A Pattern That Keeps Repeating
Cyberattacks against operational technology systems, the industrial devices that run pumps, valves, and production and treatment processes, keep hitting the same soft spot: internet-facing programmable logic controllers (PLCs).
Across water utilities, energy providers, and manufacturers, attackers have changed PLC passwords and network settings, locking operators out of their own equipment. In several cases, this has led to real operational disruption, including flooding and reduced water pressure at affected facilities.
Here’s the detail that should stop every OT professional in their tracks: many of the compromised systems were still using default passwords. Federal agencies have urged operators to fix exactly that for years.
These weren’t sophisticated zero-days. They were well-known, well-documented gaps that training exists to close.
The Data Confirms the Skills Gap
We work with organizations across energy, manufacturing, water, and critical infrastructure, and the same patterns show up again and again. Not because these teams are careless. Because no one ever built the muscle to catch these problems before they become incidents.
The data backs this up.
ISC2’s most recent workforce research found that 88% of organizations experienced a significant cybersecurity event tied to a skills shortage in the past 12 months.
SANS’ 2026 workforce report found that 27% of organizations experienced a breach as a direct result of workforce skills gaps.
And organizations with critical or significant skills gaps are nearly twice as likely to experience a material breach than organizations without one, according to ISC2’s Workforce Study.
None of those numbers are about missing technology. They’re about readiness.
Where Training Would Have Mattered
States are starting to respond. Maryland’s Chapter 495 of 2025 sets cybersecurity requirements for community water and sewerage systems statewide, recognizing that OT security in this sector isn’t optional anymore. But a law only closes the gap if the people running these systems have the skills to meet it.
Three failures show up again and again across these incidents, and every one of them is core curriculum in hands-on OT training.
Default credentials left unchanged. Changing default passwords on PLCs is one of the most basic steps in OT hardening. It’s also one of the first habits built in a hands-on training environment, where trainees work directly with the same class of hardware attackers exploit.
PLCs exposed directly to the internet. CISA has repeatedly urged operators to remove OT assets from direct internet exposure and route remote access through secure gateways. Recognizing which devices are exposed, and why that matters, requires the kind of network awareness that OT-specific training builds and generalized IT training doesn’t.
No fast detection of anomalous access. The organizations that catch intrusions quickly avoid the worst outcomes. The ones without OT-aware monitoring in place are the ones left flat-footed. Reading what’s abnormal inside an industrial process is a trained skill, not an instinct.
Every one of these is fixable. None of them require new technology. They require people who’ve been trained specifically on OT, not IT security applied to an OT environment and hoped for the best.
Build the OT Security Skills Your Team Needs
These incidents are a preview, not an outlier. Water, energy, and manufacturing systems remain attractive targets because many rely on older equipment, remote vendor access, and thin cybersecurity staffing, exactly the conditions hands-on OT training is built to address.
Through the Maryland Lighthouse Industries Upskilling and Reskilling Grant, eligible Maryland professionals can attend OT BoOTcamp™ at no cost.
This five-day, hands-on training experience gives IT, engineering, and operations teams the practical skills needed to understand, secure, and defend industrial control systems and critical infrastructure environments, including sectors now facing new state cybersecurity requirements.
Don’t wait for the next incident to expose a skills gap. Build your team’s OT security readiness today.
