Bitsight: ICS/OT exposure has plateaued, but risk is increasing

Researchers note that many industrial systems are reachable via IP addresses belonging to internet service providers (fixed, mobile, or satellite), not to specific organizations operating the devices. As a result, even when a vulnerable system is identified, it is often difficult to determine the actual owner and notify them of the risk. Unlike traditional IT systems, compromising ICS/OT environments can directly affect physical processes — such as power supply, building automation, and industrial production. Moreover, misconfigurations and identical deployment patterns often scale across multiple sites, turning single vulnerabilities into systemic risks that can impact entire sectors and regions at once. Mitigating this risk requires reducing ICS/OT exposure and improving asset visibility.