OT Cybersecurity: 2026 Threat Landscape for French Industry

· 14 min read
14 min read
Eziwan Team
Eziwan Team
IoT Infrastructure

Industrial systems have become the primary target of cybercriminals. In 2025, 68% of cybersecurity incidents reported to ANSSI involved OT (Operational Technology) systems, compared to 41% in 2022. The growing interconnection between IT and OT networks, accelerated by Industry 4.0, has significantly expanded the attack surface of factories, power plants, and water systems.

This guide outlines the main OT threats identified in 2025–2026, the sectors most at risk in France, and concrete steps you can take to reduce your exposure.

Why OT Systems Have Become the Number One Target​

For decades, industrial systems were protected by the air gap: their complete physical isolation from IT networks and the Internet. This natural protection has disappeared with the digitization of industry.

The game-changing factors:

  • IT/OT Convergence: PLCs, SCADA systems, and sensors are now connected to ERP and MES systems and the cloud for remote monitoring
  • Equipment Lifespan: A programmable logic controller (PLC) has a lifespan of 15 to 25 years. PLCs installed between 2005 and 2010 often run on obsolete operating systems (Windows XP, CE) that are no longer supported
  • Protocols without native security: Modbus, DNP3, Profibus, and BACnet were designed for reliability, not security. They support neither authentication nor encryption
  • Limited resources: A PLC or RTU lacks the processing power to run antivirus software or modern cryptographic algorithms
  • Slow update cycle: Applying a patch to a controller may require a planned production shutdown—many companies delay updates for years

Consequence: OT systems are rife with unpatched vulnerabilities, insecure protocols, and increasing network exposure. For an attacker, this is an ideal target.

The Top 6 OT Threats in 2026​

1. Industrial Ransomware (ICS Ransomware)​

Ransomware remains the number one threat. But in 2025–2026, cybercriminal groups developed variants specific to industrial systems, capable of:

  • Encrypt SCADA configuration files (Wonderware, Ignition, and Siemens TIA Portal projects)
  • Modify PLC parameters to cause a physical failure in addition to encryption
  • Exploit OPC-UA and Modbus TCP interfaces to move laterally within the OT network

Active Groups in Europe: LockBit 3.0, BlackCat/ALPHV, Play, and Cl0p all targeted French industries in 2024–2025. The manufacturing sector accounts for 28% of ransomware victims in Europe.

Average impact of industrial ransomware:

  • Production downtime: 12 to 21 days
  • Total cost (ransom + recovery + lost revenue): €2.5 to 8 million for an SME
  • Ransom payment rate: 42% of industrial companies pay (vs. 30% across all sectors)

Most Common Entry Points:

  1. VPNs without MFA compromised via credential stuffing
  2. Remote access by maintenance contractors (TeamViewer, AnyDesk) using shared credentials
  3. Phishing attacks targeting engineers with access to OT systems
  4. Exploitation of vulnerabilities in HMI (Human-Machine Interface) systems exposed to the Internet

2. Attacks on Programmable Logic Controllers (PLCs) and Remote Terminal Units (RTUs)​

Programmable logic controllers are now being targeted directly. The most sophisticated attacks modify the program logic (firmware or ladder logic) to:

  • Cause unintended emergency shutdowns
  • Force equipment to operate outside its normal operating ranges
  • Hide actual values from operators (manipulation of monitoring data)

Recurring vulnerabilities identified by ANSSI (2024–2025):

VendorVulnerability TypeCVE
Siemens S7-1500Buffer overflow in the Modbus TCP serverCVE-2023-46156
Schneider Electric M340Lack of authentication on the FTP portCVE-2024-8935
Rockwell Automation ControlLogixRCE via EtherNet/IP without authenticationCVE-2024-6077
Mitsubishi MELSEC iQ-RDenial of service via malformed packetsCVE-2024-7419
Wago 750 SeriesDefault credentials not changedCVE-2023-4156

Key preventive measure: Isolate PLCs in dedicated VLANs, prohibit direct connections from the IT network, and use industrial DMZs that comply with the Purdue architecture.

