Defending Against an Active Threat to Siemens S7 Series PLCs

Agency News, Industry News
The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)—hereafter referred to as the authoring agencies—are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them.
The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk—it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.
The authoring agencies urge all owners and operators of operational technology (OT) systems using Siemens S7 Series and other PLC devices to proactively check their systems:
- are properly protected with all applicable security patches and updates,
- are isolated from the Internet wherever possible,
- have strong access controls, and
- employ security tooling to monitor ICS environments for anomalous or malicious activity.
These mitigations are particularly important for owners and operators who work with third-party service providers or system integrators who may have remote access to PLCs, as the asset owners may not realize that their systems are exposed and at risk.
Technical details
Note: This advisory uses the MITRE ATT&CK® Matrix for ICS1 framework, version 19, and the MITRE ATT&CK Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FENDTM, version 1.5.0. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and MITRE D3FEND tactics, techniques, and countermeasures.
Threat actor targeting
Threat actors are actively targeting the following Siemens PLC models:
- S7-200 Series (all CPU variants)
- S7-300 Series (all CPU variants including 314, 315, 317 models)
- S7-400 Series (all CPU variants)
- S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
- S7-1500 Series (all CPU variants, including F-series safety controllers)
Threat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives. If these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.
Note: Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use AI-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation.
Threat actors are leveraging open source industrial automation libraries—specifically snap7.dll/python-snap7—combined with AI-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol.
Threat actor techniques
Threat actors are:
- Using Internet scanning services (e.g., Censys, ZoomEye) to identify Internet-exposed or insufficiently segmented Siemens S7 Series PLCs [T1596.005]
- Rapidly iterating exploit code through AI-assisted development, lowering technical barriers to ICS attacks [T1587.004, T1588.007]
- Taking advantage of insecure credentials to access exposed devices that have unconfigured (default) or minimally configured authentication [T1694]
- Deploying AI-generated Python scripts that incorporate the snap7.dll library from public repositories [T0834] to gain read/write access to the PLC and mimic legitimate tools
- Masquerading malicious scripts as legitimate monitoring tools to evade detection by security teams [T0849]
- Conducting read/write operations on data blocks, potentially for reconnaissance, capability testing, or pre-positioning for effects operations [T0893, T0821]
The authoring agencies assess this activity pattern is likely intended as persistent reconnaissance in targeted sectors and facilities to develop capabilities and prepare to cause operational effects against critical infrastructure. For capability development, actors are testing and refining their exploitation techniques against specific PLC models to improve their ability to compromise the PLCs. To prepare for operational effects, actors are leveraging read access to understand target environments, enabling preparation and positioning for future write operations to cause disruption or other operational impacts.
Potential operational impacts
The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. Additionally, Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), and could be targeted there as well. Unauthorized access to PLCs could result in:
- Disruption of critical industrial processes affecting production throughput, product quality, and public services
- Safety incidents affecting personnel through manipulation of safety interlocks, emergency shutdown systems, or process parameters
- Equipment damage and extended operational downtime from process upsets, improper sequencing, or forced equipment operation outside design parameters
- Compromise of sensitive operational data, including proprietary process recipes, control strategies, and facility configurations
- Cascading impacts across interconnected systems affecting supply chains, dependent facilities, and integrated business operations
- Regulatory compliance violations and potential liability from process safety management failures
Mitigation actions
Since threat actors are developing capabilities using AI to compromise PLCs using known vulnerabilities, misconfigurations, and other weaknesses and then may use compromised PLCs to interfere with normal operations, the authoring agencies urge organizations to implement comprehensive defense-in-depth strategies, in addition to Common Vulnerabilities and Exposures (CVE) remediation, to protect and defend their PLCs.
Detection opportunities
Organizations should implement detection strategies and hunt for anomalies that may indicate a compromise, focusing on [D3-PM]:
- Anomalous S7comm behavior: Connections from non-engineering workstations, unusual data block access patterns, or write operations outside change windows
- Reconnaissance indicators: Sequential IP scanning on port 102, repeated connection attempts with varying parameters, or enumeration of CPU properties
- Tool artifacts: Snap7.dll library usage outside approved engineering workstations, Python scripts with S7comm functionality, or unauthorized monitoring software installations
- Temporal anomalies: S7comm activity during off-hours, unexpected connection patterns consistent with automated scripting rather than human operators, or configuration changes without corresponding work orders or change tickets
- Geographic anomalies: Connections originating from unexpected countries or IP ranges not associated with vendors or integrators
Preventative hardening actions
To counter threats to PLCs, the authoring agencies recommend all PLC owners and operators follow the mitigations in joint guidance Primary Mitigations to Reduce Cyber Threats to Operational Technology.
Leave a comment

Algorithmic Amplification Is Now a Critical Infrastructure Risk

Industry News

Critical infrastructure incidents no longer unfold only across physical assets and cyber systems. They also unfold in an infospace shaped by digital platforms whose algorithms favour speed, emotional intensity, and visibility over verification. For operators, this means that rumour, distortion, and misleading narratives can become part of the incident environment before the first official statement is issued. That is no longer just a communications issue. It is a resilience issue.

The problem is not limited to deliberate disinformation campaigns by hostile actors. A significant part of the risk arises from the normal operation of large social media platforms. During an outage, transport failure, communications disruption, or industrial accident, there is almost always an early information vacuum. Official facts are incomplete, technical assessments are still underway, and restoration timelines remain uncertain. Into that gap flows the content platforms are most likely to amplify. In practice, that often means the most dramatic, emotionally charged, or speculative interpretation of events.

