The recent blackout that swept across Spain, Portugal, and parts of France — called by some the most significant outage in modern history — is a stark reminder of a reality too many still underestimate:
Whether or not this specific incident was cyber-induced, this is exactly how cyber-physical disruption feels at scale.
For those of us who have lived and breathed industrial operations, one thing is clear: We must rethink how we view OT cybersecurity risk.
This event brings forward three critical questions every operations leader, cybersecurity executive, and infrastructure owner must ask today:
1. Why Are Reported Successful OT Cyberattacks So Limited Compared to IT Breaches?
Because successful OT cyberattacks often don’t look like cyberattacks, at least not initially.
In IT:
- Breaches target data — easy to detect, log, monetize, and report.
In OT:
- Breaches target physical operations — Hot oil heaters, Exchangers, pumps, compressors, turbines, valves.
- Consequences manifest as degradation, disruption, or shutdowns — easily misdiagnosed as "normal equipment failures.”
Industrial systems are designed with multiple layers of protection (operational shutdowns, emergency shutdown systems, redundancy) to prioritize safety and continuity.
A cyber breach might trigger a shutdown, but the true cause, malicious activity, can easily go undetected.
Illustrative scenarios (each combines recurring control gaps seen across the sector and does not describe a single customer or site):
- Petrochemical Plant Compressor Trips: Repeated downtime over months was initially blamed on mechanical aging. Later, forensic analysis revealed malware manipulating compressor setpoints — hiding behind perceived "equipment degradation."
- Stuxnet (2010): Adjusted centrifuge speeds in Iran's nuclear program while falsely reporting normal operation, leading to equipment destruction without immediate visibility.
- Colonial Pipeline (2021): A ransomware attack on IT systems forced OT shutdowns to prevent the potential lateral movement of the attack into the OT. Poor segmentation, lack of IT/OT cooperation, ineffective detection mechanisms, and limited incident response strategies have resulted in a disruption lasting more than 6 days.
Key Insight: In OT, minor cyber breaches often hide behind operational noise. Without cyber-physical visibility, attackers operate in the shadows.
2. What Does a Real OT Cyberattack Look Like?
Forget the Hollywood scenes of instant chaos. Real OT attacks are subtle, methodical, and devastating over time:
- Slight parameter deviations.
- Delayed system responses.
- Minor alarm floods that seem random.
- Gradual degradation of system health.
Attackers aren't always aiming for instant destruction — they aim for disruption, erosion of safety margins, and operational doubt.
Illustrative scenarios (composite, not a single customer or site):
- A gas plant in the Middle East: Attackers compromised a poorly secured maintenance laptop, gradually altering pressure alarm thresholds. Systems operated dangerously outside safe margins — until significant damage occurred months later, misattributed to "normal wear and tear.”
- Triton/Trisis (2017): Attackers targeted a Saudi petrochemical plant's SIS, initially masked as a system "fault." Only after forensic review did teams uncover malware intended to disable emergency shutdown capabilities — a catastrophic risk disguised as a routine error.
- Oldsmar Water Treatment Plant (2021): Attackers remotely attempted to drastically increase sodium hydroxide levels. An immediate operator alert prevented a disaster, but the breach highlighted vulnerabilities in remote access configurations.
Key Insight: OT attacks are silent assassins. They exploit the divide between operational troubleshooting and cybersecurity forensics.
3. How Do You Distinguish Between a Successful OT Breach and a Process Malfunction?
In traditional OT environments:
- If the pump fails, replace the pump.
- If the valve sticks, repair it.
Today, that mindset is no longer enough.
We must train ourselves to ask:
- Is this failure mechanical or malicious? And get Cybersecurity embedded into the HAZOP study and the cause and Effect
- Has there been unauthorized access, logic manipulation, or system tampering?
Real-World Triage:
- Trisis Malware: An initial “system fault” in the safety controller was assumed to be a hardware failure — until a second incident triggered a forensic investigation revealing custom malware engineered to disable emergency shutdown systems.
- Toyota Motors (2022): A supplier's IT breach cascaded into operational technology (OT) environments, halting production across 14 plants. The initial diagnosis overlooked the cyber link between IT and OT.
Key Insight: Without integrated cyber-physical monitoring, threats remain buried within operational incident logs.
Why the Iberian Blackout Matters for OT Security
Whether cyber-induced or not, the Iberian blackout proves the vulnerability of critical infrastructure.
As grids modernize and IT/OT converge, the risks become increasingly intertwined.
Three Imperatives for Resilient OT Cybersecurity:
- Resilience Through Segmentation: Isolate OT networks without stifling innovation. (Legacy systems like Windows XP still exist in OT — Risk-based Planned air-gapping and strict access control are no longer optional.)
- Cross-Train Teams: Bridge the Gap Between IT Cybersecurity and OT Engineering Expertise. (Industry surveys of OT teams have repeatedly found that only a minority have meaningful network visibility.)
- Assume Compromise: Every unexplained operational anomaly must be treated as a potential cyber event until proven otherwise. (The 2022 Industroyer2 attack on Ukrainian substations showed that malicious commands can travel in the same protocols as legitimate control traffic.)
Final Thought:
The Iberian blackout is a wake-up call, regardless of its cause.
In OT cybersecurity:
- Resilience is engineered into the systems.
- Safety mechanisms buy time, not immunity.
- Silent threats persist without deliberate cyber vigilance.
In industrial environments, survival isn’t enough. Understanding the “why” behind every disruption is the only real protection.
Stay alert. Stay resilient. The next disruption will not come with a warning.