> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Why ICS/OT Is Under Threat

> IT/OT convergence removed the air gap — and made physical processes a cyber target.

Industrial control systems (ICS) and operational technology (OT) run the physical world: power grids, water plants, pipelines, factories, and building automation. For decades they were treated as safe by isolation. That assumption no longer holds.

## The air gap is gone

IT and OT networks converged. Modern PLCs speak Ethernet, expose web UIs, and sit one firewall rule away from corporate email. A Siemens PLC on the plant floor can share a segment with office systems that were never designed for process safety.

## Asymmetric impact

Ransomware on IT means downtime and data loss. The same foothold in OT can halt production, damage equipment, or endanger people. Defenders must treat ICS exposure as a **safety and national-security** problem, not only an IT ticketing problem.

## Why reconnaissance is continuous

Opportunistic scanners and nation-state tooling both probe the public internet for Modbus (502), S7 (102), BACnet, IEC 104, EtherNet/IP, and fuel ATG endpoints. Shodan and similar engines index hundreds of thousands of reachable industrial devices.

Reyhford sensors sit in that reconnaissance path — honeypots that look like real ICS endpoints so SOC teams see attacker behavior **before** it reaches production.

## Next

* [Who attacks](/threat-landscape/who-attacks) — nation-states, hacktivists, ransomware
* [Real incidents](/threat-landscape/real-incidents) — Stuxnet, Triton, Colonial Pipeline