The consequences are operational, not merely reputational.

First, algorithmically amplified misinformation can distort public behaviour. False or exaggerated claims about the scale of an incident, the existence of secondary hazards, or the reliability of official updates can influence how people respond in real time. In an infrastructure emergency, resilience depends partly on public cooperation: passengers need clear guidance, consumers may need to reduce demand, and affected communities need to know which channels to trust. Confusion in the information environment weakens that cooperation.

Second, it can place additional strain on response systems. When misleading narratives spread quickly, emergency services, customer contact centres, and public authorities may face surges of enquiries, complaints, or panic-driven reactions that do not correspond to the technical reality of the event. This diverts attention and capacity at precisely the moment when disciplined prioritisation matters most.

Third, it can damage trust in ways that outlast the incident itself. Even where restoration is technically successful, the dominant online narrative may frame the event as evidence of incompetence, secrecy, or negligence. Once that framing becomes established, later incidents become harder to manage because the baseline level of trust has already been weakened.

For this reason, critical infrastructure operators should stop treating the infospace as a downstream issue to be handled only after the technical response is underway. In the platform age, the narrative environment develops in parallel with the operational incident, and often faster than formal communication processes can respond. The information dimension therefore needs to be built into resilience planning in advance.

Three practical steps would make a real difference.

The first is to treat narrative monitoring as part of situational awareness during significant incidents. Operators already monitor technical status, cyber indicators, and service impacts. They should also have a structured way to assess what claims are circulating online, which narratives are gaining traction, and whether those narratives are affecting behaviour. While this is established practice in advanced crisis communication teams, it remains rare in CIP incident management structures — and that gap needs to close.

The second is to invest in trusted communication channels and pre-prepared messaging frameworks before a crisis occurs. Credibility cannot be improvised in the middle of a major outage. Organisations that have already established visible, consistent, and recognisable public channels — whether through direct social media presence, relationships with local authorities, or pre-agreed communication protocols with emergency services — are in a much stronger position to reach the public quickly with accurate information when it matters. Equally important is preparing draft holding lines and narrative frameworks for the most foreseeable incident types: a grid outage, a transport disruption, a communications failure. When the information vacuum opens, the difference between responding in minutes and responding in hours is often the difference between shaping the narrative and chasing it.

The third is to update crisis training and exercises. Tabletop exercises should not simulate only the technical disruption. They should also simulate the platform dynamics surrounding it: rumour cascades, miscaptioned images, false attributions of cause, and competing unofficial narratives. That is now part of the real operating environment, and preparedness should reflect it.

Critical infrastructure protection has always required attention to the wider conditions that shape disruption. Today, one of those conditions is the infospace. Algorithmic amplification is not an abstract media issue or a secondary public relations concern. It is part of the environment in which incidents are interpreted, escalated, and managed. Resilience planning should reflect that reality.

Antonio Scala is a physicist and Research Director at CNR-ISC. His research focuses on complex networks, information dynamics, and critical infrastructure resilience.

Leave a comment

OSCE expands access to its technical guidance on the physical security of critical infrastructure

Agency News, Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
The OSCE Centre in Ashgabat and the OSCE Transnational Threats Department launched the Turkmen version of their Technical Guide on Physical Security Considerations for Protecting Critical Infrastructure from Terrorist Attacks. The launch event was accompanied by a training course on enhancing the physical security of critical infrastructure from terrorist attacks, using the Technical Guide as a training aid.
Developed under the OSCE’s Project PROTECT with support from Germany and the United States of America, the Technical Guide provides practical guidance to policymakers, critical infrastructure owners and operators, and security practitioners on enhancing the protection of critical infrastructure sites from terrorist attacks. The publication consolidates publicly available practices and examples from across the OSCE area and is designed to support stakeholders in developing security measures tailored to their specific risk environment. It was released in November 2025 in the English and Russian. The launch of the Turkmen language version of this Guide, initiated by the OSCE Centre in Ashgabat, is a testament to the Guide's growing value in OSCE participating States.
A representative of the Ministry of Internal Affairs of Turkmenistan presented the country's approach to protecting critical infrastructure, highlighting current practices, the national legislative framework and ongoing efforts to strengthen the security and resilience of critical infrastructure.
The training course brought together government officials responsible for critical infrastructure protection to strengthen their understanding of physical security principles and practices. Participants examined approaches to security system design as well as technical measures including perimeter protection, intrusion detection systems, security lighting, video surveillance, access control and security screening. During the event, participants explored practical ways to apply the Guide’s principles through security assessments, emergency planning, business continuity measures and training exercises.
“The Organization for Security and Co-operation in Europe serves as a vital pillar in global counter-terrorism efforts by actively strengthening the resilience and protection of critical infrastructure across its 57 participating States. Bearing in mind that security is not a task for a single agency or nation, we designed this training programme to build our collective resilience. It is our firm belief that this programme, together with the Guide, will strengthen inter-agency communication and help upgrade security protocols to more effectively protect critical infrastructure from terrorist attacks,” said William Leaf, Head of the OSCE Centre in Ashgabat.
The event featured contributions from international experts and practitioners, as well as the Government of Kazakhstan, another key stakeholder in the OSCE’s Project PROTECT. A representative of the Anti-Terrorism Centre of the Committee of National Security of the Republic of Kazakhstan delivered a presentation on the country's approach to protecting critical infrastructure from terrorist threats.
The event forms part of the OSCE Centre in Ashgabat's project Building Capacity of Law Enforcement and Security Officials of Turkmenistan in Countering Transnational Threats Related to Organized Crime and Terrorism – 2026 and the OSCE's extrabudgetary Project PROTECT, which supports participating States in strengthening national approaches to protecting vulnerable targets from terrorist threats and other hazards.
Leave a comment

INTERPOL report finds AI linked to more than half of cybercrime in Africa

Agency News, Cyber Security CII sector, Industry News

Artificial intelligence is enabling 55 per cent of reported cybercrimes across Africa making attacks faster, more scalable, and increasingly difficult for victims and platforms to detect, according to INTERPOL’s African Cyberthreat Assessment Report 2026.

