News & Insights
GUIDE: OT operational resilience against AI threats
Salas O’Brien’s guide breaks down where risk quietly accumulates across a connected operational technology (OT) environment and shows how to gain visibility without disrupting production. It outlines a production-safe, phased path giving plant managers, operations leaders, and IT/OT decision-makers a framework to turn invisible risk into a ranked, defensible plan they can act on and fund.
Contributor
Dave Jennings, PE, CISA
The most expensive sentence in manufacturing
“It’s always worked.” On a plant floor, that sentence can be the sound of risk that no one has looked at in a long time.
Most plants are running the system as it was commissioned, plus a decade of small changes nobody mapped: a controller that was never patched because the line couldn’t go down, a temporary remote-access path that became permanent, a workaround an operator built to get through a bad shift, a new sensor package bolted onto a network that wasn’t designed to carry it.
Each change made sense on its own. Together, they’ve quietly rewritten what’s actually on your floor, how it’s connected, and where it’s exposed.
Why does it matter? Two things have changed the stakes:
1) OT is now a primary target, not a side door. Manufacturing has become one of the most-attacked industries, and attackers have shifted from disrupting data to disrupting physical operations.
2) AI has lowered the barrier to entry. The skill, time, and budget once required to map a target, craft a convincing intrusion, or adapt a known exploit are all dropping. It’s resulting in more capable adversaries, against targets that haven’t changed their posture in years.
This guide is about practical steps to close that gap.
How OT risk is impacting the industry
The visibility gap, in one number. Only 5% of organizations reported centralized visibility into all their OT activity — meaning the overwhelming majority are defending an environment they can’t fully see.
Manufacturing ranks among the most attacked industries. Manufacturing accounted for 27.7% of cybersecurity incidents in 2025, the fifth consecutive year it was the most-targeted industry.
Average dwell time for ransomware in OT environments is 42 days. Attackers operate undetected inside systems that control physical processes. Organizations with comprehensive OT visibility cut that to an average of five days.
More than one in five organizations (22%) experienced a cybersecurity incident in the past year. Of those incidents, 40% disrupted operations and nearly one in five took more than a month to remediate.
Why Salas O’Brien for operational technology (OT) resilience?
Knowing you have a visibility gap is the easy part. The hard part — where most efforts stall — is closing it without disrupting production, and turning what you find into a plan that engineering, maintenance, and leadership will actually back.
Salas O’Brien can help you get there.
We work where operational technology meets plant operations. Our team understands ICS, PLC, and SCADA environments, process operations, and the realities of a running plant, so we identify risks pure-IT firms miss and recommend solutions that protect uptime.
Reach out for an OT Operational Resilience Audit. We map your environment and set a defensible baseline without intrusive scanning, surface exposure across access, monitoring, detection, and recovery, and find the resilience and modernization gaps that quietly threaten uptime. The result is a clear answer to what you have, where you’re exposed, and what to do next. Ranked by operational impact.
Want to discuss your project? Reach out to [email protected].
Dave Jennings, PE, CISA
Dave Jennings is an industrial cybersecurity consultant who works closely with clients to improve and innovate their industrial controls systems (ICS). His main optimization areas of focus are: SCADA controls and visualization, ICS networking, cybersecurity, and data collection and reporting. Dave provides consulting and audits. He serves as an Associate Vice President at Salas O’Brien. Contact him at [email protected].