Topic starter
24/10/2026 8:48 pm
TL;DR: Attack activity in 2025 spread more globally, more cloud-enabled, and more toward vulnerable web apps, OT protocols, and AI tools, according to Forescout Research - Vedere Labs. Attack-surface visibility and segmentation matter because exposure now cuts across asset classes that were never meant to share trust.
Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “2025 Threat Report: Exploitation Grows Across IT, IoT, and OT”.
By the numbers:
- The top 10 countries accounted for 61% of malicious traffic observed, down nearly 20 percentage points from 2024.
- Attackers using OT protocols surged by 84%, with Modbus leading at 57%.
- Web applications remained the most attacked service type at 61%, up from 41% in 2024.
Key questions
Q: Why does advisory-driven patching miss so much active risk?
A: Advisory-driven patching misses risk because attackers exploit whatever is reachable, not only what appears on a curated prioritisation list.
Q: How should security teams reduce exposure on administrative interfaces?
A: Security teams should require authentication on every administrative interface, then restrict access through IP-based access control lists or a VPN-protected management VLAN.
Q: What breaks when OT and IoT assets are exposed without segmentation?
A: When OT and IoT assets are reachable without segmentation, attackers can move from one exposed system into other operational assets that were never meant to share trust.
Practitioner guidance
- Map exposed assets before you harden them Build a live inventory of network perimeter assets, OT devices, IoT endpoints, and management interfaces, then classify what is internet-facing, internally reachable, or isolated.
- Lock down administrative interfaces and engineering ports Require authentication on all web UIs and engineering ports, then place them behind IP-based access control lists or a VPN-protected management VLAN.
- Segment IT, OT, and IoT communications Limit each asset class to the minimum set of authorised management and peer-to-peer connections required for operations, and review exceptions regularly.
Bottom line: Attackers are increasingly using distributed cloud infrastructure, exposed applications, and OT protocols to reach systems that were never designed for broad internet exposure.
Glossary terms: Attack surface visibility, System-Level Segmentation, Management Interface Hardening, Credential Hygiene
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Attack-surface sprawl is now an identity problem as much as a network problem: once administrative interfaces, management ports, and service endpoints are exposed across IT, OT, and IoT, identity assurance becomes the control that determines whether access is legitimate. The report's mitigation list implicitly shows this by requiring authentication on management interfaces and unique credentials on assets. Practitioners should treat unmanaged reachability as a privilege issue, not just a connectivity issue.
A question worth separating out:
A: They should do both, but segmentation becomes the more urgent risk reducer when exploit creation moves faster than patch cycles. Faster patching still matters, yet it cannot eliminate exposure in time for every high-severity issue. Containment buys the time patching needs and limits the business impact when a flaw is exploited before remediation completes.
👉 Read our full editorial: 2025 attack trends show cloud and OT exposure widening
This post was modified 6 days ago by NHI Mgmt Group