The ICS Exploit Pipeline Is Built for Destruction, Not Theft

The report shows that ICS/OT vulnerability disclosures in 2025 are heavily skewed toward enabling physical disruption (a 5:1 destruction-to-theft ratio), with most issues network-exploitable and many being access-enabling; state actors and ransomware groups are converging on the same PLCs/HMIs and using legitimate protocol commands as weapons, so confidentiality-focused risk models underprice real OT exposure and should be reweighted toward availability/integrity and physical-consequence scenarios.