September 2, 2026.
The NCSC (National Cyber Security Centre) has seen increased targeting of operational technology (OT) systems across multiple sectors globally, including in the UK. This has been carried out by a range of threat actors and resulted in some limited real-world disruption.
Any organisation that uses, deploys or maintains OT systems should treat this development seriously and review their security posture accordingly. Please scroll down for the latest advice.
The NCSC warns:
“Organisations should not assume that their OT is inaccessible from the internet without verifying it, as unintended exposure can arise through misconfigurations, legacy connections, or unmanaged assets.”
The Government backed organisation says it has been engaging with sectors directly in response to this recent targeting and is now sharing this advisory to support national resilience efforts.
For some time, the NCSC has been warning about a broader pattern of disruptive cyber activity carried out by state and non-state actors affecting organisations in both critical national infrastructure (CNI) and non-CNI sectors.
Against the backdrop of technology-enabled uplifts in cyber capability and increased geopolitical instability, the NCSC assesses that the threat from state use of offensive cyber, including outside of conflict, has almost certainly increased.
As a result of this wider context, it is essential that all organisations take action now given the developing threat picture.
In response to the observed disruptive activity, organisations should take the following actions:
Build a definitive view of your OT architecture, including all assets, communications pathways and external connections. This will help identify internet-exposed systems, unmanaged assets and legacy connectivity that may introduce risk. Ensure OT devices, such as Programmable Logic Controllers (PLCs) and Human Machine Interfaces (HMIs), are not directly exposed to the public internet.
Change default credentials and prevent the use of shared passwords on web interfaces, management interfaces, and management protocols. Use unique accounts for administrators, enable multi-factor authentication (MFA) wherever supported, and use stronger authentication mechanisms such as public/private key authentication if supported by protocols (eg SSH) instead of passwords where possible.
Harden your OT boundary. Strictly control access to OT from external or untrusted networks. Ensure devices (such as industrial gateways, firewalls, routers and remote access appliances) that facilitate external connectivity are within vendor support, routinely updated by default, replaced before they reach their end-of-life (EOL), and that the management of these devices is only possible from a segregated management network that is not connected to the internet.
Adopt secure versions of industrial and management protocols where possible. For industrial protocols this might mean migrating DNP3 to DNP3-SAv5, CIP to CIP Security, Modbus to Modbus Security, OPC DA to OPC UA. In management this includes but is not limited to removing the use of, telnet, SNMP v1, SNMP v2. Limit use of insecure protocols (where there is no secure alternative) to isolated network segments.
Log and monitor all connectivity to and within OT networks, with particular focus on detecting attempts to communicate with OT assets such as PLCs and HMIs from unexpected devices, networks, or routes. As OT environments are typically static and predictable, baseline monitoring can be highly effective at identifying unauthorised activity, misconfigurations, or potential cyber compromise.
Ensure OT devices are operating in a way that prevents remote programming during normal operations.
Segment management networks, OT control systems, and business IT networks to reduce the impact of a cyber incident. Separate systems based on their function and criticality and restrict communications between network zones to only those required for operational purposes. This helps prevent unauthorised access, limits opportunities for an attacker to move between systems, and reduces the likelihood that a compromise in one area will affect the wider environment.
Maintain tested backups of OT systems, configurations, controller logic, and critical engineering data, and regularly practise restoration and recovery procedures. Ensure you can quickly isolate affected systems from the wider network and restore essential operations from trusted backups to minimise downtime and support safe recovery from cyber incidents. Backups should be designed to be ransomware-resistant.
This NCSC update offers a wealth of great advice.
To discuss your cyber security needs, contact UK Business IT via this website.
