When the taps ran dry and signalling lights blinked out last winter, few stopped to ask why. In fact, beneath the veneer of modern convenience lies a growing menace: a cyber-attack that reaches beyond stolen data to physically disrupt our most vital services. In the UK this year, everything from water treatment works to Tube control rooms has felt the sting of digital intruders probing the delicate junction where corporate IT meets industrial OT (Operational Technology).
A rising tide of disruption
The National Cyber Security Centre (NCSC) sounded the alarm early in 2025, warning that state-aligned groups continue “enduring and significant” campaigns against critical national infrastructure. Meanwhile, incident trackers paint an alarming picture: more than a thousand sites suffered outages or impairment in 2024, over a third more than the year before, many driven not by hardware failure but by malware-driven mischief.
Consider Southern Water, whose network was infiltrated by the Black Basta ransomware gang in February. Although no toxins tainted our drinking supply, key monitoring dashboards went dark, and engineers spent days reverting to manual checks to keep reservoirs safe. Thames Water, too, found legacy control units, some installed in the 1980s, exposed via unsecured remote links, a sobering reminder that “air-gapped” systems are often more porous than their reputation suggests.
When trains stall and signals fail
Across the Thames, Transport for London (TfL) faced its own problems. In late 2024 an intruder slipped past perimeter defences and into the OT segment that controls signalling maintenance—forcing staff to implement paper-based workarounds. Commuters may not have noticed on the Oyster gates, but hidden behind the scenes, every delay chipped away at TfL’s resilience and reputation.
An insurance report from Chaucer estimated that UK utility companies alone endured 48 successful cyber-attacks in 2023, a 586% jump from 2022. Though many targeted data networks, the lure of OT gateways is growing ever stronger.
High-hazard heat
Beyond water and transport, Europe’s high-hazard manufacturers have learned this lesson the hard way. In early 2024, Germany’s VARTA Group was forced to idle five battery-cell plants when attackers jumped from IT servers into production networks, halting output for electric-vehicle and grid-storage markets. And while the infamous LockerGoga strike at Norsk Hydro dated back to 2019, its lesson remains vivid: ransomware can encrypt backup systems as easily as live controls, leaving smelters without the tools to manage molten metal safely.
These breaches share a theme: when business and control networks merge, a single phishing email or unpatched server can cascade into days-long shutdowns, financial ruin, and even risks to human safety.
From chaos to control
So how can organisations transform this high-stakes vulnerability into a manageable, continuously improving process? It starts with treating OT security not as a one-off “project” but as an evolving journey, one where visibility, benchmarking, and automated remediation become your frontline defence.
- Map the terrain. Begin with a thorough inventory of every valve, sensor, and PLC (Programmable Logic Controller) connected to your network plus every remote-access path that might sneak an attacker inside.
- Score your posture. Use appropriate frameworks coupled with the latest NCSC guidance to assess your maturity. How do you compare with peers? Which domains (incident response, training, network segmentation) need the most urgent attention?
- Automate the cure. Armed with a clear gap analysis, employ a unified platform to generate prioritised, time-bound action plans. Assign tasks, set deadlines, and monitor progress on a single dashboard, no more chasing email threads or updating spreadsheets in the dead of night.
- Close the loop. With each vulnerability highlighted and managed, your maturity score nudges upward. Schedule regular “health checks” to catch new exposures, whether from policy changes, new regulations, or fresh threat-actor tactics, before they can be exploited.
A future that flows
The stakes could not be higher. In a hyper-connected world, a blackout or water-treatment glitch triggered by cyber-attack is no longer science fiction, it’s a looming reality. But by embracing a continuous-improvement mindset, mapping and benchmarking your entire OT estate, and automating tailored fixes, organisations can turn vulnerability into advantage.
OpenPSM Cyber Resilience helps identify OT vulnerabilities, strengthen cyber resilience, plot maturity and meet COMAH and NIS obligations – all through a repeatable, structured, software-driven process.
Interested? Get in touch today.