OT Incidents Don't Require PLC CompromiseOT Incidents Don't Require PLC Compromise

One of the most persistent misconceptions in OT security is that an attack has to reach the PLC to become an OT incident. It doesn't.

What Recent Incidents in India Actually Show

Look at what happened in India over the last few years. At Kudankulam, malware was discovered on an administrative network, raising questions about the separation between systems around a highly sensitive operational environment. In the power sector, threat activity targeted organisations involved in operating the electricity grid, including load dispatch infrastructure. And when Oil India was hit by ransomware in 2022, its IT systems were disrupted while drilling and production were reported to remain unaffected.

The interesting part isn't that these incidents were identical. They weren't. It's that they challenge a very simple definition of an OT attack: someone has taken control of the process.

Disruption Happens Earlier Than That

Operational disruption can happen much earlier than a compromised controller. If engineering workstations are unavailable, operators lose access to systems they depend on, remote support stops working, production information becomes inaccessible, or IT services that operations rely on go offline — the plant can still have a serious problem, even when the PLC continues executing its logic exactly as designed.

The Question an OT Assessment Should Actually Ask

That changes the question worth asking during an OT assessment. Not just:

"Can someone reach the PLC?"

But:

"What does the plant depend on that can be reached from somewhere else?"

That is where the real IT-OT boundary becomes much more interesting.