3. Attacks on Unsecured Industrial Protocols​

Modbus, DNP3, BACnet, and Profinet were designed between the 1970s and 1990s with reliability and speed in mind. None of them include native authentication. Any device on the same network can:

  • Read all registers on a Modbus controller without restriction
  • Write values to coils and registers without authentication
  • Send DNP3 commands to electrical or water distribution equipment

Typical attack: An attacker who gains access to the OT network (via a compromised VPN, an infected maintenance workstation, or a physically connected cable) can directly send Modbus commands to the controller of a pump or compressor.

Mitigation:

  • Deploy industrial gateways with application firewalls that block unauthorized Modbus write commands (whitelist source IPs and function codes)
  • Implement mutual TLS authentication for OPC-UA communications
  • Monitor Modbus communications to detect abnormal function codes (FC05/FC06/FC15/FC16 outside of maintenance windows)

4. Attacks on HMI and SCADA Interfaces​

Human-machine interfaces (HMIs) and SCADA servers are often the weak links because:

  • They run on Windows Server (2012, 2016, or even 2008) that is rarely updated
  • They are accessible from IT networks for production monitoring
  • They include web servers for remote access (often without MFA)

Common Attack Scenario:

  1. An attacker compromises an IT workstation via phishing
  2. Network scan → detects a Wonderware SCADA server on port 80
  3. Exploitation of a web vulnerability or default credentials
  4. Access to production monitoring → modification of alarm thresholds to mask an anomaly
  5. Deployment of ransomware from the SCADA system to the rest of the OT network

Fact Check 2025: The Shodan platform lists more than 15,000 industrial HMIs accessible directly from the Internet in France, including approximately 3,400 that do not have authentication configured.

5. Attacks on the Supply Chain (OT Supply Chain)​

The OT supply chain threat is growing rapidly. It involves compromising equipment, software, or a service provider before it reaches the end victim.

Identified vectors:

  • Malicious firmware in imported industrial routers or IoT gateways (mostly from Asia) that contain backdoors
  • Compromised software updates for SCADA software or industrial protocol libraries
  • Maintenance contractors who access the OT network using their own devices (USB drives, laptops) from other infected client sites
  • Integration of third-party components into PLCs (communication cards, industrial modules) with unverified firmware

Directly Related NIS2 Requirements: Article 21 of the NIS2 Directive explicitly requires supply chain security management for essential and significant entities.

6. Internal Threats (Insiders)​

Internal threats are often underestimated in the industry. They include:

  • Dissatisfied employees with access to control systems
  • Contractors with permanent remote access that is not revoked after their assignment ends
  • Intentional sabotage of critical systems (documented cases in the water and energy sectors)

2024 Statistics (Verizon DBIR Report): 18% of OT incidents involve an insider or a compromised trusted third party.

Key Measure: Zero Trust Access — every access attempt must be authenticated (MFA), time-limited, and audited. A third-party vendor must never have permanent, unlimited access.

Sectors Most Vulnerable in France​

1. Water and Sanitation​

The water sector is the number one target of OT attacks, according to ANSSI and Europol. The reasons:

  • Critical infrastructure with a direct impact on public health
  • Aging systems (many Sofrel RTUs from the 2000s–2010s)
  • Staff often lack cybersecurity training
  • Limited IT/OT budgets in local governments

Reference Incident: In February 2021, an attacker altered the caustic soda level at a water treatment plant in Florida via an unsecured TeamViewer connection. An alert operator detected the anomaly in time. The same type of attack is possible on any water SCADA system without rigorous access controls.

In France, NIS2 classifies water utilities serving more than 10,000 residents as critical entities, subject to enhanced cybersecurity requirements effective October 17, 2024.

2. Energy and Electric Grids​

Attacks on energy infrastructure (generation, transmission, and distribution) have tripled in Europe since 2022. Distribution system operators (DSOs), renewable energy producers, and industrial sites with electrical substations are at risk.

Targeted protocols: IEC 60870-5-101/104, IEC 61850 GOOSE, DNP3 — none of which include native authentication in their base versions.

3. Pharmaceutical and Food Industries​

These sectors combine strict regulations (FDA 21 CFR Part 11, EU GMP Annex 11) with critical OT systems. Contamination of a manufacturing process resulting from the manipulation of PLCs can have serious health consequences.

Attacks aimed at halting production (competitive sabotage) are on the rise in these high-value-added sectors.

