Most operational technology (OT) compromises do not need exotic malware: they use an internet-exposed controller, a forgotten remote access account or a default password. Industrial control systems run for decades and trust any host that can reach them, so small gaps carry physical consequences: loss of view, control or safety. This list ranks ten OT risks by our judgement of likelihood and impact, with why each matters, an incident where one fits, and the first fix. It is for OT security leads, control engineers and SOC teams. For the full picture, see the OT Security Guide.
The Top 10 at a glance
- Internet-exposed PLCs, HMIs and OT devices
- Insecure remote and vendor access
- Default, shared and hardcoded credentials
- Flat IT/OT networks and OT dependence on IT
- Unpatched and unsupported legacy systems
- Weak asset visibility
- Industrial protocols without authentication
- Removable media and transient devices
- Supply chain and vendor compromise
- Poor OT incident readiness and recovery
| # | Risk | How attackers use it (ATT&CK for ICS v20) | First fix |
|---|---|---|---|
| 1 | Internet-exposed devices | Log straight in to exposed controllers (T0883) | Remove internet exposure; inventory public-facing assets |
| 2 | Insecure remote access | Reuse valid accounts on VPNs and remote tools (T0822, T0859) | Brokered access with phishing-resistant MFA; disable dormant accounts |
| 3 | Default and shared credentials | Default or hardcoded passwords (T1694.001, T1694.002), then lock out operators (T0892) | Change every default; named accounts where devices allow |
| 4 | Flat IT/OT networks | Move from IT into OT over remote services (T0886, T0867) | Industrial DMZ; no direct IT to OT flows |
| 5 | Unpatched legacy systems | Exploit public-facing or remote services (T0819, T0866) | KEV-driven prioritisation; compensating controls |
| 6 | Weak asset visibility | Operate on devices nobody knows exist | Passive inventory with owner and criticality |
| 7 | Protocols without authentication | Send command messages and program downloads (T1692.001, T0843) | Allowlist writers; monitor writes and mode changes |
| 8 | Removable media and transient devices | Carry malware across the air gap (T0847, T0864) | Media scanning kiosks; device control; AutoRun off |
| 9 | Supply chain and vendor compromise | Trojanised vendor software and firmware (T0862, T1693) | Verify signatures and hashes; vendor security requirements |
| 10 | Poor incident readiness | Turn an intrusion into loss of control or view (T0827, T0829) | Offline logic backups; exercised manual operation |
1. Internet-exposed PLCs, HMIs and OT devices
The risk: controllers, HMIs and cellular gateways are reachable from the internet, often for convenient remote monitoring (ATT&CK T0883 Internet Accessible Device).
Why it matters: CISA, the FBI, EPA and DOE note OT devices are "quickly found by searching for open ports on public IP ranges". In CISA advisory AA23-335A, IRGC-affiliated CyberAv3ngers actors compromised at least 75 Unitronics PLCs and HMIs, including at least 34 in the US water sector, by logging in with default or no passwords on the default TCP port 20256. ATT&CK records the same pattern in the 2026 U.S. Water Utilities Attacks (C0066), where adversaries logged directly into internet-exposed PLCs.
The fix: disconnect controllers from the public internet, put any required access behind a broker or VPN, and inventory internet-accessible devices regularly. See the Attack Surface Management Guide.
2. Insecure remote and vendor access
The risk: VPNs with passwords only, always-on vendor support tools, remote desktop to jump hosts with shared logins, and accounts nobody disabled (T0822 External Remote Services, T0886 Remote Services, T0859 Valid Accounts).
Why it matters: remote access is the most direct path into the plant. In the Colonial Pipeline ransomware attack, a legacy VPN profile without MFA that had never been disabled let DarkSide in, and the company shut its pipeline for six days.
The fix: one brokered path through the industrial DMZ, named accounts, phishing-resistant MFA, approval windows, per-asset least privilege and recorded sessions. CISA also says to "disable dormant accounts". See the Remote Access Identity Guide and the Third-Party Access Guide.
3. Default, shared and hardcoded credentials
The risk: PLCs and HMIs keep factory passwords or none, operators share one HMI login per shift, and firmware contains hardcoded credentials (T1694 Insecure Credentials: T1694.001 Default Credentials, T1694.002 Hardcoded Credentials).
