The air gap is gone
IT and OT networks converged. Modern PLCs speak Ethernet, expose web UIs, and sit one firewall rule away from corporate email. A Siemens PLC on the plant floor can share a segment with office systems that were never designed for process safety.Asymmetric impact
Ransomware on IT means downtime and data loss. The same foothold in OT can halt production, damage equipment, or endanger people. Defenders must treat ICS exposure as a safety and national-security problem, not only an IT ticketing problem.Why reconnaissance is continuous
Opportunistic scanners and nation-state tooling both probe the public internet for Modbus (502), S7 (102), BACnet, IEC 104, EtherNet/IP, and fuel ATG endpoints. Shodan and similar engines index hundreds of thousands of reachable industrial devices. Reyhford sensors sit in that reconnaissance path — honeypots that look like real ICS endpoints so SOC teams see attacker behavior before it reaches production.Next
- Who attacks — nation-states, hacktivists, ransomware
- Real incidents — Stuxnet, Triton, Colonial Pipeline