With more than 1.1 billion mobile subscribers recorded in 2025, Africa’s digital transformation is expanding rapidly.

However, cybercrime legislation is fragmented and AI readiness in law enforcement agencies remains alarmingly low.

The 40-page report draws on survey data from 36 African member countries and highlights a defining shift: cyber-criminality has evolved from isolated incidents into an industrialized, borderless ecosystem.

East Africa emerged as a hub of mobile money fraud and infrastructure-targeted ransomware.

Business email compromise and romance scams targeting both corporate and individual victims were prolific in Central and West Africa.

Southern Africa’s ultra-high connectivity makes it a magnet for global threat actors seeking maximum disruption.

The financial toll of cybercrime in Africa is significant.

Since 2024, cybercrime-related losses have more than doubled, from USD 192 million to USD 484 million, driven primarily by AI-facilitated scams, credential harvesting, and automated social engineering campaigns.

According to the report, in 2025, online scams continued to be the most reported type of cybercrime, with attackers leveraging mobile money platforms, social media and AI to reach their targets.

Notably, 72 per cent of surveyed countries reported the presence of scam centres, with the highest concentration in Southern and West Africa.

AI-enabled cyberthreats
Digital sextortion and online harassment, often facilitated by AI-generated deepfakes and synthetic media, remained pervasive, with some 600,000 sextortion detections recorded by TrendAI, one of several partners working with INTERPOL.

Similarly, the sophistication of Business E-Mail Compromise (BEC) schemes increased dramatically, with AI used to generate highly convincing e-mail correspondence, with Africa-based threat actors targeting victims in Europe and North America using infrastructure located across multiple jurisdictions.

The report reveals that the absence of real-time, inter-agency data sharing between banks, telecoms and law enforcement creates a dangerous blind spot in efforts to combat financial fraud.

This vulnerability is being exploited by criminals who have moved beyond simply stealing existing credentials to creating entirely synthetic identities.

Combining real personal data with fabricated elements, these AI-generated digital personas can bypass even advanced biometric verification systems and have been used to open bank accounts, secure mobile loans and register SIM cards under false names.

Neal Jetton, Director of INTERPOL’s Cybercrime unit said, “Cybercrime has emerged as one of the most significant criminal threats to the region. AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion.

“However, we see that when countries work together, cybercriminal infrastructure can be identified, disrupted and dismantled.”

Meaningful transnational progress is visible. In 2025, 17 countries enacted or amended cybercrime legislation, including the launch of an online reporting platform in Senegal aimed at enhancing the response to online violations affecting children.

At the same time, regionally coordinated capacity building initiatives continue to strengthen long-term cyber resilience.

Operational cooperation is also delivering noteworthy results.

Four high impact cybercrime operations coordinated by INTERPOL including Operation Serengeti 2.0, Operation Contender 3.0, Operation Sentinel and Operation Red Card 2.0 collectively led to more than 1,500 arrests, the seizure of hundreds of devices and the recovery of over USD 100 million.

In its recommendations, the report calls for standardized digital forensic capabilities, enhanced cross-border cooperation, investment in AI literacy among law enforcement officers and formal-public private partnership to support effective prevention, detection and response.

Leave a comment

CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

Agency News, Cyber Security CII sector, Industry News, Water sector

CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.

These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.

CISA recommends organizations implement the following mitigations:

- Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
- Enable password protection and change default passwords.
- Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets.

After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix™ 1400 Controller When the Password Is Unknown for guidance addressing this activity.

To securely enable remote access to your OT systems, CISA recommends system owners, operators, and integrators see the following resources for guidance:

- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- United Kingdom's National Cyber Security Center: Secure Connectivity Principles for Operational Technology
- Federal Bureau of Investigation (FBI): Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions

For additional support, contact the Environmental Protection Agency’s Cybersecurity Technical Assistance Program for the Water Sector.

Leave a comment

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Agency News, Cyber Security CII sector, Industry News

The Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Federal Bureau of Investigation (FBI), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), United States Cyber Command – Cyber National Mission Force (CNMF), and Department of the Treasury (Treasury) released an updated joint Cybersecurity Advisory Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure.

This update re-emphasizes the ongoing threat from Iranian-affiliated advanced persistent threat (APT) actors targeting internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other brands/manufacturers. These attacks have resulted in operational disruptions and financial losses across multiple U.S. critical infrastructure sectors, including Government Services and Facilities, Water and Wastewater Systems, and Energy.

What’s New in This Update:

• Expanded Targeting: The advisory now includes observed targeting of Schneider Electric and Siemens PLCs, in addition to Rockwell Automation/Allen-Bradley and potentially other branded/manufacturer devices.
• Updated Technical Details: New information on threat actor tactics, including use of configuration software to exfiltrate device project files, and expanded details on targeted ports and device models.
• Enhanced Mitigations: Additional recommendations for securing cellular modems, implementing isolated architectures, validating project files, and detecting malicious changes in reusable code modules (such as Add-On Instructions/AOIs).
• New Indicators of Compromise (IOCs): Updated tables of internet protocol (IP) addresses and timeframes associated with Iranian-affiliated APT activity.

