The days of relegating cybersecurity to an IT problem are behind us. Cybersecurity practitioners agree that the risk is a pressing operational problem that demands immediate attention and budget.
Here’s what industrial leaders need to know with insights from ABS Consulting, a safety, risk and compliance management firm with frontline expertise managing some of the nation’s most critical cyber programs.
How should business leaders think about today’s evolving cyber risk?
Across multiple industry sectors, “cyber risk is a critical business risk,” says Michael DeVolld, senior director of maritime cybersecurity for ABS Consulting. DeVolld is a retired U.S. Coast Guard (USCG) Officer who has conducted numerous safety and compliance inspections, investigated high-profile marine casualties and established a cybersecurity program at USCG Cyber Command. “An incident will impact everyone,” he stresses.
Marco Ayala, technical director at ABS Consulting and energy market lead for the ABS Cyber Center of Excellence, echoes this outlook for the energy sector. “The digital ‘threatscape’ is evolving while operators face volatile energy prices, margin compression and supply chain disruptions, among other interconnected risks.
According to Dragos’ 2026 OT Cybersecurity Year in Review, ransomware attacks targeting the industrial sector surged 49% year-over-year in 2025, impacting 3,300 organizations globally. “Industrial organizations significantly underestimate the reach of ransomware into OT environments because they think it’s ‘just IT,’” Dragos CEO Robert Lee said in the report.
When it comes to protecting operations, the question is never whether a cyber incident would affect a company’s bottom line. It’s how much and for how long. Cybersecurity advisors note that companies can enhance corporate value through improved performance by understanding their unique operational risks and managing these proactively.
What makes operational technology (OT) environments particularly vulnerable right now?
The convergence of IT and OT systems has changed the risk profile for industrial operators. “With more IT and OT systems converging across industrial operations, the entire energy value chain is at risk,” Ayala explains. “Systems have become even more complex, and complexity breeds vulnerabilities from both the technical and human sides.”
Over the past four decades of digitizing equipment, traditional industries have brought in emerging technologies that weren’t always fully vetted.
Blake Benson, vice president and cybersecurity practice lead at ABS Consulting and the ABS Cyber Center of Excellence, points to a related, compounding challenge: “Industry stakeholders responsible for operating facilities and processes in critical infrastructure environments, such as energy and transportation, are increasingly grappling with the challenges of technology debt. Technology debt refers to the accumulation of systems, software and hardware that hinder operational efficiency, security and scalability.”
In other words, older systems sitting alongside newer ones create blind spots that cyber attackers can exploit.
When an industrial operation is compromised by a cyberattack, how far does the damage extend?
Well beyond the control room, according to OT cyber practitioners. “Cybersecurity failures extend throughout the supply chain,” Ayala says. “A successful cyberattack can disrupt global trade flows, delay cargo deliveries and damage relationships with customers and partners.” In industries where reputation and reliability define competitive standing, the commercial fallout can outlast the operational disruption.
Quiz