increasingly required in many jurisdictions, which should increase disclosure rates. Less than material incidents may no longer be disclosed. But if incidents overall increase in 2026, one would expect to see material incidents and disclosures increase as well. And – in a world interested in cyber attacks, it is increasingly difficult to hide the fact that a factory shut down and laid off the workforce due to a cyber attack.

In short, it is reasonable to believe that the cyber attacks with physical consequences will continue to rise in the years ahead. And it is worth studying the attacks and trends we observe today, because anything that has happened in the past is a credible threat in the years ahead.

Digging Deeper: The authors of the threat report discuss these and many other findings in a webinar that you can stream now.

About the author

Andrew Ginter

IT/OT Cyber Theory: Espionage vs. Sabotage

January 6, 2026

Ships Re-Routed, Ships Run Aground

January 6, 2026

New CISA, CCCS et al Alert | Advice on Pro-Russian Hacktivists Targeting

January 6, 2026

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

The post Consequential OT Breaches Dropped in 2025 – What Happened? appeared first on Waterfall Security Solutions.

How to Apply the NCSC/CISA 2026 Guidance

Waterfall team — Sun, 01 Mar 2026 14:33:08 +0000

OT Insights CenterHow to Apply the NCSC/CISA 2026 Guidance

How to Apply the NCSC/CISA 2026 Guidance

Hardware-enforced OT Security solutions help industrial operators follow the latest multi-government OT security guidance.

Waterfall team

March 1, 2026

For the first time, joint guidance from the UK NCSC, co-signed by CISA, BSI, Australia’s ACSC and others, calls for centralizing risky connections into OT networks, simplifying instructions sent into OT so they can be inspected for safety, and even “browsing down” for engineering workstation access. Alongside these newer ideas, it reinforces more established advice, such as hardening OT boundaries with hardware-enforced protections like Unidirectional Gateways and Hardware-Enforced Remote Access.

The challenge is that the guidance is fairly abstract. The principles are clear, but how to apply them in real OT architectures is not always obvious.

What are the 8 core principles of the NCSC / CISA “Secure connectivity principles for Operational Technology (OT)” guidance, and how does Waterfall support their application?

1) Balance the risks and opportunities – Waterfall’s Unidirectional Gateways dramatically reduce cyber risks to connected OT networks. One-way hardware prevents attack information from reaching back into OT networks, significantly reducing risks for even obsolete, unpatchable targets.

2) Limit the exposure of your connectivity – Waterfall’s Secure Bypass product is a time-limited switch, controlling how often and how long vulnerable software components are exposed to external networks, Waterfall’s Unidirectional Gateways are intrinsically outbound connections – no inbound threat is possible to connected devices through the gateways.

3) Centralise and standardise network connections – Waterfall’s Unidirectional Gateways scale from the smallest DIN rail form factors to 10Gbps rack-mount devices supporting dozens of simultaneous connectors & replications, making both distributed and centralized deployment straightforward.

4) Use standardised and secure protocols – Waterfall’s Unidirectional Gateways support dozens of OT protocols and applications, both plain-text and encrypted versions. Better yet, even when using plain-text communications into IT networks, no session hijack or other plain-text attack can reach through the unidirectional hardware back into the OT network to put physical operations at risk.

5) Harden your OT boundary – The guidance recommends hardware-enforced unidirectionality and integrity filtering. Waterfall’s Unidirectional Gateways enforce unidirectionality in hardware. Waterfall’s Hardware-Enforced Remote Access (HERA) uses a hardware filter to ensure only HERA protocol information can enter the OT side of the HERA device.

6) Limit the impact of compromise – Waterfall Unidirectional Gateway and FLIP products are compatible with a wide variety of anti-virus systems, patch management systems, zero trust, and other systems that provide this second level of defense in defense-in-depth programs.

7) Ensure all connectivity is logged and monitored – Waterfall for IDS is hardware-enforced protection for SPAN port and mirror ports sending data to IT-resident OT intrusion detection system (IDS) sensors. Waterfall is partnered with all the most important OT IDS vendors.

8) Establish an isolation plan – Waterfall’s Unidirectional Gateways are used by TSA-compliant sites and other sites with isolation / islanding requirements. The gateways ensure critical data continues to move, even during “isolation” emergencies where firewalls are not permitted to connect OT with IT networks, or the Internet.

Waterfall’s Unidirectional Gateway, HERA remote access and other hardware-enforced products are dramatically stronger than software and are used routinely at the sensitive IT/OT trust/consequence boundary.

Schedule a meeting with a unidirectional architect for a free consultation today.

FAQ about the NCSC / CISA “Secure Connectivity Principles for Operational Technology (OT)” guidance

What are the key recommendations from the NCSC / CISA “Secure Connectivity Principles for Operational Technology (OT)” guidance?

Webinar: 2026 OT Cyber Threat Report

Andrew Ginter — Wed, 25 Feb 2026 11:01:05 +0000

OT Insights CenterWebinar: 2026 OT Cyber Threat Report

Webinar: 2026 OT Cyber Threat Report

Watch now - on demand!

In 2025, 57 cyber attacks caused real-world damage in heavy industry, world-wide. This is a 25% drop from 2024, but that’s the tip of the iceberg

Most of this reduction is because of temporary factors affecting ransomware attacks. Nation-state and hacktivist attacks doubled, with most attacks targeting critical infrastructures.