Iranian-affiliated APT actors continue to adapt their tactics, targeting a wider range of devices and sectors. Proactive review of this advisory and implementation of the recommended mitigations are critical to defending your organization’s OT assets and ensuring operational resilience.

Leave a comment

Detection vs. Deterrence: What Actually Stops Intruders

Industry News
Across critical infrastructure sectors such as energy, transportation, water, utilities, and other facilities, physical security threats are increasing in frequency and complexity. Assets are more distributed, sites are often remote or unstaffed, and essential operations cannot afford disruptions. Meanwhile, many organizations continue to rely on security frameworks focused primarily on detection rather than prevention.
The common approach is familiar: detect an intrusion, verify the threat, and initiate a response. Cameras, alarms, analytics, and monitoring centers form the backbone of this model, providing visibility into events as they unfold. In many cases, these systems are well-integrated and operationally necessary. However, detection-led security is inherently reactive. It assumes an intrusion attempt will occur and focuses on managing the outcome rather than reducing the likelihood of the event. In environments where response times vary and sites span large geographic areas, even rapid detection is unlikely to prevent loss, damage, or disruption.
This raises a broader strategic question for global infrastructure leaders: Is it enough to recognize when a breach occurs, or should the primary goal be preventing the attempt altogether?
The Structural Imbalance Between Detection and Deterrence 
Detection and deterrence are not competing concepts, but in practice, they are often treated disproportionately. As industry threats evolve and expectations for resilience rise, that imbalance is becoming harder to ignore.
Most physical security strategies are built around detection. According to the Physical Security Market 2025-2030 report, video surveillance systems dominated the global market, accounting for more than 50.5% (Grand View Research). This includes systems that detect activity once it has begun and trigger a response, such as cameras, motion sensors, alarms, and monitoring centers — tools that provide visibility into events as they occur.
• Detection systems answer necessary questions: What is happening? What happened? What response is required? They provide situational awareness to support incident verification and create a record for investigation, compliance, insurance, or operational review. In well-designed environments, they can be integrated into response protocols that guide how teams react once a threat is identified.
• Deterrence systems, by contrast, focus on influencing behavior before an intrusion attempt occurs. These include visible barriers, controlled access points, lighting, active perimeter security, signage, and environmental design that signal a higher level of risk, effort, and consequence to potential intruders.
The critical infrastructure industry continues to prioritize detection over deterrence. The global video surveillance market is projected to grow from $95.1 billion (USD) in 2026 to 261.65 billion (USD) by 2034 (Fortune Business Insights). The issue is not that detection is unnecessary. It is that a detection-first approach can create a security gap when visibility and response are emphasized more heavily than perimeter-based prevention strategies.
The Reality of Infrastructure Intrusions
To develop effective security strategies, it is necessary to understand how most violations take place in practice. While high-profile incidents may be sophisticated or targeted, most security breaches across critical infrastructure are less complex.
Many crimes are opportunistic, driven by theft, vandalism, trespassing, or easy access rather than coordinated attacks. The continued rise in material theft, such as copper, components, and equipment, reflects this pattern. These incidents typically occur where assets are visible, access is predictable, and resistance is low. In this context, intruders tend to follow a straightforward logic: they weigh effort against reward and choose the path of least resistance. Therefore, sites with inconsistent perimeter control, limited deterrents, or predictable operating patterns are more likely to be targeted.
For infrastructure operators, the consequences often extend far beyond the value of the stolen material or damaged asset. A single intrusion can create emergency repairs, downtime, safety concerns, crew diversion, insurance involvement, regulatory scrutiny, and operational disruption. For electric utilities, water providers, transportation operators, and other critical infrastructure organizations, the incident itself is often only the beginning of the cost.
When applied to security design, systems that primarily detect activity after entry can still leave infrastructure exposed. When the environment signals low resistance, the likelihood of an attempt remains high — even if detection capabilities are strong.
Where Detection-First Systems Fall Short
Detection systems identify events effectively, but once someone initiates an intrusion that triggers the system, the damage may already be done, and an unavoidable gap remains. Because these systems depend heavily on post-alarm intervention, monitoring teams — even those with AI — must assess alerts, filter out false alarms, and determine the appropriate response. In the United States alone, 94-98% of police alarm calls are false alarms, costing the public about $1.5 billion per year in police time (U.S. Department of Justice). Over time, delayed escalation or false calls can lead to a lack of response, especially in highly distributed areas.
The operational and financial impacts extend beyond the incident itself. A single breach can cause downtime, safety issues, and regulatory scrutiny, diverting resources and straining teams. From a financial perspective, downstream expenses such as replacements, insurance, and productivity losses tend to rapidly surpass prevention costs.
For many infrastructure sites, the issue is not whether detection works. The issue is whether detection happens early enough, and whether the response can arrive quickly enough, to prevent meaningful loss or damage.
How Deterrence Influences Behavior
A prevention-focused approach shifts the point at which security is activated. It moves the risk outward to the perimeter, where decisions are made and potential threats can be deterred from escalating.
At its core, deterrence operates on perception. Visible security measures create clearly defined boundaries and alter how a potential intruder evaluates risk versus reward. When effort increases and uncertainty rises, the likelihood of an attempt decreases. Essentially, security begins as a psychological barrier before any physical action is taken; it begins in the decision-making process. This premise also aligns with principles in criminology. Individuals seeking opportunity tend to favor environments with lower resistance and higher predictability. When those conditions change, behavior changes with them. In most cases, the outcome is not confrontation but displacement; intruders will move on to less-protected sites.
