Check out all our 2025 predictive blogs →
Before we look ahead to the coming year, I’d like to contextualize the severity of the threats facing our critical infrastructure with a snapshot of the current landscape in numbers. If we take Manufacturing as an example, the past 12 months alone has seen a 37%1 increase in ransomware attacks. In fact, Manufacturing tops the Armis Centrix™ for Actionable Threat Intelligence early warning list with 974 alerts in 2024 and counting2. Such a steep upturn in critical events has sparked conversation amongst industry leaders and significantly elevated the focus on cybersecurity strategy, provision and resilience.
The following blog explores the emerging trends in the cyber threat landscape and dives into why manufacturing, utilities, water and energy grids and other critical infrastructures are targeted more than any other sector. Perhaps most importantly, we’ll also look at how organizations can bolster defenses and take steps to enhance the resilience of their mission-critical processes.
At a glance:
- Ransomware attacks in critical infrastructure continue to trend upwards. In particular, the weaponization of IoT devices is expected to grow in 2025.
- Organizations must take strategic steps to fortify their entire network, taking into consideration all assets including OT, IT and IoT. Steps should include regular security assessments, upgrading legacy systems, implementing Zero Trust architectures, and leveraging AI for threat detection.
- The adoption of cloud-based solutions is imperative for industry leaders to ensure comprehensive security management across integrated IT and OT networks.
The Evolving Cyber Threat Landscape
We know that the attack surface in complex industrial environments is growing exponentially—IT, IoT and OT have converged to create digitalized, efficient production lines but at what cost? Perhaps it is true that cyber resilience and safety have been sacrificed for the sake of higher outputs and profit margins. That is until now. From my perspective, the tides are turning, safeguarding manufacturing and critical infrastructure from cyber threats is being taken more seriously than ever before. A combination of global socio-political instability and a boom in nation state attackers on critical infrastructure means that the time to act is now. As we look ahead to 2025, understanding the landscape impacting our essential services is more important than ever.
Targeted Ransomware in Manufacturing
Ransomware attacks are evolving beyond IT environments and are now specifically targeting OT systems, such as industrial control systems (ICS) in manufacturing plants. These attacks are aimed at halting production lines, leading to prolonged downtimes and severe financial losses. Attackers recognize the high stakes in manufacturing, where even a brief halt can result in millions of dollars in losses, making these companies more likely to pay ransom quickly.
Escalating Cyberattacks on Critical Infrastructure
Critical infrastructure sectors such as energy, water, transportation, and healthcare are becoming prime targets for cyberattacks, particularly from nation-states and advanced persistent threat (APT) groups. The goal of these attackers is often to create widespread disruptions that destabilize economies or gain political leverage. For example, cyberattacks on power grids or water treatment facilities could result in blackouts or contamination, endangering public safety.
Zero Trust Expansion in OT Systems
As OT systems become more connected and integrated with IT networks, the risk of lateral movement from IT to OT environments increases. The adoption of Zero Trust architectures in OT systems is growing as a way to mitigate these risks. Zero Trust assumes no device, user, or connection is trusted by default, requiring strict authentication and continuous monitoring at every access point. Implementing Zero Trust in OT environments can significantly reduce unauthorized access and minimize the damage caused by compromised credentials or insider threats.
Legacy OT Systems Vulnerabilities
Many manufacturing and industrial facilities continue to rely on legacy OT systems that were never designed with cybersecurity in mind. These systems often lack encryption, proper authentication mechanisms, and patch management capabilities, making them easy targets for cybercriminals. Because replacing these systems can be prohibitively expensive, organizations must find ways to secure them. This might include the use of network segmentation, mitigating controls, and the deployment of security patches whenever feasible, if even possible. Additionally, continuously and in real-time monitoring traffic patterns for unusual activity can help detect breaches in these vulnerable environments.
AI-Driven Threat Detection and Response
The increasing complexity and frequency of cyberattacks require more advanced detection and response mechanisms. AI-driven cybersecurity solutions are rapidly becoming a cornerstone in OT environments. These tools can analyze vast amounts of data in real-time, using predictive analytics and anomaly detection to identify threats before they cause significant damage. AI can also improve efficiency and automate incident response processes, allowing systems to react faster than human operators, and even block or contain threats in real-time. This proactive approach is critical, as traditional, reactive security models struggle to keep up with evolving threats.