Why it matters: shared and default credentials remove attribution and make every exposed device a login away from compromise. Once in, attackers can change the device password and lock operators out (T0892 Change Credential), as in the 2026 water utility attacks.
The fix: "Replace all default passwords on PLCs and HMIs with a strong password" (AA23-335A), move to named accounts and role-based access where devices support them, vault and rotate the rest, and log failed logins. When buying, follow Secure by Demand and "Seek out manufacturers that have eliminated the use of shared role-based passwords in their products." See the OT and ICS Identity and Access Guide.
4. Flat IT/OT networks and OT dependence on IT
The risk: no industrial DMZ, dual-homed historians and engineering workstations, an OT domain that trusts the IT domain, and plant systems that cannot run without IT services (T0886 Remote Services, T0867 Lateral Tool Transfer).
Why it matters: an IT compromise becomes a plant problem. The joint Principles of operational technology cyber security state that "Critical OT systems should not be reliant on IT systems to operate." In the Jaguar Land Rover cyberattack, the company proactively shut down systems and production stopped from 1 September 2025 until a phased restart on 8 October; the entry vector has not been disclosed.
The fix: IEC 62443 zones and conduits, a Level 3.5 DMZ where every IT to OT session terminates, a separate OT identity domain, and a tested plan for running isolated from IT. See the Network Segmentation Guide.
5. Unpatched and unsupported legacy systems
The risk: HMIs and engineering workstations on unsupported Windows, controller firmware years behind, and remote access appliances patched late (T0819 Exploit Public-Facing Application, T0866 Exploitation of Remote Services).
Why it matters: OT patches need vendor qualification and an outage, so known flaws stay open for months.
The fix: prioritise by CISA's KEV catalogue and exposure: internet- and DMZ-facing devices and remote access appliances first. Where a patch must wait, record a compensating control (tighter conduit rule, disabled service, application allowlisting, targeted monitoring) with an owner and review date. See the Patch Management Guide.
6. Weak asset visibility
The risk: no current list of controllers, firmware, protocols, accounts and connections, so exposure and rogue devices go unseen.
Why it matters: every other fix on this list depends on knowing what exists. CISA's 2025 joint OT asset inventory guidance lists high-priority attributes including communication protocols, asset criticality, logging and user accounts.
The fix: build the inventory passively from network traffic, add vendor-approved active queries in maintenance windows only, and record owner, zone and criticality. Never point IT scanners at Level 1 devices without engineering approval.
7. Industrial protocols without authentication
The risk: Modbus TCP (502), DNP3 (20000), IEC 60870-5-104 (2404), S7comm (102) and EtherNet/IP (44818) commonly accept commands from any host that can reach the device (T1692.001 Unauthorized Message: Command Message, T0843 Program Download, T0830 Adversary-in-the-Middle).
Why it matters: network access equals control: an attacker on the right segment can write setpoints or download logic.
The fix: allowlist which hosts may write to or program each controller, alert on writes and program transfers, keep key switches in run, and adopt authenticated variants (DNP3 Secure Authentication, CIP Security, OPC UA with Sign or SignAndEncrypt) on replacement. Their keys are machine identities to manage. See the Network Ports and Protocols Security Guide and the Device and IoT Identity Guide.
8. Removable media and transient devices
The risk: USB drives, contractor laptops and engineering tools move between networks and into control zones (T0847 Replication Through Removable Media, T0864 Transient Cyber Asset).
Why it matters: they bridge air gaps. ATT&CK records that Stuxnet spread through removable drives and that Conficker was suspected of arriving on a USB drive at a German nuclear plant.
The fix: disable AutoRun (ATT&CK M0942), limit USB hardware on critical assets (M0934), scan media at a kiosk before entry, and issue dedicated, managed engineering laptops instead of allowing contractor devices.
9. Supply chain and vendor compromise
The risk: trojanised vendor software, tampered firmware and integrator access with broad, long-lived rights (T0862 Supply Chain Compromise, T1693 Modify Firmware).
Why it matters: ATT&CK records Dragonfly trojanising ICS vendors' software on their own download sites. The OT principles warn: "Vendors can increase risk to OT systems."
