Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security

This report argues that most disruptions to operational technology originate in IT and traverse the IT–OT edge, where defenders have the best opportunity to detect and disrupt threats. Drawing on joint research by Palo Alto Networks, Siemens, and INL, it cites a 332% rise in internet-exposed OT devices (2023–2024), finds roughly 70% of OT-impacting incidents start in IT, and shows 82.8% of adversary activity occurs during long precursor phases with an average dwell time of 185 days. It recommends shifting from passive visibility to active defense with an OT SecOps/OT SOC model, coordinated IT–OT SOC convergence, and edge-focused detection and response to interrupt adversary progression before process impact.