Ransomware shifts and AI reconnaissance
Ransomware activity against industrial organizations reached 742 incidents from July through September this year, up from 657 in the second quarter. Manufacturing accounted for 72 percent of these cases, with construction seeing 142 incidents. Equipment manufacturers reported 77 incidents, food and beverage companies faced 64, and electronics firms reported 50. Consumer goods and automotive operations saw 34 and 32 incidents, respectively, while healthcare manufacturing recorded 26. Qilin drove 138 incidents, while Akira recorded 94, Play logged 64, INC Ransom recorded 51, and Safepay and Lynx each recorded 34. Emerging groups also pressure the sector, such as Sinobi, which claimed 42 victims including 23 industrial organizations, and Gentlemen, which hit 16 industrial targets. The SADM breach in Monterrey illustrates how AI tools bridge the technical gap; an adversary used Anthropic’s Claude to create "BACKUPOSINT v9.0 APEX PREDATOR", a 17,000-line Python framework that autonomously identified a vNode industrial gateway. This AI-driven reconnaissance bypassed safety controls by framing prompts as authorized testing. I find the use of AI to automate reconnaissance against critical infrastructure a significant escalation in threat sophistication. The availability of AI-assisted tools allows lower-skilled actors to assemble or modify ransomware payloads without deep technical expertise. The Poland energy sector incident from late December 2025 proves that attackers now target physical processes, hitting 30 wind and photovoltaic farms and a large combined heat and power plant.
Regulatory mandates and visibility gaps
New NERC CIP requirements change how facilities manage external connections. CIP-003-9 became effective on April 1, 2026, and forces entities to control and record vendor electronic remote access. This mandate requires that entities implement processes to determine, disable, and detect malicious communications for third-party sessions. CIP-005-7, which took effect on January 1, 2026, requires an electronic security perimeter around low-impact systems using routers or firewalls. CIP-007-7, effective April 1, 2026, requires patching all low-impact BES cyber systems within 365 days of patch release. You should know that 5,219 internet-exposed Rockwell Automation and Allen-Bradley hosts exist globally, with 74.6 percent of those in the United States. This exposure directly contradicts the goal of network segmentation. The federal order sets its floor at 69 kV, which differs from the FERC interstate transmission construct. Does the current enforcement of NERC standards actually mitigate the risk of exposed controllers?
Intelligence-driven defense strategies
I judge the efficacy of OT defense by how well tools handle the convergence of IT and OT. Most vendors focus on detection and visibility, but Dragos specializes in intelligence-driven security.
| Feature | Dragos | Claroty | Nozomi Networks |
|---|---|---|---|
| Primary Focus | Threat intelligence | CPS protection | OT/IoT visibility |
| Detection Method | Intelligence-driven | Behavioral/Signature | AI/ML analytics |
| Protocols Supported | Over 600 | Over 450 | Over 500 |
I find that while Claroty provides CPS protection with visibility into IT, OT, and IIoT, and Nozomi Networks provides AI-powered analytics for OT/IoT, Dragos provides four types of detection: threat behavior, vulnerability, misconfiguration, and operational. Dragos also utilizes proprietary intelligence-driven analytics to identify threats and provide response playbooks designed by experienced ICS security practitioners. Dragos also uses a "Now, Next, Never" prioritization framework to manage vulnerabilities. I would skip the extra cost of proprietary hardware if a software-only solution satisfies the local network requirements. I think the reliance on legacy systems makes full compliance difficult for companies managing equipment from the 1990s.
