Your sector is named in a threat report: can the plant see the scenario, or is it blind?

The bulletin reaches the site on a Monday morning, forwarded by group security with one line on top: “Our sector is mentioned, please confirm we are not affected.” It describes an actor that goes after remote access gateways and then reprograms controllers. The OT lead reads it twice. The remote access appliance keeps thirty days of connection logs, nobody has ever captured traffic between the engineering workstations and the controllers, and the firewall between the plant and the office network logs denied traffic only.

So the honest answer to “are we affected?” is “we cannot tell”. The bulletin was good. The plant simply cannot see what it describes. Most industrial organisations have more threat intelligence than they can use; the bottleneck is what each site can observe. The fix is to turn every alert into a scenario, ask of each site whether it could see that scenario, and measure readiness scenario by scenario.

Collection is not the problem

Robert M. Lee, SANS Fellow and chief executive of Dragos, wrote on 26 January 2026 that organisations confuse buying intelligence with using it, and invest far less in the telemetry needed to act inside the operational technology (OT) network. He quotes the SANS survey on industrial control system (ICS) and OT security published on 14 November 2025 from 330 responses: only 14 per cent of organisations felt fully prepared for emerging threats, and only 13 per cent reported full visibility across the ICS cyber kill chain.

Dragos’s blog launching the 2026 OT Cybersecurity Year in Review on 17 February 2026 states that only 46 per cent of its assessments found adequate OT network monitoring, and that network telemetry is transient: if nobody recorded the conversation between a workstation and a controller when it happened, it is gone. The press release of the same day gives the cost. In Lee’s words, organisations with comprehensive OT visibility contained OT ransomware in an average of 5 days, against an industry-wide average of 42.

The article on what attack counts really say puts those two numbers next to the incidents that never make the headlines.

Three kinds of alert, three different questions

A plant receives three kinds of threat news. Treating them alike is how a site ends up ignoring everything, or reacting to everything.

Geopolitical escalation. Michael Hoffman, a SANS instructor, wrote on 11 June 2026 that no publicly disclosed operation linked to the Middle East escalation had then reached Stage 2 of the ICS cyber kill chain, the stage where an attack on the industrial process is developed and delivered (the model comes from a SANS paper by Michael Assante and Robert M. Lee, October 2015). In his reading, escalation brings reconnaissance and footholds in enterprise networks first. The question for a site is whether it would notice them.

Hacktivist claims. They arrive loudly and often overstate what happened. The ENISA Threat Landscape 2025, covering 1 July 2024 to 30 June 2025, found that hacktivist activity made up almost 80 per cent of recorded incidents, mostly low-level denial-of-service attacks on websites with very low overall impact. ENISA also names CyberAv3ngers, linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), as a state-aligned operator behind a hacktivist persona.

That group shows both sides of a claim. Joint advisory AA23-335A, updated by CISA, the FBI and partner agencies in December 2024, confirms that from November 2023 it compromised at least 75 internet-exposed Unitronics programmable logic controllers (PLCs) and their human-machine interfaces (HMIs), through default or absent passwords. The same advisory notes that several of its claimed compromises in Israel were false.

On 2 March 2026 the Jordan News Agency reported that the country’s National Cybersecurity Center had thwarted an attempt on the management system of its grain silos, aimed at changing wheat storage temperatures, with no impact on that system. Hoffman reports that a hacktivist persona had claimed the controls were manipulated. The official statement is the one to work from.

A capability, not a campaign. Joint advisory AA22-103A of 13 April 2022 described custom tools able to scan for, compromise and control Schneider Electric and Omron controllers and OPC Unified Architecture (OPC UA) servers once inside the OT network, a toolkit Dragos named PIPEDREAM. Lee uses it as a benchmark: a site that could not detect or contain something like it has a programme not grounded in reality. The advisory on Siemens S7 controllers under active exploitation is the same kind of signal for one controller family.

Score each site: viable or blind

Lee’s method is to anchor intelligence to the SANS Five ICS Cybersecurity Critical Controls. Real threat scenarios are mapped to the controls needed to withstand them, and each site is assessed against those controls. The output he describes is a coverage view that shows which sites are viable and which are effectively blind. The article on the five controls explains why the scenarios come first and drive the other four.

In practice, three questions per scenario and per site do most of the work. Would the site have the data an investigator needs? Is there visibility where this adversary operates, which for the scenarios above is mostly inside the control network rather than at its edge? Would the site notice early enough to respond safely, while the batch can still be protected?

Scoring is per site because no two plants are alike. In the multi-site groups we work with, the newest site often has a passive monitoring sensor and brokered remote access, while the oldest runs a flat network with a modem in a machine cabinet. A group score averages the two and hides the site that would fall first. The output is a table: scenarios down the side, sites across the top, each cell viable or blind with the missing element named.

Hunt from a hypothesis

A hunt in OT starts from a scenario turned into a hypothesis that the site’s own data can confirm or refute. MITRE ATT&CK for ICS, the public knowledge base of adversary techniques against industrial systems, gives the vocabulary that advisories use. Four hypotheses cover most of the alerts a plant receives.

1. External Remote Services (T0822). Someone connected to the OT network from outside through a vendor or employee path, outside any planned intervention. Data needed: remote access gateway logs and the maintenance plan.
2. Internet Accessible Device (T0883). One of the site’s controllers, HMIs or gateways answers from the internet. Data needed: an outside-in scan of the site’s own addresses, compared with the asset inventory.
3. Program Download (T0843). A controller received a program that does not match the approved version. Data needed: the approved program from change control and a fresh upload from the controller.
4. Modify Parameter (T0836). A set point or limit changed with no operator action and no change record. Data needed: the HMI or batch audit trail and the historian.

