2025 attack trends show cloud and OT exposure widening

At a glance

What this is: Forescout Research – Vedere Labs' 2025 threat roundup says attacks spread across more geographies and infrastructure types while web apps, OT protocols, and cloud-enabled abuse remained central targets.

Why it matters: Security teams need to treat visibility, segmentation, and credential hygiene as shared controls across IT, IoT, OT, and AI-adjacent environments rather than separate programme tracks.

By the numbers:

• The top 10 countries accounted for 61% of malicious traffic observed, down nearly 20 percentage points from 2024.
• Attackers using OT protocols surged by 84%, with Modbus leading at 57%.
• Web applications remained the most attacked service type at 61%, up from 41% in 2024.
• 71% of exploited vulnerabilities were not in CISA KEV, showing that many active issues sit outside mainstream prioritisation.

Context

Attack surface expansion is now a governance problem as much as a technical one. When attackers can pivot between cloud services, exposed web applications, OT protocols, and unmanaged edge assets, the limiting factor becomes whether defenders can see, classify, and isolate those assets before exploitation.

For IAM and NHI teams, the important intersection is control of administrative access and device-to-device trust across mixed environments. If legacy systems, management interfaces, and sensitive protocols are reachable without strong authentication or network segmentation, identity controls and network controls fail together rather than independently.

Key questions

Q: What breaks when OT and IoT assets are exposed without segmentation?

A: When OT and IoT assets are reachable without segmentation, attackers can move from one exposed system into other operational assets that were never meant to share trust. The result is usually broader blast radius, weaker containment, and a much harder incident response effort because one compromised interface can expose multiple environments.

Q: Why does advisory-driven patching miss so much active risk?

A: Advisory-driven patching misses risk because attackers exploit whatever is reachable, not only what appears on a curated prioritisation list. If teams only chase listed vulnerabilities, they can miss locally exposed services, weak configurations, and unmanaged assets that are already in scope for exploitation.

Q: How should security teams reduce exposure on administrative interfaces?

A: Security teams should require authentication on every administrative interface, then restrict access through IP-based access control lists or a VPN-protected management VLAN. This reduces the chance that exposed web UIs and engineering ports become direct entry points for opportunistic exploitation.

Q: Should organisations prioritise segmentation over faster patching when discovery outpaces remediation?

A: They should do both, but segmentation becomes the more urgent risk reducer when exploit creation moves faster than patch cycles. Faster patching still matters, yet it cannot eliminate exposure in time for every high-severity issue. Containment buys the time patching needs and limits the business impact when a flaw is exploited before remediation completes.

Technical breakdown

Why cloud-enabled attack infrastructure changes defensive assumptions

Cloud services, hosting providers, and compromised internet infrastructure make attribution and blocking harder because the source of abuse no longer maps neatly to a single organisation or geography. The report shows attackers increasingly use distributed infrastructure while targeting exposed services that can be reached quickly. That pattern compresses dwell time and reduces the value of perimeter-only blocking. It also means defenders need to reason about the trust chain behind inbound traffic, not just the destination asset. Practical detection has to combine reputation, behaviour, and asset context rather than assuming that cloud-hosted traffic is inherently benign.

Practical implication: validate inbound exposure and management-plane trust continuously, not just at the network edge.

Why OT protocols and web applications stay high-value targets

OT protocols such as Modbus and BACnet are attractive because they often lack the built-in authentication and segmentation assumptions common in modern IT systems. Web applications remain high-value because they provide broad reach into business processes and often expose weak authentication, misconfiguration, or unpatched vulnerabilities. When these two layers coexist, an attacker can move from public-facing application access into operational environments that were never designed for direct internet exposure. The governance challenge is not only patching vulnerabilities but also reducing reachable attack surface and limiting which identities can speak to which services.

Practical implication: enforce protocol-level access limits and segment OT from general-purpose networks.

What rising vulnerability exploitation means for asset and credential governance

The fact that most exploited vulnerabilities were not in CISA KEV shows prioritisation lists are useful but incomplete. Attackers will exploit whichever exposure is easiest, whether or not it has been formally flagged. That makes asset inventory, credential hardening, and administrative access restrictions part of vulnerability management, not separate workstreams. For NHI governance, the same logic applies to unmanaged devices, service accounts, and embedded credentials: if the asset or credential can be used without oversight, exposure becomes exploitation. Practical resilience depends on knowing what exists, how it authenticates, and where it can communicate.

Practical implication: tie vulnerability management to inventory, credential control, and reachability analysis.

Threat narrative

Attacker objective: Attackers sought reliable access to distributed infrastructure and high-value operational or business systems, then used that foothold to expand impact across critical industries.