4. Local Governments and Smart Cities​

Smart cities are deploying IoT sensors, actuators, and gateways on a massive scale, often with insufficient security budgets. Street lighting, parking management, and urban transportation systems are now all connected—and potentially vulnerable.

The 10 Priority Steps to Secure Your OT in 2026​

Level 1: Fundamentals (to be completed immediately)​

1. Inventory of All OT Assets You can’t protect what you don’t know about. Map all PLCs, SCADA systems, HMIs, gateways, and network devices, including their operating systems, firmware, protocols, and connections. Use passive discovery tools (Nozomi Networks, Claroty, Dragos) that do not disrupt the OT network.

2. IT/OT Network Segmentation Isolate your OT network from the IT network using an industrial firewall or a dedicated DMZ. The Purdue architecture (levels 0 through 5) remains the industry standard. At a minimum: prohibit any direct communication between desktop PCs and field controllers.

3. Eliminate unsecured remote access Audit all existing remote access methods (VPN, TeamViewer, AnyDesk, RDP). Disable those that are not strictly necessary. For legitimate access, implement MFA and limit access time windows.

4. Changing Default Credentials All equipment (controllers, switches, HMIs, routers) shipped with default credentials (admin/admin, root/root) must have those credentials changed upon initial deployment. Document the credentials in a password vault (Bitwarden, HashiCorp Vault).

5. Backing Up PLC Configurations Export and back up TIA Portal, Unity Pro, and Studio 5000 projects offline to a location isolated from the OT network. In the event of a ransomware attack, restoration from a clean backup must be possible within hours, not weeks.

Level 2: Strengthening (to be planned over 6–12 months)​

6. Strong Authentication for Remote Access Deploy an industrial VPN with MFA (TOTP or FIDO2) for all remote access—in-house technicians, contractors, and integrators. Each session must be recorded for auditing purposes.

7. OT Network Behavior Monitoring (NDR) Deploy a passive monitoring sensor on your OT network to detect communication anomalies: new devices, unusual Modbus function codes, communications to unknown IP addresses, and firmware changes. Nozomi Networks, Claroty, and Dragos are the market leaders.

8. OT Vulnerability Management Subscribe to your manufacturers’ security bulletins (Siemens ProductCERT, Schneider Electric PSIRT, Rockwell Automation Security Advisories). Assess critical CVEs (CVSS ≥ 7.0) and schedule patches during upcoming maintenance windows.

9. OT Incident Response Plan Document the specific OT response process: who to contact (ANSSI if the entity is NIS2-compliant), how to isolate a compromised segment without halting production, and procedures for restoring systems from backups. Test the plan once a year through a simulation.

10. Team Training (OT Security Awareness) Automation engineers generally have not received cybersecurity training. Sessions lasting 2–4 hours on OT-specific threats, phishing, USB drive management, and secure remote access significantly reduce internal risk.

How Eziwan Meets OT Security Requirements​

The Eziwan gateway and platform were designed from the outset with OT security as a critical non-functional requirement.

Zero Trust Architecture:

  • All gateway → cloud communications are encrypted using TLS 1.3 with mutual authentication via X.509 certificates
  • Each gateway has a unique, non-modifiable identifier pre-programmed at the factory (Device Identity)
  • No incoming ports are open on the gateway: connections are initiated exclusively from the OT to the cloud (push model)

Granular remote access control:

  • OpenVPN/IPSec VPN with mandatory MFA for all remote access
  • Time-limited sessions (configurable automatic expiration: 1 hour, 4 hours, 24 hours)
  • Comprehensive audit log: who logged in, from which IP address, for how long, and what actions were performed
  • Vendor access: restricted by source IP address, target device, and time window

Integrated OT Monitoring:

  • Anomaly detection for Modbus values (out-of-range variations, static values, communication interruptions)
  • Real-time alerts via SMS/email for any detected anomalies
  • Complete history of values for post-incident investigation

Sovereign Hosting:

  • Infrastructure hosted in France (AWS Paris eu-west-3), ISO 27001
  • Data not transferred outside the EU
  • Compliance with GDPR, NIS2, and ANSSI requirements

OT Security Checklist 2026​

Use this checklist to assess your OT cybersecurity maturity level:

