MITRE ATT&CK for ICS points to PLC access as the last line of OT defence

In August 2026 alone, global ransomware incidents reached a record monthly high of 997 attacks, with more than 30 per cent directly targeting manufacturing and critical infrastructure sectors. When an operational technology environment is breached, the average facility outage extends to 16.2 hours, and 21 per cent of affected organisations report financial losses exceeding $100,000 per hour. Relying on passive monitoring and post-incident alerting has proven insufficient to prevent physical machinery from grinding to a halt.

Against this backdrop, the MITRE ATT&CK for Industrial Control Systems (ICS) framework has become the objective benchmark by which global security architects evaluate defensive capabilities. The v20 release catalogues real-world campaigns rather than theoretical exercises. Notable entries include the compromise of internet-exposed programmable logic controllers across more than 30 water and wastewater utilities in Minnesota using default credentials (Campaign C0066), an AI-assisted breach of Mexican government institutions, including the Monterrey municipal water utility, in which the adversary went on to discover SCADA management platforms (Campaign C0064), and IOControl, malware attributed to CyberAv3ngers that targeted IoT and OT devices including Unitronics PLCs.

The operational limits of detection along the attack chain

Adversaries rarely attempt to brute-force hardened network perimeters. Instead, they gain initial access through third-party remote access services (External Remote Services, T0822) or exposed edge devices (Internet Accessible Device, T0883), then move laterally using compromised legitimate credentials (Valid Accounts, T0859).

The ultimate objective remains consistent: reaching Level 1 operational assets. Once inside, intruders manipulate industrial protocols to change controller operating modes (Change Operating Mode, T0858), change setpoints (Modify Parameter, T0836), and suppress operational alarms (Alarm Suppression, T0878) to delay engineering intervention.

Most industrial detection tools are engineered to log these transitions and generate forensic alerts after an action has occurred. However, when an adversary transmits instructions using legitimate industrial protocols, passive telemetry cannot halt physical actuators, valves, or turbines before irreversible disruption occurs.

Verifying identity at the moment of equipment access

Neutralising threats across the MITRE ATT&CK matrix requires absolute Credential Separation between network access rights and equipment access rights. Even if an adversary navigates internal network tiers using compromised remote maintenance credentials, connecting to a PLC with engineering software or SSH must require an independent identity verification step.

Integrating unidirectional dynamic authentication codes (OTAC)—generated autonomously at the device level without reliance on network connectivity—into the access path in front of the PLC blocks unauthorised users from connecting to the equipment at all.

This can be seen on an interactive matrix based on MITRE ATT&CK for ICS v20. By selecting the Minnesota water utility attacks (C0066) and applying OTAC Trusted Access Gateway (TAG), security teams can see the attack stop at step 2, when the adversary tries to log in to the PLC with default credentials.

Delivering defensive resilience without costly operational disruption

Unplanned manufacturing downtime costs an average of $260,000 (approximately £200,000) per hour. Rip-and-replace overhauls that require taking operational lines offline are rejected by plant operations teams and present an unacceptable commercial risk.

The practical path forward involves inserting a non-intrusive authentication layer directly ahead of legacy controllers, preserving existing field wiring and operational programming. Without altering PLC source code or disrupting proprietary protocols, organisations ensure that only users whose identity has been verified with an OTAC can access Level 1 machinery.

Seeing where destructive techniques stop on the MITRE ATT&CK matrix gives CISOs defensible evidence for executive leadership and compliance auditors, and gives engineering teams grounds for reducing the risk of unplanned downtime.

Simulate real-world scenarios

Test how your endpoints hold up against recorded ICS attack campaigns.

👉 Try the Interactive Matrix