Supply Chain Attacks in Manufacturing
Manufacturing supply chains are highly interconnected, with multiple suppliers and third-party vendors contributing to production processes. Attackers are increasingly exploiting these relationships to launch supply chain attacks, targeting weak links to infiltrate OT systems. Once inside, they can cause production delays, manipulate product quality, or steal intellectual property. Protecting against supply chain attacks requires not only securing one’s own systems but also ensuring the security of all partners within the supply chain. This might involve conducting vendor risk assessments and implementing strong contractual requirements for cybersecurity.
Convergence of IT and OT Cybersecurity
The line between IT and OT networks is becoming increasingly blurred as organizations embrace digital transformation. This convergence creates new vulnerabilities, as a breach in IT can now have direct consequences on OT systems. To address this, organizations are moving toward unified cybersecurity platforms that offer the capability of real-time visibility and protection across both IT and OT environments.
Cyber-Physical Attack Consequences
Attacks on OT systems can result in real-world, physical damage. For example, a cyberattack on a power plant can cause electrical outages, while an attack on a transportation system can lead to accidents or delays. These attacks not only disrupt operations but also endanger public safety. As OT systems control critical physical processes, cybersecurity must be treated as a priority to prevent catastrophic outcomes.
Regulatory Compliance for OT Security
As the threat landscape for OT systems expands, regulatory bodies around the world are introducing stricter compliance requirements for OT cybersecurity. Regulations such as the NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection) for power utilities, (CER) Critical Entities Resilience Directive, or the NIS2 (Network and Information Security) Directive in the EU, mandate strong cybersecurity controls, ongoing monitoring and the disclosure of cyberattacks. Organizations must not only implement these protections but also demonstrate compliance through audits and continuous risk assessments.
Weaponization of IoT in Critical Infrastructure
The proliferation of Internet of Things (IoT) devices in critical infrastructure sectors has dramatically expanded the attack surface. These devices, often deployed without robust security measures, can serve as entry points for cybercriminals to access core OT systems. For example, compromised IoT sensors, such as smart meters in a power grid could disrupt monitoring and control functions, leading to major power outages. Securing IoT devices requires strong encryption, regular patching, and strict access controls.
Cloud Adoption for OT Security
As OT environments become more dispersed geographically, cloud-based security solutions are gaining popularity. These solutions enable centralized monitoring, management, and threat intelligence sharing across multiple sites, improving visibility and incident response times. Cloud platforms can offer scalable security services such as real-time threat detection, endpoint protection, and automated response, all of which are crucial for protecting OT environments.
Strategic Steps to Fortify Critical Infrastructure
The emerging threats and trends explored above are putting mounting pressure on organizations in OT industries. Industry leaders should consider the following strategic steps:
- Conduct Regular Security Assessments: Regular assessments can identify vulnerabilities and help prioritize remediation efforts.
- Upgrade Legacy Systems: Replace or enhance legacy OT systems lacking modern security features.
- Implement Zero Trust Architecture: Adopt a Zero Trust model to ensure comprehensive monitoring and authentication.
- Leverage AI for Threat Detection: Utilize AI-driven tools for faster and more accurate threat detection and response.
- Adopt Multi-layered Defense Strategies, including threat intelligence sharing, to protect these essential services from both nation-state actors and organized cybercriminals.
- Strengthen Supply Chain Security: Implement robust measures to secure supply chains against targeted attacks.
- Make Use of Effective Network Segmentation: In OT, mitigation is more viable than remediation. Automatically dividing up your network can help fortify and protect your essential assets.
- Enhance IoT Security Measures: Secure IoT devices with proper encryption, authentication, and network segmentation.
- Adopt Cloud-Based Solutions: Use cloud-based platforms for centralized OT security management.
Conclusion
Our dependence on OT assets and the environments they operate continues to grow year on year. Whether it’s assembling cars, keeping a nuclear reactor stable, or keeping our drinking water safe to drink, once manual processes are now completely automated. With this in mind, prioritizing the resilience of this critical infrastructure is essential. The trends outlined above underscore the need for proactive and strategic cybersecurity measures. By taking steps now, organizations can protect against increasingly sophisticated threats and ensure the continued safe operation of critical systems.
Stay informed and prepared as we advance toward 2025. For a deeper understanding of cyber threats and defense strategies, I encourage you to explore our cyberwarfare report.
1 Armis Labs, 2024
2 “ibid”