1. Entry occurred through exposed web applications, vulnerable OT protocols, and cloud-enabled infrastructure that attackers could reach across a wider set of countries and networks.
2. Escalation followed when compromised devices and unmanaged services gave attackers a path to broader attack surface access, including administrative interfaces and sensitive protocols.
3. Impact was broader operational and data exposure across healthcare, manufacturing, government, energy, and financial services, with attackers exploiting issues that were often outside standard prioritisation lists.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Attack-surface sprawl is now an identity problem as much as a network problem: once administrative interfaces, management ports, and service endpoints are exposed across IT, OT, and IoT, identity assurance becomes the control that determines whether access is legitimate. The report's mitigation list implicitly shows this by requiring authentication on management interfaces and unique credentials on assets. Practitioners should treat unmanaged reachability as a privilege issue, not just a connectivity issue.

Protocol visibility is the named concept this report exposes: defenders cannot govern what they cannot classify, and OT protocols such as Modbus and BACnet are only manageable when their communication patterns and allowed peers are known. That is why segmentation, ACLs, and inventory accuracy matter more than generic perimeter hardness. The practical conclusion is simple: protocol context must feed access decisions, or exposure stays invisible until exploitation.

KEV-only prioritisation creates false confidence: the report's finding that 71% of exploited vulnerabilities were not in CISA KEV shows that advisory-driven patch queues miss a large share of active risk. This is not an argument against advisories, but against treating them as the full governance model. Security teams need a risk model that combines external intelligence with local exposure, reachability, and asset criticality.

Credential hygiene is the bridge between cyber posture and identity governance: the recommendation to change default or easily guessable credentials, enforce MFA where possible, and secure administrative interfaces shows that weak authentication remains a common entry condition across infrastructure types. For identity practitioners, that means NHI and machine access controls cannot be confined to cloud workloads. They have to extend into OT, IoT, and legacy management paths where persistent credentials often survive longest.

Detection has to be end-to-end, not selective: once controls are in place, Forescout's report says threat detection and response must span every asset type. That is the right operational lesson for mixed estates where a blind spot in one environment undermines controls in another. Practitioners should assume that a single unmonitored asset class can break the rest of the programme.

What this signals

Protocol-aware segmentation should become the default control in mixed estates: the article's OT findings show that generic flat-network thinking no longer matches how attackers move. Teams should build policies around who can talk to Modbus, BACnet, web UIs, and engineering ports, then enforce those rules with network and identity controls together.

Visibility is now the prerequisite for every other decision: if teams cannot see which assets are present, what software they run, and how they communicate, risk scoring and patch planning will both be incomplete. That is especially true for operational and legacy environments where unmanaged reachability often persists longest.

Credential control remains a cross-domain control, not just an IAM task: default passwords and weak admin access are still common across exposed infrastructure. For readers running mixed environments, that means machine and human authentication hygiene must be built into OT, IoT, and perimeter hardening plans from the start.

For practitioners

• Map exposed assets before you harden them Build a live inventory of network perimeter assets, OT devices, IoT endpoints, and management interfaces, then classify what is internet-facing, internally reachable, or isolated.
• Lock down administrative interfaces and engineering ports Require authentication on all web UIs and engineering ports, then place them behind IP-based access control lists or a VPN-protected management VLAN.
• Segment IT, OT, and IoT communications Limit each asset class to the minimum set of authorised management and peer-to-peer connections required for operations, and review exceptions regularly.
• Harden credentials on exposed and legacy assets Replace default or guessable credentials, use strong unique passwords, and enforce multifactor authentication wherever a device or interface supports it.
• Extend detection across all asset types Make sure telemetry, alerting, and response coverage includes unmanaged, legacy, and operational assets, not just cloud and endpoint platforms.

Key takeaways

• Attackers are increasingly using distributed cloud infrastructure, exposed applications, and OT protocols to reach systems that were never designed for broad internet exposure.
• The report shows that 71% of exploited vulnerabilities were not in CISA KEV, which means active risk is often wider than advisory lists suggest.
• The most practical response is to combine inventory, segmentation, credential hardening, and end-to-end detection across every asset class.

Key terms

• Attack surface visibility: The degree to which an organisation can identify and understand the systems, endpoints, APIs, and data paths that are exposed to risk. In practice, it is what allows security teams to decide what to test, what to prioritise, and what to explain under scrutiny.
• System-Level Segmentation: A method of separating protection boundaries around a full business or clinical system rather than changing the underlying network architecture. It lets security teams define which components should communicate, while preserving availability and reducing the need for disruptive infrastructure reengineering.
• Management Interface Hardening: Management interface hardening is the practice of reducing exposure on administrative access paths for devices and platforms. It typically includes IP allowlisting, VPN enforcement, MFA, and strict segmentation so only trusted admins can reach control planes. The goal is to shrink the chance that exploitation of the device leads to full administrative takeover.
• Credential Hygiene: Credential hygiene is the discipline of creating, storing, using, and separating passwords and secrets in a controlled way. It includes avoiding reuse, keeping work and personal accounts separate, and making the governed path easy enough that people do not work around it.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in a way that supports mixed-environment security programmes. It helps practitioners connect identity controls to operational risk across cloud, OT, and legacy systems.