Governance

  • Up-to-date OT asset mapping (complete inventory)
  • Formalized OT security policy approved by management
  • Designated OT cybersecurity manager (or specialized MSSP)
  • Classification of systems by criticality (IEC 62443 Security Levels)

Network Architecture

  • IT/OT segmentation with industrial firewall/DMZ
  • Dedicated VLANs by Purdue zone (levels 0, 1, 2, 3)
  • No OT equipment directly accessible from the Internet
  • No direct connections between IT workstations and field controllers

Access and Identities

  • Default credentials removed from all devices
  • MFA deployed for all remote access methods (VPN, RDP, web-based SCADA)
  • Limited access for contractors (duration, scope, time window)
  • Audit log of remote access archived for ≥ 1 year

Maintenance and Updates

  • Documented OT vulnerability management process
  • PLC configuration backups tested and stored off-network
  • Scheduled firmware update procedure during maintenance windows

Detection and Response

  • Monitoring of OT network behavior (OT NDR or OT SIEM)
  • Documented and tested OT incident response plan
  • ANSSI notification procedure (mandatory for NIS2 entities)
  • Identified cybersecurity emergency contacts (internal or external CERT)

FAQ — OT Cybersecurity and Industrial Threats in 2026​

Can ransomware that infects the IT network also affect OT controllers?

Yes, if the OT and IT networks are interconnected without strict segmentation. This is exactly how NotPetya (2017) and many industrial incidents since then spread. The ransomware encrypts IT servers, spreads via Active Directory and network shares, and if the OT network is on the same LAN or accessible via the same Windows domain, SCADA monitoring stations—and sometimes PLCs—are compromised.

Can Siemens or Schneider PLCs be directly infected by malware?

Industrial control systems do not “become infected” in the traditional sense (they lack a standard file system, and arbitrary code cannot be executed via typical vectors). However, they can be reprogrammed remotely if access is gained (see Stuxnet). The real risk is more often the shutdown or manipulation of PLCs by a compromised operator or through poorly secured remote access, rather than a direct infection of the firmware.

What is the requirement to report to ANSSI in the event of an OT incident under NIS2?

For entities subject to NIS2 (Essential Entities and Important Entities), the requirements are as follows: preliminary notification within 24 hours if the incident is likely to have a significant impact, an interim report within 72 hours, and a final report within one month. ANSSI can be notified using the dedicated form on its website. Failure to comply may result in fines of up to €10 million or 2% of global revenue.

Are OT network segmentation solutions very expensive for a small-to-medium-sized enterprise?

No. Basic segmentation (OT/IT VLANs on a managed switch costing €200–400, with restrictive inter-VLAN rules) is within reach of any small and medium-sized business. For a higher level of protection, compact industrial firewalls (such as the Stormshield SNi40 or Fortinet FortiGate Rugged) start at 500–800€. Segmentation offers the best cost-effectiveness in OT cybersecurity—it contains incidents before they spread.

Should unsecured protocols such as Modbus TCP be disabled on the OT network?

On the internal OT network, Modbus TCP can remain active—its lack of authentication is acceptable in a physically isolated and segmented network. The critical mistake is to expose the Modbus port (502) to the Internet or the IT network without any controls. The priority is to ensure that no OT ports are accessible from the outside, not necessarily to replace Modbus with a more secure protocol in the short term.

Conclusion​

OT cybersecurity is no longer an option for French manufacturers. The NIS2 Directive, the requirements of the IEC 62443 standard, and the reality of incidents (ransomware, attacks on water networks, sabotage of energy infrastructure) make protecting OT systems essential.

The good news: Contrary to what many business leaders believe, it’s not necessary to start from scratch to make significant progress. The five fundamental measures outlined in this guide—inventory, segmentation, removal of unsecured access, default credentials, and backups—reduce the risk of a major incident by 80%, at a reasonable cost and with manageable complexity.

Your next step: Conduct an OT audit of your infrastructure (Eziwan offers a free audit of your remote connections) and identify the three priority actions to implement within the next 30 days.

Article written by the Eziwan team. Eziwan is a provider of IIoT gateways and industrial monitoring platforms for small and medium-sized industrial companies, local governments, and French automation integrators. Learn more about our approach to OT security →

Additional Resources​