What OT assessments keep finding, and what a GMP site should check first

A coating pan on a solid-dose line logs a spray rate that jumps twice overnight. No alarm, no operator action in the batch record. The batch goes on hold, a deviation is opened, and three weeks later it is closed: probable transmitter drift, sensor replaced, CAPA effective. Everyone did their job properly.

Nobody asked whether anything on the network had talked to that controller during the night. Nobody could have answered, either. There was no traffic capture, the engineering workstation kept no useful log, and the remote access gateway only recorded that a session had been opened the week before. The investigation landed on the most likely technical cause because it was the only cause the site had data for.

This is not a scare story. In its structure, it is the most common way an industrial incident starts in the field data Dragos published this year.

What the report is, and what we take from it

Dragos, a US vendor of OT security products and services, published its ninth annual OT Cybersecurity Year in Review on 17 February 2026. Most of the coverage went to threat groups and ransomware counts; how much those counts really tell you is discussed in the famous attacks are not the number.

For a plant manager, the more useful part sits further back: what Dragos’s own teams found when they were called in for incident response, architecture assessments, penetration tests and tabletop exercises. Dragos summarised those findings in the launch post, then again in a May 2026 blog built around the SANS five critical controls.

Two cautions before any number. These figures come from organisations that hired Dragos, which is not a random sample of industry. And they are Dragos’s figures, not an independent survey, so every percentage below is attributed to them. A few differ from one Dragos page to another; where that happens, we say so or take the more cautious value.

We picked five findings and read each one against the records a GMP site already keeps. Pharmaceutical plants are not worse than anyone else. The point is that most of the controls Dragos finds missing have a cousin in the quality system, and strengthening the cousin is usually easier than building something new.

1. Incidents start as process problems

According to Dragos, the largest single trigger of its 2025 incident response cases was neither malware nor ransomware (23 per cent each). It was unexplained operational issues, at 30 per cent: inconsistent values, hardware failures, anomalies the asset owner could not explain. Dragos also reports that 82 per cent of asset owners had no clear criteria for when an operational anomaly should trigger a cybersecurity investigation, and that most of the incidents it handled meant at least a week of outage.

A GMP site already owns the mechanism that should catch this. The US rule on production record review, 21 CFR 211.192, requires that “any unexplained discrepancy … shall be thoroughly investigated”, and EU GMP Annex 11 §13 asks that “all incidents, not only system failures and data errors, should be reported and assessed”. What the deviation procedure usually lacks is one line: at what point does the investigator ask the OT or security team whether the network was involved?

Goodwill will not answer that. Criteria will. A value that changes without an operator action. A controller that restarts or changes mode outside a planned intervention. A recipe parameter that no longer matches the approved version. An alarm that should have fired and did not. Each takes a line in the procedure. Watch the vocabulary too: calling something an “incident” too early has consequences of its own, see event, issue, incident, attack.

2. The network is still flat where it matters

Dragos reports poor IT/OT segmentation in 81 per cent of its services reports, the most common architectural weakness it saw, and at least one major finding on defensible architecture in 42 per cent of reports.

On a GMP site, segmentation usually exists on the drawing. The gap is between the drawing and the traffic. Annex 11 §4.3 already asks, for critical systems, for an up-to-date description of “the physical and logical arrangements, data flows and interfaces with other systems or processes … and security measures”. Kept current, that document is the beginning of a zone and conduit model in the IEC 62443-3-2 sense. Left as the validation annex written at go-live, it describes a network that has not existed for years.

The test takes an afternoon. Take the system description of the MES, the historian or the batch server, and put it next to what the firewall actually allows. Every rule with no line in the description is a finding. So is every line with no rule.

3. Remote access is how they get in

Across all its incident response cases to date, Dragos states that 73 per cent involved compromised VPN or jump-host credentials. In its 2025 services work, 49 per cent of reports carried elevated findings on remote access and 53 per cent found internet-facing systems. The weaknesses Dragos lists behind the ransomware and commodity malware cases are depressingly ordinary: shared credentials, no multi-factor authentication, passwords stored where anyone could read them, management interfaces left exposed.

Remote access is already written into GMP. Annex 11 §3.1 requires formal agreements with third parties who maintain a computerised system, names “remote access” as an example, and asks for “clear statements of the responsibilities of the third party”. Most quality agreements with machine builders and integrators say who fixes what. Very few say how the supplier connects, with which named accounts, who approves the session and what gets logged. NIST SP 800-82 Rev. 3 gives remote access its own section (§6.2.10). A design that satisfies both is described in vendor remote access without opening your cell network.

