The Real Time Threat Intel Imperative for OT Systems

Diminishing supplies tapped by lines of waiting cars at filling stations across the American Southeast in May 2021 were a wakeup call for critical infrastructure operators. The lines accumulated because Colonial Pipeline, operator of the largest pipeline system in the United States, stopped the flow of gas.

Extending 5,500 miles from Texan refineries in Houston to New Jersey distributors at Manhattan’s doorstep, the pipeline was dry. Its operators turned it off after the DarkSide ransomware operation took company systems hostage, demanding a $4.4 million ransom payment. The company eventually paid.

See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge

Hackers penetrated Colonial Pipeline after finding an obsolete VPN account not protected by multifactor authentication that connected to the entire corporate network. They didn’t breach the operational technology environment – Colonial Pipeline executives said they proactively “took certain systems offline to contain the threat.” But the takeaway is plain: Siloed security practices no longer suffice in operational technology environments.

Rare is the OT environment truly isolated from a business network. OT systems may be shielded by firewalls and classified into zones – but they still ultimately connect to the IT business systems of their enterprise, which needs data for billing, planning and logistics. Greater connectivity means a more agile enterprise. It also means escalating risks. Experts say real-time, contextual threat intelligence is now essential for securing OT systems, enabling faster detection, more accurate responses and coordinated action across IT and OT teams.

“Real-time threat intelligence is essential for detecting and responding to cyberthreats before they impact industrial operations,” said Derek Manky, chief security strategist at Fortinet’s FortiGuard Labs. Manky said a major energy provider used real-time threat intelligence to prevent a ransomware attack targeting its industrial control systems. Security teams detected unusual reconnaissance activity aligned with known tactics used by initial access brokers. The organization was able to block malicious IPs identified in threat intelligence feeds and enforce stricter authentication controls.

“As a result, the attack was neutralized before it could disrupt industrial operations, demonstrating the power of real-time intelligence in safeguarding critical infrastructure,” Manky told Information Security Media Group.

Prateek Singh, lead for OT cybersecurity services at Eaton, shared a case involving a manufacturing firm on how real-time intelligence identified unusual traffic between a human machine interface and programmable logic controller.

“Matched to known malware, the SOC isolated the devices, performed threat hunting and prevented lateral movement, averting production downtime,” Singh said.

Jan Miller, CTO of threat analysis at Opswat, emphasized that real-time intelligence has to be useful to both sides of the OT-IT divide. “It’s not enough to collect data, you have to make it usable for both IT and OT teams,” Miller said. “That includes translating technical insights into operational terms that engineers can act on without risking downtime.”

Experts agree that intelligence should span pre-attack prevention and active incident response. “Threat intelligence plays a dual role by providing early warning signs before an attack and clarifying severity during one,” said Grant Geyer, chief strategy officer at Claroty. “The more tailored your intelligence is to your environment, the faster and more effective your response will be. You can’t take a one-size-fits-all approach in OT.”

Integrating that intelligence without disrupting operations remains a balancing act. “To successfully integrate threat intelligence, IT and OT teams must work together without compromising uptime or operational efficiency,” said Manky.

He advised organizations to use unified threat platforms that consolidate IT and OT data, implement zero trust access controls and run joint security drills to build cohesion across teams.

Miller endorsed a layered integration strategy involving secure data transfer mechanisms like unidirectional data diodes and advanced content sanitization techniques such as content disarm and reconstruction. A diode is a unidirectional gateway that allows data to only pass in one direction. These methods ensure that operational workflows remain undisturbed while threat intelligence feeds are validated and applied securely.

Emerging technologies will further transform the threat landscape. “AI-driven threat detection that continuously adapts to new attack patterns, coupled with automated SOAR platforms, will streamline incident response and reduce manual workloads,” Manky said.

Growing Nation-State Threat

Roughly 18 months after Colonial Pipeline suspended operations, the European Union Agency for Cybersecurity published a warning for critical infrastructure operations: nation-state hacking groups are coming.

And come they have. Several nation-state groups are actively targeting operational technology systems, with the most prominent being a threat group linked to China called Voltzite, said industrial cybersecurity firm Dragos in March (see: Groups From China, Russia, Iran Hitting OT Systems Worldwide).

Nathaniel Jones, vice president of threat research at Darktrace, said advanced persistent threats often rely on unpatched, internet-facing OT and IoT devices to break into production environments. “These operations suggest a long-term, strategic intent often involving state-sponsored actors who establish footholds and wait, only increasing activity when geopolitical conditions change,” he said.

Darktrace analysts have observed energy sector attacks ranging from targeted disruptions of PLC motors in SCADA environments to widespread Fog ransomware incidents.

Jones said that many groups now avoid traditional indicators of compromise, instead relying on living off the land techniques to evade detection.

“With IT and OT systems increasingly converging, defending CNI demands coordinated, continuous monitoring and proactive security across the full digital estate,” he said.

Singh believes that the convergence of IT and OT solutions will give rise to unified threat detection platforms and digital twins virtual replicas of physical OT systems to simulate attacks and model impacts in a risk-free environment.

“This allows teams to understand attack vectors and operational consequences before real damage is done,” he said.

Claroty’s Geyer warned that with OT’s increasing connectivity to cloud and mobile systems, the attack surface will grow exponentially. “Unless security and risk managers proactively segment OT assets and environments, operational disruptions will become more common,” he said.

“Organizations need to move beyond viewing threat intelligence as a static input,” Geyer said. “In OT, action is everything.”