For critical infrastructure, many assets are located in remote or minimally staffed environments where response times are inherently constrained. In these settings, visible deterrence and clear boundary enforcement must be foundational measures. Physical barriers and well-defined perimeters heighten avoidance instincts and reinforce a simple message: access is controlled, and intrusion carries consequences. When security is designed with human behavior in mind, it reduces the likelihood that unlawful activity progresses in the first place.
The Case for a Layered Security Approach
Detection and deterrence should work together, not compete; relying on only one creates gaps. A more effective approach is organized, multi-layered, and aligned with how intrusions occur and how human behavior responds.
This model organizes security into three functional layers at critical infrastructure sites:
• Outer layer: Deter. Establish visible boundaries through barriers, active perimeter deterrence, lighting, signage, and controlled access gates to discourage intrusion attempts before they begin.
• Middle layer: Delay. Introduce intrusion sensors, lighting, audible alerts, secondary barriers, and other physical obstacles that slow or complicate movement, increasing the time and effort required to proceed.
• Inner layer: Detect and Respond. Use cameras and real-time monitoring systems to identify activity and initiate an appropriate response in the event of a confirmed breach.
In this framework, detection remains essential, but it is no longer the first or only line of defense. Its role is to reinforce a system designed to prevent intrusion, not simply manage it after the fact. For infrastructure operators, the objective is to align these layers with asset value, operational scale, and acceptable risk levels. A well-designed multi-layer approach minimizes perimeter exposure while enhancing response effectiveness and supporting continuity across critical systems.
Operational Considerations for Infrastructure Leaders
For industry leaders, the shift from detection toward layered deterrence is strategic. It requires moving from a reactive posture to proactive risk mitigation, with the objective of reducing exposure before incidents happen. This shift also changes how security effectiveness is evaluated. The focus moves beyond response capability to include prevention, visibility, and resilience across the entire operating environment.
A few questions can help assess whether your current strategies are aligned:
• Are we primarily reacting to incidents, or preventing them?
• How visible and defined is our security posture at the perimeter?
• Would a potential intruder view this site as difficult, risky, and time-consuming to enter?
How does our anticipated response time compare to the speed of a typical intrusion?
Are cameras and alarms being used as part of a layered strategy, or are they carrying most of the burden?
What is the full cost of an incident beyond replacement material or repair expense?
• Can the current model scale across distributed assets without creating unnecessary operational complexity?
At the same time, practical constraints remain. Security decisions must balance cost, coverage across distributed assets, and the ability to maintain and scale systems over time. The most effective strategies integrate these considerations without introducing unnecessary complexity or operational burden.
Selecting a partner that can manage all aspects of compliance, risk management, and connectivity for multi-site operations within a layered security strategy can reduce the need to juggle multiple vendors.
The Evolving Threat Landscape and Industry Expectations
The responsibilities assigned to critical infrastructure operators are expanding. Security is no longer evaluated solely on the ability to detect and report incidents, but on the ability to maintain continuity under increasing pressure. Regulatory scrutiny is intensifying, public safety expectations are rising, and insurance and liability considerations are becoming more closely tied to how risk is managed — not just how it is documented.
In response, there is a broader shift toward proactive risk mitigation. Resilience frameworks emphasize reducing exposure and ensuring operational stability rather than relying solely on post-incident reporting. Therefore, a perimeter-first, layered approach is a strategic foundation for addressing risk at the boundary, reducing the likelihood of intrusion, and limiting the need for downstream response. This shift also reflects a closer integration between physical security and operational resilience. Protection strategies are no longer isolated functions; they are part of a connected effort to safeguard uptime, reliability, public safety, and trust across critical systems.
As these expectations evolve, so must the standard for what constitutes effective security. Monitoring alone cannot secure critical infrastructure. The outdated sequence of detect, verify, and respond is no longer sufficient on its own. A more comprehensive model prioritizes deterrence and delay immediately, with detection and response as needed. As a result, success depends not only on how incidents are handled, but more importantly, on how often they can be avoided entirely.
Redefining Effective Security in CIP
Detection answers an important question: “What happened?” Yet deterrence addresses a more consequential one: “How do we reduce the likelihood that it happens in the first place?”
The most effective security strategies recognize this distinction. They prioritize preventing incidents where possible, while maintaining the ability to detect, verify, and respond when necessary. For infrastructure leaders, this requires a shift in how success is defined.
Success should not be measured only by how efficiently incidents are managed after they occur. It should also be measured by how effectively a security posture discourages attempts, delays escalation, reduces preventable losses, and supports operational continuity.
Detection will always matter. But detection alone is not prevention.
As threats evolve and expectations for resilience increase, the strongest critical infrastructure security strategies will be those that move risk outward, strengthen the perimeter, and combine deterrence, delay, detection, and response into a coordinated model designed to prevent more incidents from happening in the first place.
Jonathan Ratledge leads AMAROK’s Critical Infrastructure and Government strategy, helping utilities, public agencies, and infrastructure operators strengthen perimeter security across high-value sites.
Leave a comment