The fix: verify firmware and software against vendor signatures or known-good hashes (M0945 Code Signing, M0947 Audit), require ISA/IEC 62443-4-1 and 62443-2-4 practices from suppliers and integrators, ask for SBOMs as Secure by Demand recommends, and time-box vendor accounts. See the Firmware and Boot Security Guide.
10. Poor OT incident readiness and recovery
The risk: IT incident plans that ignore the plant, no offline copies of controller logic, and no recent practice of manual operation (impact techniques T0827 Loss of Control, T0829 Loss of View, T0880 Loss of Safety).
Why it matters: without them, the only safe response to an intrusion is a long shutdown. CISA calls the ability to revert to manual control "vital in the immediate aftermath of an incident".
The fix: an OT-specific response plan with operations, defined authority to isolate or shut down, offline tested backups of PLC logic, firmware and HMI images, spare hardware as AA23-335A advises, and regular exercises including manual running. See the Incident Response Guide and the Backup Security and Immutable Backup Guide.
Mapping to OWASP
OWASP has no ICS or OT Top 10, so the honest answer is that OT risks map to OWASP weakly. The closest list is the OWASP IoT Top 10 2018, which covers individual devices rather than industrial processes. MITRE ATT&CK for ICS and the seven ISA/IEC 62443 foundational requirements (FR) are the useful maps, and we lead with them.
| Risk | ATT&CK for ICS v20 | ISA/IEC 62443 FR | OWASP IoT Top 10 2018 |
|---|---|---|---|
| 1. Internet-exposed devices | T0883 | FR 5 Restricted data flow | I2 Insecure Network Services, I9 Insecure Default Settings |
| 2. Remote and vendor access | T0822, T0886, T0859 | FR 1 Identification and authentication control, FR 2 Use control | I3 Insecure Ecosystem Interfaces (weak fit) |
| 3. Default and shared credentials | T1694.001, T1694.002, T0892 | FR 1, FR 2 | I1 Weak, Guessable, or Hardcoded Passwords |
| 4. Flat IT/OT networks | T0886, T0867 | FR 5 | None |
| 5. Unpatched legacy systems | T0819, T0866 | FR 3 System integrity, FR 7 Resource availability | I4 Lack of Secure Update Mechanism, I5 Use of Insecure or Outdated Components |
| 6. Weak asset visibility | No single technique | No direct FR; 62443-2-1 programme and 3-2 zone assessment | I8 Lack of Device Management |
| 7. Protocols without authentication | T1692.001, T0843, T0830 | FR 1, FR 3, FR 4 Data confidentiality | I7 Insecure Data Transfer and Storage (weak fit) |
| 8. Removable media | T0847, T0864 | FR 2, FR 3 | I10 Lack of Physical Hardening (weak fit) |
| 9. Supply chain | T0862, T1693 | FR 3 | I5 Use of Insecure or Outdated Components (weak fit) |
| 10. Incident readiness | T0827, T0829, T0880 | FR 6 Timely response to events, FR 7 | None |
ATT&CK v20 renumbered several ICS techniques: default credentials now sit under T1694 Insecure Credentials (formerly T0812), unauthorised command messages under T1692.001 (formerly T0855) and firmware changes under T1693. Update detection rules that use the older IDs.
Where to start
If you can do only three things this quarter: remove every internet-exposed controller and HMI (risk 1), put all remote and vendor access through one brokered path with phishing-resistant MFA and disable dormant accounts (risk 2), and change every default password (risk 3). All three are among CISA's primary mitigations for OT. Then take offline backups of controller logic and rehearse manual operation (risk 10). Track five numbers monthly: internet-reachable OT devices (target zero), direct IT to OT flows outside the DMZ (target zero), remote sessions brokered with MFA and recording (target 100%), devices still on default credentials, and critical controllers with a tested offline logic backup.
Primary sources: CISA advisory AA23-335A, the Secure by Demand priority considerations for OT, MITRE ATT&CK for ICS techniques, the ISA/IEC 62443 series and NIST SP 800-82 Rev. 3.
Related NHI Mgmt Group resources: OT Security Guide · OT and ICS Identity and Access Guide · VPN Security Guide · Vulnerability Management Guide · Ransomware Prevention Guide