Highlighted attacks include:

Jaguar / LandRover – the most costly production shutdown in a decade,
Colins Aerospace – a crippled software system caused flight cancellations and delays for weeks – highlighting the need for rapid recovery or manual fall-backs for critical systems operated and managed by third parties,
Grounded and mis-directed ships – again highlighted the need for multiple independent checks on important external inputs, such as GPS signals, and
Polish distributed generation – a near miss because the lights stayed on, an example of the Russian nation state targeting European critical infrastructures, and a cautionary tale about “bricking” control equipment.

Join Greg Hale of ICS Strive and Andrew Ginter of Waterfall Security as they explore what lies beneath all of 2025's OT breaches with physical consequences.

Key Takeaways:

Record-breaking costs of consequences

What is behind the drop in ransomware attacks

Key defensive developments of 2025, in light of these threats

About the Speaker

Andrew Ginter

Watch Now

The post Webinar: 2026 OT Cyber Threat Report appeared first on Waterfall Security Solutions.

2026 OT Cyber Threat Report

Waterfall team — Wed, 18 Feb 2026 17:03:48 +0000

OT Insights Center2026 OT Cyber Threat Report

2026 OT Cyber Threat Report

Ransomware is down, nation state / hacktivists are up.

Cyber breaches with physical consequences in the public record for heavy industry and critical industrial infrastructures decreased 25% to 57 in 2025 from 76 in 2024. Most of this reduction is because of temporary factors affecting ransomware attacks. Nation-state and hacktivist attacks doubled, with most attacks targeting critical infrastructures.

The report is unique in its focus, and in that the entire 2025 data set is included in the Appendix.

Highlighted attacks include:

Jaguar / LandRover – the most costly production shutdown in a decade
Colins Aerospace – a crippled software system caused flight cancellations and delays for weeks – highlighting the need for rapid recovery or manual fall-backs for critical systems operated and managed by third parties
Grounded and mis-directed ships – again highlighted the need for multiple independent checks on important external inputs, such as GPS signals, and
Polish distributed generation – a near miss because the lights stayed on, an example of the Russian nation state targeting European critical infrastructures, and a cautionary tale about “bricking” control equipment.

FAQs About the 2026 OT Cyber Threat Report

What is in the 2026 OT Cyber Threat Report?

Waterfall Security Solutions

8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors

8 (and a Half) Questions for Your OT “Secure” Remote Access Vendors

Ask different questions, get different answers: What should you be asking your OT “secure” remote access (SRA) vendor?

Waterfall team

Question 1: For SRA into OT systems, does your vendor provide IT-grade protection we HOPE can detect attacks in time, or do they provide hardware-enforced, engineering-grade protection?

Question 2: If someone phishes an SRA credential, can they exploit a vulnerability in the Multi-Factor Authentication (MFA) to get into the protected OT systems?

Question 3: Is that SRA a H2M solution, or an M2M solution?

Question 4: Can users override SRA encryption / certificate warnings?

Question 5: Can you paste or file-transfer arbitrarily complex files into OT equipment remotely?

Question 6: Is there a session timeout?

Question 7: Do you require deny-by-default on firewalls protecting OT networks?

Question 8: Does your OT SRA need a firewall?

Question 8 1/2: Does your SRA support MFA?

Digging Deeper

About the author

Waterfall team

Share

Trending posts

Stay up to date

Tags

Webinar: 13 Ways To Break “Secure” OT Remote Access Systems

Webinar: 13 Ways To Break “Secure” OT Remote Access Systems

and the questions you should be asking your OT SRA vendor...

Join us on April 23rd to understand attacks and look at questions we should be asking our OT "Secure" Remote Access vendors.

About the Speaker

Andrew Ginter

Register Now

Share

Webinar: 2026 OT Cyber Threat Report

Webinar: 2026 OT Cyber Threat Report

Watch now - on demand!​

Join Greg Hale of ICS Strive and Andrew Ginter of Waterfall Security as they explore what lies beneath all of 2025's OT breaches with physical consequences.Key Takeaways:

About the Speaker

Waterfall team

Stream it Now

Share

80K Stryker Devices Wiped Following Iran-Attributed Attack

80K Stryker Devices Wiped Following Iran-Attributed Attack

Stryker produces medical devices. An Iran-attributed attack erased 80,000 corporate and personal devices (cell phones? laptops?) as a result of an intrusion into the Microsoft cloud and an instruction from that cloud to erase / reset the devices.

Andrew Ginter

About the author

Andrew Ginter

Share

Trending posts

Stay up to date

Tags

Cyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact

Cyber-Informed Engineering Recognized with Cyber Policy Award for Research Impact

Waterfall team

What is Cyber Informed Engineering?

Waterfall and Cyber Informed Engineering

About the author

Waterfall team

Share

Trending posts

Stay up to date

Tags

Waterfall Security Solutions recognized by Gartner®

Waterfall Security Solutions recognized by Gartner®

Waterfall team

Hardware-Enforced Remote Access

Modern OT Remote Access

About the author

Waterfall team

Share

Trending posts

Stay up to date

Tags

Consequential OT Breaches Dropped in 2025 – What Happened?

Consequential OT Breaches Dropped in 2025 – What Happened?

In 2025, 57 cyber attacks caused real-world damage in heavy industry, world-wide. This is a 25% drop from 2024, and the first drop in this statistic in six years. What happened?

Andrew Ginter

The OT Data Set

The Ransomware Data

Analysis

Conclusion

About the author

Andrew Ginter

Share

Watch now - on demand!

Join Greg Hale of ICS Strive and Andrew Ginter of Waterfall Security as they explore what lies beneath all of 2025's OT breaches with physical consequences.

Key Takeaways:

Join Greg Hale of ICS Strive and Andrew Ginter of Waterfall Security as they explore what lies beneath all of 2025's OT breaches with physical consequences.

Key Takeaways: