Picture this.
A loader in an autonomous mining zone jolts forward unexpectedly. A safety interlock that “never fails” fails—and two operators are in its path. Or a hospital ICU loses access to critical systems and staff scramble onto paper while ventilated patients need orders every minute. Or a water utility’s chemical dosing is silently altered, with no human noticing until it’s too late.
None of this is sci-fi. It’s today’s risk profile for any organisation running Operational Technology (OT): plants, fleets, production lines, building systems, clinical devices, power and water infrastructure. And the consequences aren’t “just” downtime or a fine—they are physical harm, environmental damage, and the kind of public trust collapse you do not recover from.
Australia’s own cyber leaders keep warning that the focus on preventing attacks that would cripple services is still “shamefully low” at board level. [LINK]
OT isn’t IT with hard hats. It’s different—and more dangerous.
- Physical outcomes: Compromised OT doesn’t leak records—it moves steel, doses chemicals, opens valves, trips breakers, changes speeds and pressures. That’s where injuries, fatalities and environmental incidents happen.
- Legacy & exposure: Many OT assets were never designed for today’s threat landscape. Years of “air-gap by folklore” have given way to IT/OT convergence, remote access, cloud analytics and vendors connecting in.
- Visibility gaps: Too many boards can’t answer, “What OT assets do we have, where are our crown-jewel processes, and what would it take to stop them safely?”
An essential service provider in the national transport sector engaged us to help assess their connected OT environment. They believed they had a clear handle on their operational environment — confidently stating they had around 14,000 connected devices across their network.
By the end of the first day of discovery, we had identified more than 55,000 devices — revealing that over 75% of their infrastructure was completely invisible to their teams.
Many of these devices were legacy systems, long embedded in critical operational processes but never designed with modern cyber threats in mind. Some were connected without formal oversight, often via vendor access or unmanaged interfaces introduced over time.
The risk wasn’t just theoretical. These unseen and unsecured assets included devices directly involved in signalling, switching, and passenger safety systems — the kinds of endpoints where a cyber incident could have immediate and physical consequences.
This example highlights the scale of the challenge: you can’t secure what you don’t know exists, and in OT environments, the consequences of that blind spot can be far more than just financial.
Australia’s own threat reporting shows critical infrastructure sectors (electricity, gas, water, waste, transport, etc.) are consistently targeted and suffer meaningful incident volumes. [LINK][LINK][LINK]
“But has it happened here?” Yes—and the near-misses are the lesson.
Ports: real-world stoppage
In November 2023 a cyber incident at a major Australian port logistics provider led to landside operations being suspended across major Australian ports—slowing supply chains and backing up tens of thousands of containers. That’s operational disruption at national scale from one incident.
Mining: active targeting
Australian mining—our largest export industry—has been repeatedly targeted. An ASX-listed mining organisation confirmed a cyberattack in 2024 (it was contained, but the sector remains in adversaries’ crosshairs). Mining’s automation and remote ops make it particularly exposed.
Healthcare: when minutes matter
While many local health breaches are “IT/data”, clinical operations are the blast radius. Look at global precedents shaping Australian risk planning: in May 2024, Ascension (140 hospitals) diverted ambulances, postponed procedures, and ran manual workarounds due to a major cyberattack—directly affecting patient care. London hospitals similarly cancelled ~1,600 operations and appointments in one week after a pathology IT provider hack. Ask yourself how your facility would cope in hour one. [LINK][LINK][LINK]
Water & utilities: the chilling “what if”
In Oldsmar, Florida (2021), an intruder remotely altered caustic soda levels in a water plant. Operators caught it before harm—but that’s the point: it only takes minutes for a cyber event to become a public health disaster. Australia’s utilities face similar targeting trends; water and electricity operators report high rates of attempted and repeated attacks. [LINK][LINK][LINK]
Sector snapshots: where attacks become injuries
Mining & Manufacturing
- Autonomous and tele-remote vehicles; robotic cells; conveyors; safety PLCs.
- Risks: manipulated safety interlocks, speed/pressure changes, misaligned motion paths, “stop” commands removed, or deceptive HMI values. Downtime is costly; unsafe motion is deadly. [LINK]
Healthcare
- Clinical apps, med devices, building systems (BMS), lab networks, and third-party diagnostics.
- Risks: delayed diagnostics, diverted ambulances, cancelled surgeries, medication errors under manual workarounds. “Paper mode” is not benign when seconds count. [LINK][LINK]
Power & Water
- SCADA/ICS controlling pumps, dosing, generation and distribution.
- Risks: incorrect chemical dosing; pump trips; power protection mis-settings. The Ukraine grid attacks proved cyber can turn the lights off—deliberately. [LINK][LINK]
Why so many organisations are still exposed
- Governance gap – OT risk is still seen as “an engineering problem”, not a board-level life-safety obligation. [LINK]
- Unknown assets – No authoritative OT asset inventory; blind to legacy gear and shadow connections.
- Flat networks – Weak segmentation between corporate IT, vendor access and crown-jewel process networks.
- Patch paralysis – Inability to patch OT in maintenance windows; lack of compensating controls.
- Supplier sprawl – Third parties with privileged access but uneven controls and monitoring.
- No detection where it matters – OT networks without 24×7 monitoring, anomaly detection or playbooks aligned to the physical process.
The plausible worst cases (that keep us up at night)
- Chemical dosing drift in a treatment plant that isn’t alarmed or is ignored—leading to community exposure.
- Autonomous equipment “nudged” just enough to bypass a safety envelope; interlocks appear healthy in the HMI while parameters are altered on the device.
- ICU/Pathology blackout where downtime and diversions compound into delayed diagnoses or missed interventions.
- National-scale knock-ons from a single OT/IT pivot that suspends logistics, halting critical spares for other sectors.
If that sounds dramatic, consider that none of the incidents cited above were “theoretical”. They happened. The only open question is whether the next one lands here and puts your people and community at risk.
What good looks like (and where to start this quarter)
1) Put OT on the board agenda—explicitly.
Adopt a clear risk statement: “Cyber compromise of OT could cause injury, environmental harm and major operational disruption.” Assign executive accountability (operations + CISO), not just IT. Back it with scenario-based risk appetite and investment. [LINK]
2) See everything you have.
Build a living OT asset inventory (make, model, firmware, location, criticality, known vulns, network path). You cannot defend what you don’t know exists.
3) Segment like lives depend on it (because they might).
Design and enforce zones & conduits between IT/OT, vendor access, safety systems and crown-jewel processes. Use allow-lists, one-way gateways where feasible, and actually test isolation.
4) Monitor the process, not just the packets.
Deploy OT-aware detection and 24×7 monitoring with playbooks that understand the physical process impact of alerts. Tie detection to safety and operations procedures—not just SOC tickets.
5) Patch when you can; compensate when you can’t.
Embed risk-based patching into maintenance windows. Where patching is impossible, use network controls, strict access, application whitelisting and hardened configurations.
6) Control third-party risk at the OT boundary.
Inventory every vendor connection. Enforce MFA, JIT/JEA access, session recording and change approval. No permanent “jump boxes” with broad reach.
7) Rehearse bad days with the right people.
Run joint IT/OT incident response exercises that include operations leaders, control engineers and safety specialists. Practise fail-safe states and manual overrides.
How Australia’s threat picture is shifting (and why urgency matters)
The ACSC’s Annual Cyber Threat Report highlights continued pressure on critical infrastructure, with utilities and transport regularly in the firing line. Water and electricity operators report high targeting and repeat attempts. Attackers increasingly blend identity compromise (e.g., AD/Entra/Okta) with lateral movement toward OT. That identity-to-OT pivot is the route to real-world harm. [LINK][LINK]
And the set-piece global events matter here: the Colonial Pipeline shutdown (IT breach → OT impact) showed that even “indirect” compromises can force operators to halt critical services for safety. The Ukraine power grid attacks proved adversaries will turn the lights off on purpose. The Oldsmar near-poisoning remains the most visceral warning to water authorities everywhere. [LINK][LINK]
A practical offer to help you move now
If you run plants, utilities, hospitals, labs, ports, logistics hubs or large campuses, you should be asking three questions this month:
- What are our crown-jewel processes and how could an attacker actually stop or subvert them?
- How quickly would we know something in OT was wrong (beyond a help-desk ticket)?
- What’s our fail-safe plan—and have we drilled it with operations and safety?
If any answer is fuzzy, we can help you get clarity—fast. Orro’s OT specialists can deliver a rapid OT risk review (governance + technical) and design a 90-day stabilisation plan that gets you from “unknown exposure” to “monitored, segmented, and rehearsed”. (Ask about our OT SOC and one-touch visibility of IT/OT/IoT for critical sites.)
Final word: It’s not fear-mongering if it’s true.
The point isn’t to panic anyone. It’s to be honest about stakes. In OT, cyber risk is life-safety risk. You don’t get credit for lucking out on a near-miss.
If you’re ready to verify your exposure and close the gaps—before an attacker (or a headline) does—let’s talk.
