Attackers Breach IT-Based Networks Before Jumping to ICS/OT Systems

The SANS Institute’s State of ICS/OT Cybersecurity 2024 report summarizes survey findings across critical infrastructure, noting that non-ransomware incidents (74.4%) outweighed ransomware (11.7%), with 19% of respondents experiencing one or more security incidents. Common initial access vectors included external remote services and Internet-accessible devices (each 23.7%), employee workstations and removable media (each 20.3%), supply chain compromise (20.3%), and spear-phishing attachments (18.6%). While only 12% reported ransomware targeting in the past year, impacts remained severe: 38% affected IT only, 28.6% affected OT/ICS, 21% affected both, and 38.1% reported reliability and safety compromise, underscoring the need to integrate ransomware scenarios into ICS/OT incident response planning.