Crisis Communications Network Europe Joins CIP Week Europe 2026

Association News
The International Association of CIP Professionals (IACIPP) has announced that the Crisis Communications Network Europe (CCNE) has become the latest supporting organisation for the 3rd CIP Week Europe, taking place in Brussels from 20th–22nd October 2026.
Following the recent launch of CIP Week Europe 2026, IACIPP continues to expand the event's programme through partnerships with leading organisations representing the diverse disciplines that contribute to the protection and resilience of Europe's critical infrastructure.
Bringing together critical infrastructure operators, government representatives, security professionals, resilience practitioners, emergency planners and industry experts from across Europe, CIP Week Europe provides a platform for collaboration, knowledge sharing and professional development at a time when organisations are implementing new resilience and security obligations under the CER and NIS2 Directives.
At the heart of the programme will be the Critical Infrastructure Protection & Resilience Europe (CIPRE) Conference, featuring expert speakers, case studies and panel discussions covering physical and cyber security, resilience strategy, emerging threats, public-private cooperation, business continuity and the protection of essential services.
In addition to the main conference, delegates will have access to a series of specialist workshops delivered by supporting organisations, providing practical guidance and expert insight into key aspects of critical infrastructure resilience.
As one of the latest confirmed supporting organisations, Crisis Communications Network Europe (CCNE) will deliver a specialist workshop "From Incident to Communication: Crisis Communications for Critical Infrastructure", examining how communications support the response to incidents affecting critical infrastructure, from tactical communications in the field to strategic engagement with stakeholders, authorities, and the public.
The workshop will explore realistic scenario, participants will examine challenges, exchange experiences, and explore practical methodologies, best practices, and lessons learned. The session is intended for anyone responsible for, or interested in, crisis communications and resilience, and aims to provide practical insights that can be applied across a wide range of organisations and sectors.
John Donlon, Chairman of the International Association of CIP Professionals, welcomed the partnership.
"Protecting critical infrastructure is about much more than physical security and cyber resilience. Effective communication during a crisis is fundamental to maintaining public confidence, supporting operational response and enabling organisations to recover more quickly. We are delighted to welcome Crisis Communications Network Europe as a supporting organisation for CIP Week Europe 2026. Their expertise adds an important dimension to the programme and reflects the multidisciplinary approach needed to strengthen resilience across Europe's critical infrastructure."
Robbert Meulemeester, Coordinator of the Crisis Communications Network Europe (CCNE), said "The CCNE is delighted to be supporting and be part of CIP Week Europe. Crisis communications has a key part to play in managing an incident, helping organisations communicate clearly, maintain public confidence and support informed decision-making during times of uncertainty. As the risks facing critical infrastructure continue to evolve, effective communication must be recognised as a core component of organisational resilience, alongside security, business continuity and emergency management. Our workshop will provide delegates with practical insights into developing crisis communication strategies that strengthen preparedness, support response and contribute to faster recovery when incidents occur."
"CIP Week Europe was created to bring together the diverse community of professionals responsible for protecting and strengthening critical infrastructure," continued John Donlon. "Every new supporting organisation brings additional expertise and practical experience that benefits delegates. As the risks facing critical infrastructure continue to evolve, collaboration, knowledge sharing and professional development have never been more important."
The event is expected to attract participants from government agencies, critical infrastructure operators, utilities, transport providers, security organisations, emergency services, consultancies, technology providers and academic institutions.
Further announcements regarding speakers, additional workshop partners and programme details will be released in the coming weeks.
For organisations involved in critical infrastructure protection and resilience, CIP Week Europe offers a unique opportunity to engage with leading experts, share experiences and contribute to the development of a stronger and more resilient Europe.
Leave a comment , ,