4. You cannot investigate what you did not record

Dragos writes that in 56 per cent of its network penetration tests the client could not identify adversary activity carried out with native administration tools. In tabletop exercises, 88 per cent of organisations struggled with detection, 94 per cent with containment and 82 per cent with activating their incident response plan.

Dragos’s argument about why this matters is worth keeping. OT network telemetry is transient. If nobody captured the traffic between the engineering workstation and the controller when it happened, it cannot be rebuilt later. For the deviation in our opening scene, that means the network question can only ever be answered for the next event, never for the one already on the investigator’s desk.

The GMP hook is Annex 11 §11: the periodic evaluation of a computerised system should include, where appropriate, “deviation records, incidents, problems … security and validation status”. Add one question to that review, could our own records have told us whether this system was tampered with last year?, and monitoring stops being an IT project and becomes a validation question. The technical side is covered by NIST SP 800-82 Rev. 3 under security continuous monitoring (§6.3.2).

5. The advisory is not the answer

Dragos is blunt about vulnerability advisories for industrial products. Its press release states that 25 per cent of the ICS-CERT and NVD vulnerabilities it analysed in 2025 carried an incorrect CVSS score, and that about a quarter of advisories (26 per cent) came with no patch or mitigation from the vendor. The launch post adds that Dragos had to supply alternative mitigations for 52 per cent of advisories, and that 4 per cent of the vulnerabilities were actively exploited. Under its own “Now, Next, Never” triage, only a very small share lands in “Now” (2 per cent in the press release). Most go to “Next”, handled with compensating controls or at the next maintenance window, and about a quarter to “Never”.

None of this contradicts the standards. The CVSS v4.0 specification itself asks users to enrich the base score with threat and environmental metrics for their own installation, and CISA’s catalogue of known exploited vulnerabilities exists precisely to flag the few with reliable evidence of exploitation. A base score read on its own was never meant to set the work order on a plant.

For a validated system the consequence is concrete. Most fixes will not be a patch next week. They will be a firewall rule, a disabled service, a restricted account: a compensating control, each one a change under change control, tested for effect and for non-regression. Deciding to wait for the shutdown, or not to remediate at all, is also a decision. It belongs in a record, with a name on it.

The five findings side by side

Where to start

None of this needs a new tool or a production stop.

1. Add the cyber question to the deviation procedure. Four or five trigger criteria, the name of the person to call, and an instruction to keep logs and captures before a restart, where production allows it.
2. Reopen last year’s unexplained deviations on automated equipment. For each, ask whether the site could have ruled out a network cause. The answer gives you the size of the gap.
3. Compare one critical system’s description with its firewall rules. Start with the MES or the historian; they are the systems most often bridging IT and OT.
4. List every remote access path, including the modems in machine cabinets, and match each one to a quality agreement that says how it is used.
5. Put one monitoring point where it answers a deviation question: the segment between the engineering workstations and the controllers of your most critical line.
6. Triage open advisories by consequence and exposure, not by base score, and record every “wait” as a decision.

Five common mistakes

• Closing the deviation on the likeliest technical cause because it is the only one the data can reach, and calling the investigation complete.
• Treating the validation-era network drawing as current. A diagram signed at go-live and never compared with the firewall is a historical document.
• Quality agreements that say nothing about remote access. Responsibilities are defined. The connection, the accounts and the logs are not.
• Ranking vulnerabilities by the advisory’s base score. Dragos says a quarter of those scores were wrong, and the CVSS specification never meant the base score to stand alone.
• Buying monitoring before deciding what question it must answer. A sensor nobody looks at during a deviation adds cost, not evidence.

The quality system already investigates every unexplained discrepancy. On most sites, it simply cannot yet ask the network what happened.

References

• Dragos, Launched: 9th Annual Dragos OT Cybersecurity Year in Review, blog, 17 February 2026: dragos.com (the web item this article starts from).
• Dragos, press release, 17 February 2026: dragos.com.
• Dragos, OT Cybersecurity Lessons from the Frontlines, blog, May 2026: dragos.com.
• European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (2011), §3.1, §4.3, §11, §13: health.ec.europa.eu.
• NIST, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, §6.2.10 and §6.3.2: csrc.nist.gov.