Either the hypothesis is refuted with evidence, or the data was missing. Both are findings. According to the SANS survey as Lee quotes it, only about one organisation in five performed ICS threat hunting or red and purple team exercises.

On a site under Good Manufacturing Practice (GMP), the third and fourth hunts reuse records that quality already owns. EudraLex Annex 11 clause 9 asks for audit trails of GMP-relevant changes and deletions, regularly reviewed, and clause 10 for changes made under a defined procedure. A hunt for an unapproved program is a comparison between the controller and the change record, which most sites can run on one line in a morning.

The first week of a geopolitical alert

Hoffman’s advice for these periods is heightened vigilance rather than panic, built on controls that already exist. On a production site that means five checks.

1. Verify every remote path into OT. Vendor accounts, employee virtual private network (VPN) profiles, the modem in the packaging machine, the support tool installed on an HMI. Disable what is unused, confirm multi-factor authentication where it exists, and list where it does not. What OT assessments keep finding shows how often this path is the way in.
2. Be ready to cut, without cutting yet. Confirm who may order the plant to run islanded from the business network, and what stops when it does. The decision and its owner belong in the plan described in the OT incident decisions to take before the call.
3. Check the internet-facing edge from outside. The CyberAv3ngers case started with controllers reachable from the internet. An outside-in check of the site’s own addresses takes an afternoon and settles the question for that day.
4. Read claims against official statements. A claim on a messaging channel is not an incident. Look for the government or operator statement, and for the asset family involved. Ask whether that family is on your inventory; if not, note it and move on.
5. Check the clocks. Hoffman points to sustained satellite navigation jamming reported around the Arabian Gulf, and to its effect on network time servers that take their reference from the Global Positioning System (GPS): wrong time, corrupted log timestamps, authentication problems. Find out where the plant’s time comes from and how its servers behave when the signal disappears or is spoofed.

That fifth check weighs more on a GMP site. Annex 11 clause 12.4 asks data management systems to record the identity of operators entering, changing, confirming or deleting data “including date and time”. A time server that drifts or jumps writes wrong timestamps into every audit trail that depends on it. Name the primary time source and the fallback, confirm that servers alarm on a large offset instead of following it, and record how long they hold time without a reference.

The questions leadership should ask

Tim Conway, SANS Fellow, wrote on 28 September 2026 that leaders should challenge two assumptions: that they are too small to matter, and that the worst case is an outage. His first question is about a person: can you name the one human who understands both the operational and the cyber risk of your systems, and does the board have access to them? After any major alert, a leadership team can ask its sites five more things and expect a one-page answer.

• Which scenarios can each site see? The viable or blind table, per scenario.
• Which remote paths exist, and who approved each one? A count, with owners.
• Could we tell if a controller program changed? Yes, no, or only on some lines.
• Who may cut the plant off, at night, without asking? A role, not a name on leave.
• What would close the largest blind spot, and what would it cost? One investment, argued from a scenario.

Lee makes the same point about executive reporting: readiness tied to the five controls fits in one or two slides, without alert counts or abstract risk scores.

Where to start

1. Take the last advisory that reached the site. Write down the scenario it describes in two lines, and check whether the site could have seen it. It is done when the answer is viable or blind, with the missing data named.
2. Run one hunt. Compare the programs of the controllers on one critical line with the approved versions in change control. Record the result, including “we could not upload from two of them”.
3. Put the scenario table in the next management review. Three scenarios, all sites, viable or blind. Measure progress by cells that change colour.

Five common mistakes

1. Buying another feed. The site was already unable to use the last one.
2. Reporting alert counts. They measure activity, and leadership reads them as safety.
3. Treating a hacktivist claim as an incident. Without an official statement or your own evidence, it is a lead to check.
4. Scoring the group instead of the site. The average hides the plant that would fall first.
5. Forgetting time. Logs with wrong timestamps cannot rebuild an incident or a batch history.

The useful reply to “are we affected?” is a scenario, a site and the evidence. “We cannot tell” is also an answer, and it shows where the next investment should go.

References

• Robert M. Lee, “From Intel to Action: Leveraging ICS Threat Intelligence for Industrial Defense”, SANS blog, 26 January 2026: sans.org
• Michael Hoffman, “Heightened Cyber Risk During Middle East Escalation: An ICS Perspective for Security Leaders”, SANS blog, 11 June 2026: sans.org
• Tim Conway, “The Questions Critical Infrastructure Leaders Should Be Asking”, SANS blog, 28 September 2026: sans.org
• Dragos, press release on the 2026 OT Cybersecurity Year in Review, 17 February 2026: dragos.com
• CISA and partner agencies, AA23-335A, IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, updated December 2024: cisa.gov
• CISA, DOE, NSA and FBI, AA22-103A, APT Cyber Tools Targeting ICS/SCADA Devices, 13 April 2022: cisa.gov
• ENISA, Threat Landscape 2025, October 2025: enisa.europa.eu
• Jordan News Agency (Petra), “Jordan thwarts cyberattack targeting grain silos”, 2 March 2026: petra.gov.jo
• MITRE ATT&CK for ICS, technique T0822 and related techniques: attack.mitre.org
• EudraLex Volume 4, Annex 11: Computerised Systems (2011), clauses 9, 10 and 12.4: health.ec.europa.eu