Why Critical Infrastructure Should Use Drone Vulnerability Risk Assessments Now

Industry News
Drone incursions over critical infrastructure sites are no longer hypothetical—they are operationally relevant and escalating. Unauthorized incursions over the Salem and Hope Creek Generating Systems and River Bend Nuclear Power Plant highlight the issue, with reports suggesting some drones were up to five feet in diameter and capable of flying at more than 100mph. This is well beyond the profile of hobbyist systems.
The exposure is not limited to energy assets. The Federal Aviation Administration (FAA) now logs 100 UAS sightings per month near airports. For operators of sites such as airports, prisons, ports, utilities, data centers, oil and gas facilities, it’s already clear that dealing with the emerging drone threat is an urgent priority, but the question is how to address it in a defensible and measurable way.
Despite this, many operators delay action, waiting for regulatory clarity or standardized counter-UAS frameworks. This is a mistake. Inaction does not reduce risk; it compounds it.
Drone Vulnerability Risk Assessments (DVRAs) offer an immediate and practical path forward for critical infrastructure site operators. They enable operators to quantify exposure, identify detection and response gaps, and elevate the drone threat from a theoretical concern to a defined operational risk that can be communicated, prioritized, and acted on at the executive level.
Why DVRAs Matter
Conducting a DVRA provides a clear operational advantage by shifting organizations from reactive response to proactive risk management. Ideally implemented during the design phase and equally valuable in retrofit environments, a DVRA enables operators to identify vulnerabilities, evaluate threat scenarios, and integrate mitigation strategies before drone activity impacts service continuity, safety, or operations. This approach allows organizations to act deliberately, rather than under pressure, ensuring that counter-UAS measures are aligned with both mission requirements and site-specific risk profiles. A DVRA allows an organization to quantify their exposure in concrete terms, creating a defensible basis for budget allocation and prioritization of high-risk sites.
The assessment also translates emerging drone threats from a technical issue understood by specialists into something that leaders can evaluate. Detection of investment should be framed as a resilience and continuity measure, moving organizations from passive awareness to defensible, risk informed action. Early investment is critical, and a DVRA enables more disciplined capital allocation, avoiding higher costs and inefficiencies of reactive response.
What a DVRA Actually Delivers
DVRAs are not simple site walk-throughs; they provide a multi-layered analysis that translates drone-related technical challenges into actionable risk management. A DVRA evaluates the specific threat profile of a site, including likely drone capabilities, attack vectors, potential consequences, and high-impact security gaps.
This analysis enables operators to prioritize sensor placement and account for environmental factors such as radio frequency interference, ensuring detection systems are appropriately selected and deployed. Radar plays a critical role, particularly in addressing “dark drones” that cannot be detected through RF-based methods.
While some operators may wait for full counter-drone authorization, targeted detection remains an effective first layer of defense and supports soft mitigation strategies. A DVRA supports this approach by mapping risk across distributed assets and identifying the highest-consequence vulnerabilities requiring immediate attention.
The Scale of the Problem
The number of drones already in U.S. skies is staggering. The FAA has registered 420,825 commercial drones and 383,007 recreational drones in the U.S., ranging from hobbyist UAVs through to larger electric vertical takeoff and landing vehicles (eVTOLs). Threats range from hobbyists who may not mean to cause harm but do so accidentally (such as drones sighted over wildfires, which can cause a real threat to firefighting aircraft), through to those used for espionage and sabotage.
Drones present a unique threat to critical infrastructure. They can enter sites unnoticed, land undetected, and bypass traditional human security measures. As a result, locations once considered secure against ground-based threats are no longer assured in an era where modern drone technology has become a real and accessible risk.
Drones also pose very real threats to critical infrastructure. The scientific paper Advances And Challenges in Drone Detection and Classification Techniques, published by Purdue University researchers and researchers from Satbayev University, found:
“Due to the fact that unmanned aerial vehicles are capable of carrying explosives as well as biological and chemical weapons, drone attacks fall under the first category of possible threats. These explosives might be used to attack a variety of targets, such as specific individuals, public institutions, business organizations, and even whole nations.
Smuggling is the second-leading threat category for drone use. For border patrols and jail staff, drone drug smuggling has grown to be a serious issue. Sometimes weapons or other illegal items are smuggled beyond the reach of ground-based security. Border locations have a wide range of weather; therefore, smuggling drones need to be able to operate in adverse weather conditions.
Drones with strong cameras may also be used to spy on people, businesses, and governmental institutions from a distance. Despite privacy claims, this worry might be a drone hazard, such as a privacy invasion or espionage.
Accidentally or purposefully launching a remote-controlled drone near an aircraft or in its flight path might threaten the safety of the crew and passengers and might damage property.”
The Drone Threat Is Here Now-An Ideal Time for DVRA
These threats are not abstract, futuristic concepts. Analysis of drone incidents in 2023 found that 38% relate to drones breaching borders, and 28% involved drones delivering illegal items and drugs into prisons. Another 18% involved drones flying too close to airport runways.
The sightings of drones in New York, Pennsylvania and New Jersey spread over 17 days, and led to the FAA issuing ‘special security’ flight bans over parts of New York and New Jersey to protect critical infrastructure. The saturated attack had significant impacts, including preventing a medical helicopter from transporting a car crash victim due to a drone sighting near Raritan Community College.
Beyond coordinated incursions, drones are now a leading source of disruption in the aviation sector. UAS incidents have become the primary cause of non-weather-related flight delays, with 749 flights disrupted across the United States between January and September 2025 alone.
Internationally, the patterns are similar. At Sweden’s Stockholm Arlanda Airport, sightings of UAS forced full suspension of air traffic for two-and-a-half hours, with fears that the incursion could be linked to heightened geopolitical tensions following Sweden’s accession from NATO. In the United States the risk profile continues to expand. Recently, a United Airlines pilot reported colliding with a drone at 3,000 feet above San Diego, California. And in Nashville, a man with extremist beliefs who wanted to collapse the U.S. power grid attempted to weaponize a drone with explosives.
Correctional facilities face parallel escalation. The number of incidents has jumped from just 23 in 2018 to almost 500 in 2024, driven by evolving drone technology and greater detection awareness. There are reasons for optimism. At a state prison in Ionia, Michigan, a drone-delivered contraband drop was intercepted, leading to the identification and arrest of three individuals. This was one of the earliest documented cases where operators were apprehended in direct response to a drone smuggling event.
The Limits of Legislation
One key issue is that it’s still unclear how legislation will change to allow site owners to respond to drone threats. At present, drones enjoy protected status as ‘aircraft’, making it a federal felony to disable, damage or destroy them, under FAA rules. The Cybersecurity and Infrastructure Security Agency’s (CISA) ‘Be Air Aware’ guide, published late in 2025, raises awareness around the threat of drones both at infrastructure sites and at public gatherings, and highlights detection, rather than mitigation. The CISA guide advises, “If you witness a UAS operation that appears dangerous or is being used to commit a crime, report it immediately to local law enforcement first responders.”
The SAFER Skies Act, enacted as part of the FY2026 National Defense Authorization Act in December 2025, expands U.S. counter-drone authority by allowing qualified state, local, tribal, and territorial agencies- not just federal agencies - to detect, track, identify, and mitigate drones that pose credible threats to people at major public events, and critical infrastructure including correctional facilities. It also establishes federal training, certification, approved technology standards, reporting requirements, and funding pathways to help local agencies respond more quickly and lawfully to growing drone risks.
With infrastructure operators still constrained by regulatory and legal limitations, many continue to delay investment in drone detection capabilities.
Reactive Spending After an Incident Costs More
Investing in drone defense early—through a DVRA and a structured approach to threat mitigation—is often the most cost-effective long-term strategy. Reactive spending after an incident is typically more expensive, particularly when factoring in the direct and indirect costs of operational disruption.
The 2018 Gatwick Airport incident provides a clear example. Reports of drone activity led to a full airport shutdown, with estimated economic losses of £50 million. Emergency response measures added further cost, including the rapid deployment of military-grade tracking equipment. In the aftermath, Gatwick implemented counter-drone technology at an estimated cost of £4 million.
While the post-incident investment was necessary, the scale of disruption and financial impact underscores the value of earlier, proactive measures.
Making the Final Case Against Waiting
Critical infrastructure security can no longer stop at the fence line. It must extend into the low-altitude airspace above the site, where commercially available drones can create real consequences for operations, safety, continuity, and sensitive data.
Conflicts in Ukraine, the Middle East, and other contested environments have demonstrated how inexpensive, commercially available, and rapidly modified drones can produce outsized effects. Those tactics will not remain confined to conflict zones. They are already informing criminal activity, extremist planning, and unauthorized incursions near sensitive facilities.
For infrastructure operators, the case for waiting is collapsing. Regulatory uncertainty may limit mitigation options today, but it does not prevent organizations from understanding their exposure, deploying detection, and building a defensible response plan.
A DVRA is the practical first step. It gives operators a clear view of their vulnerabilities, their highest-consequence gaps, and the investments needed to reduce risk before an incident forces action under pressure.
This ties back much more cleanly to the introduction: drone threats are urgent; waiting is not a strategy, and DVRAs are the most practical path forward now.
By Kara Quesada, Senior Director of Marketing at Echodyne and William Edwards, Director of C-UAS Training – ENSCO
Leave a comment

NATO PA Promotes Investment in Collective Defence, Infrastructure Protection

Agency News, Cyber Security CII sector, Industry News, Power/Energy/Oil & Gas sector, Transport sector
The NATO Parliamentary Assembly has highlighted legislators’ vital role in ensuring the Atlantic Alliance faces up to pressing security challenges, strengthening collective defence and protecting against hybrid threats.
The Assembly’s Spring Session drew over 230 lawmakers from NATO and partner nations. Discussions on the second day focused on issues ranging from safeguarding critical infrastructure, maintaining military force levels and fast-tracking defence innovation
“The war in Ukraine is driving new thinking about modern warfare,” explained US Congressman Rick Larsen. “Innovating quickly is important but integrating and scaling new technologies is just as essential.
Drawing on Ukraine’s experience of fast-paced wartime innovation, Larsen said NATO must work urgently to overcome years of underinvestment, insufficient and fragmented demand, slow procurement and overly bureaucratic acquisition systems.
“That’s where we come in,” he told fellow parliamentarians. “We control the budgets. We conduct oversight. We can demand answers when promising technologies stall. We can push governments to integrate NATO commitments into national legislation and procurement systems that work.”
A presentation by Greek member Spyridon Kyriakis centred on shaping NATO’s future forces by improved recruitment, retention of experienced military personnel and strengthening the will to fight within Allied societies.
Faced with an aggressive, expansionist Russia on its doorstep, NATO must take steps to meet recruitment targets and ensure personnel stay in uniform longer, particularly those with critical skills such as cyber, intelligence, logistics and special operations.
“We need a sweeping renewed conversation on how we value, support and inspire our forces,” Kyriakis told the Assembly.
New NATO defence plans, bigger budgets and arms acquisition “can only deliver real deterrence if the Alliance has the well-trained, highly motivated men and women needed to operate and sustain them,” he added.
Lawmakers debated the costs and benefits of conscription and emphasised the importance of building on Ukraine’s experience to build public support and societal resilience to shape mobilisation capacity and wartime outcomes.
“As parliamentarians ... we hold the levers of oversight, the power of legislation and the loudest microphones to champion the profound value of military service to our citizens,” Kyriakis concluded.
Ahead of July’s summit of NATO leaders in Ankara, lawmakers highlighted the role of parliaments in ensuring that Allies stick to the goal of spending at least 5% of gross domestic product (GDP) on defence and security.
“There is still much to be done to bring defence spending to 5% of GDP and transfer that money into actual operational deterrence and defence capabilities,” said Dutch Senator Bart Kroon. “Sustaining that level of spending and transformation will require trade-offs and smart policymaking.”
NATO PA speakers underscored the need to protect critical infrastructure, such as undersea and space assets, from the mounting risk of hybrid attacks.
“Allied security is increasingly dependent upon our space systems and undersea infrastructure,” stated US Congressman Mike Turner. “They are core components of our defence posture and our economic resilience; and are under growing pressure from our adversaries.”
Turner and British Member Lord Nigel Dodds made presentations urging better monitoring and attribution of threats to infrastructure, faster repair and replacement options and solutions that allow forces to operate when communications are degraded by adversaries. Cooperation with the private sector is essential.
“Parliaments and we, as parliamentarians, have an important role to play,” said Dodds. “We can help ensure that national legal frameworks are fit for purpose. We can scrutinise whether governments have clear lead authorities and effective coordination structures. We can support dedicated funding for protection, repair, and response; and we can help keep political attention on this issue before a major disruption occurs.”
Leave a comment
1 2 3 … 69