Cloud and OT attack trends in 2025: what should teams change?

TL;DR: 2025 attacks became more globally distributed, more cloud-enabled, and more focused on vulnerable web apps, OT protocols, and AI tools, according to Forescout Research – Vedere Labs, with the top 10 countries accounting for 61% of malicious traffic and OT protocol attacks rising 84%. The data points to attack-surface visibility, exposure control, and segmentation as the practical controls that matter most.

Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “2025 Threat Report: Exploitation Grows Across IT, IoT, and OT”.

By the numbers:

• The top 10 countries accounted for 61% of malicious traffic observed, down nearly 20 percentage points from 2024.
• Attackers using OT protocols surged by 84%, with Modbus leading at 57%.
• Web applications remained the most attacked service type at 61%, up from 41% in 2024.

Key questions

Q: What breaks when OT and IoT assets are exposed without segmentation?

A: When OT and IoT assets are reachable without segmentation, attackers can move from one exposed system into other operational assets that were never meant to share trust.

Q: Why does advisory-driven patching miss so much active risk?

A: Advisory-driven patching misses risk because attackers exploit whatever is reachable, not only what appears on a curated prioritisation list.

Q: How should security teams reduce exposure on administrative interfaces?

A: Security teams should require authentication on every administrative interface, then restrict access through IP-based access control lists or a VPN-protected management VLAN.

Practitioner guidance

• Map exposed assets before you harden them Build a live inventory of network perimeter assets, OT devices, IoT endpoints, and management interfaces, then classify what is internet-facing, internally reachable, or isolated.
• Lock down administrative interfaces and engineering ports Require authentication on all web UIs and engineering ports, then place them behind IP-based access control lists or a VPN-protected management VLAN.
• Segment IT, OT, and IoT communications Limit each asset class to the minimum set of authorised management and peer-to-peer connections required for operations, and review exceptions regularly.

Bottom line: Attackers are increasingly using distributed cloud infrastructure, exposed applications, and OT protocols to reach systems that were never designed for broad internet exposure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →