1. Scale, not sophistication: the multi-state water PLC campaign gets its post-mortem

GovTech · Industrial Cyber · IBM X-Force · BlastWave · August 10 – September 3, 2026

The campaign against US water and wastewater systems began on July 27, spans at least seven states, and involves more than a hundred individual incidents. The method was not exotic. Attackers reached programmable logic controllers that answered directly from the internet and changed their IP addresses and passwords. That is the whole technique. No process was manipulated, no chemical dosing was touched, no safety interlock was defeated — the operators were simply locked out of their own controllers. Randy Rose, VP of Security Operations and Intelligence at the Center for Internet Security, gave the assessment that should frame every board conversation about this campaign: “Sophistication wasn’t necessarily needed.” The equipment reached was Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 series controllers, contacted over EtherNet/IP on TCP port 44818. Threat actors have still not been officially named; US officials are investigating a possible Iranian connection, and CISA advisory AA26-097A covers a broader Iran-affiliated campaign against Rockwell, Schneider Electric and Siemens devices. The FBI, EPA and CISA are all engaged.

Two different counts circulate, and they measure two different things. GovTech’s figure — more than a hundred incidents across at least seven states from July 27 — describes the whole campaign. The Minnesota figure, more than thirty municipal water systems struck on July 26 and 27, describes its epicentre, with similar intrusions in at least seven other states. Minnesota is where the operational detail is clearest. Some facilities reverted to manual operation, reading gauges and adjusting valves by hand. Recovery meant physically opening controller cabinets, removing backup batteries and performing hard factory resets — a procedure that requires a technician at each site, which is exactly the constraint a small utility does not have slack for. The Minnesota Department of Health confirmed no impact on water quality and issued no boil-water advisories. In parallel, the White House launched Gold Eagle on July 14, a public-private vulnerability clearinghouse using AI to coordinate scanning and remediation; Dennis Hackney’s column for Industrial Cyber makes the sharpest objection to it, arguing that an AI clearinghouse which accelerates patch delivery solves an IT problem rather than an OT one. Patch velocity is not the constraint when the controller has been reachable from the public internet for six years.

IBM X-Force’s David McMillen supplies the reconnaissance half of the story, and it is the part local government should read directly. Attackers do not need a target list; they need a search engine. As McMillen puts it, “an adversary can first search for a technology, protocol, product or service and identify its owner afterward.” The ports that matter are the ones already in the campaign: 44818 for EtherNet/IP, plus 2222, 102 and 502. X-Force names Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens and Unitronics as the vendor estate visible this way, and sets the current campaign against its own precedents — Iranian-affiliated targeting of internet-connected PLCs across US critical infrastructure in April 2026, the January 2024 Texas water incidents at Muleshoe, Hale Center and Lockney, and the November 2023 CyberAv3ngers campaign against Unitronics devices that compromised more than 75 units. BlastWave’s commentary on the same events, which quotes Shaun Six of UTSI and its own solutions architect Joe Baxter, is vendor material rather than reporting, but it lands on the right conclusion: an attack that required no sophistication is more alarming than one that did, because nothing about the adversary needs to improve for it to happen again.

The practical work is unglamorous and finite. Enumerate every controller, HMI, historian and cellular gateway that holds a routable address, including carrier-assigned ranges behind any modem, and confirm from the outside — not from the asset register — which of them answer. Check ports 44818, 2222, 102 and 502 explicitly. Search the commercial scanning services for your own organisation’s name, netblocks and equipment banners, because that is the query the adversary ran. Where a controller must be reachable for a legitimate remote-support arrangement, put an access gateway with multi-factor authentication in front of it and log every session. And write down the recovery procedure now, while nobody is under pressure: which cabinet, which battery, which reset sequence, whose truck, how long. The utilities that took days to recover were not the ones with the worst security; they were the ones who had never rehearsed a factory reset on a controller they could no longer log into.

Sources: GovTech · Industrial Cyber · IBM X-Force · BlastWave

2. Project Watershed 250: a six-month pilot in Texas, at no cost to the utilities

Industrial Cyber · Forescout · September 1–4, 2026

Project Watershed 250 is a six-month pilot programme in Texas whose purpose is to find and fix cyber vulnerabilities in water systems before they are exploited. The federal participants are the EPA and CISA; the state participant is Texas Cyber Command; the private-sector participants are Microsoft, Reflection AI, Palo Alto Networks, Dragos, Forescout and Tenable. Participating utilities receive federal, state and private-sector cyber defences at no cost to them — which, for a sector where most systems serve fewer than ten thousand people and many have no dedicated security staff at all, is the design decision that determines whether anything happens. The programme has two components: red-team exercises run against utility networks, and AI-powered security tooling and threat intelligence deployed alongside them. National Cyber Director Sean Cairncross, Texas Cyber Command chief Timothy James “TJ” White and Governor Greg Abbott appear on the government side; Chris Barry of Microsoft US Public Sector, Dragos CEO Robert Lee, Tenable’s public-sector CTO Chris Day and Forescout’s VP of Government Affairs Alison King on the industry side. King framed the premise in the sentence the whole programme rests on: “Resource-constrained cannot mean defenseless.”

The programme is explicitly a response to the July 2026 attacks on more than thirty Minnesota water systems, and it inherits that campaign’s lesson about where the failure was. Red-teaming a utility that has an exposed MicroLogix on 44818 will find it in minutes, which is the point — the exercise is not there to discover novel tradecraft but to produce a finding with a state agency’s name attached to it, in a sector where an outside finding is often the only thing that unlocks a budget line. The AI component is the part to watch sceptically. Automated scanning and triage across a few hundred small utilities is a genuinely good fit for the technology; autonomous remediation on a live process network is not, and nothing published so far says which of the two is intended.

Forescout’s own release, three days later, is worth reading with its framing adjusted. Forescout is one of six named private-sector participants, not a bilateral partner of the federal government and the state, and the release itself names no specific White House office and no specific Texas agency — the Industrial Cyber piece is the one that identifies Texas Cyber Command, the EPA and CISA. What the release does usefully supply is the shape of the technical contribution: continuous monitoring, asset visibility, external attack-surface analysis, passive OT assessment, vulnerability prioritisation, segmentation and AI-enabled defence delivered through its Vistaro platform and a universal zero-trust network access architecture, with Barry Mainz as CEO and Mike Walsh leading Forescout Government Systems. The accompanying figures — more than 70 US federal entities served, use by over 85% of US federal executive departments, eight of the top ten Fortune 500 utilities, more than 180 product integrations — are vendor self-reported and should be read as positioning rather than as programme facts. For an operator outside Texas the practical question is narrower and answerable now: passive OT assessment and external attack-surface analysis are exactly the two services that produce a defensible baseline without touching a controller, and both are procurable today from several of the six.

Sources: Industrial Cyber · Forescout

3. CISA retires six free assessments in the same week it helps launch a pilot

Cybersecurity Dive · September 1, 2026

CISA is ending six free assessment offerings for critical-infrastructure operators: Cyber Resilience Reviews, Cyber Resilience Essentials surveys, Ransomware Readiness Assessments, Incident Management Reviews, External Dependencies Management Assessments and Cyber Infrastructure Surveys. Regional staff were told on August 25. The agency’s stated rationale is reducing redundancy and retiring what it describes as legacy questionnaire assessments; sources inside the agency cited workload concerns and disputes between CISA divisions as contributing factors. The context is an agency that has lost roughly a third of its workforce since the start of the second Trump administration, and that is currently operating with acting leadership across the relevant chain — Nick Andersen as acting director, Chris Butera as acting executive assistant director for the Cybersecurity Division, James Harrell as acting assistant director for Integrated Operations.

The criticism is pointed and comes from people who have run this machinery. Jeff Greene, formerly head of CISA’s Cybersecurity Division; Michael Daniel, president of the Cyber Threat Alliance and a former White House cybersecurity coordinator; and Tatyana Bolton, executive director of the OT Cyber Coalition, all pushed back. The objection they share is about timing rather than product design: “This is a deeply dangerous time to be scaling back direct assistance.” It is worth being precise about what is actually lost. These were questionnaire-driven, facilitator-led reviews, not penetration tests, and a large mature operator will not miss them. The organisations that will are the ones with no security programme to review — the small water system, the rural co-op, the county utility for which a free, structured, externally facilitated assessment was the only mechanism that ever produced a written list of gaps. CISA has not said how many organisations used the assessments, and the reporting does not quantify it.

Set this beside Project Watershed 250 and the shape of the policy becomes visible: intensive, funded, vendor-supported help for a few hundred utilities in one state, and the withdrawal of a low-cost baseline that was available to all of them. Those are not substitutes. If your organisation was on a waiting list for any of the six, the practical move is to find out what stage your request is at before the offering closes, and to identify the replacement path — a sector ISAC, a state programme, a regional CISA advisor relationship that survives the cut, or a commercial assessment mapped to the same control set. The output that mattered was never the questionnaire; it was having a document, produced by someone outside the organisation, that a general manager or a rate board would treat as evidence.

Sources: Cybersecurity Dive

4. A wind farm’s cellular router, a private APN, and a Polish CHP plant that stopped

Zscaler · Netresec · August 31, 2026

On December 29, 2025, a Polish combined heat and power plant lost a steam turbine and its process-water treatment system to a cyberattack, temporarily cutting municipal heat supply to around 50,000 residents. CERT Polska investigated and published its account in August 2026, with public disclosure on August 8; two separate write-ups appeared on August 31, and both describe the same incident. Zscaler supplies the chain, Netresec the forensics. The intrusion is attributed to Sandworm, also tracked as the Russian state-sponsored group Electrum, and CERT Polska describes coordinated simultaneous attacks against more than thirty other Polish renewable-energy and power-distribution sites.

The path in is the reason this incident belongs in every OT architecture review this quarter. It started at an internet-facing, unpatched firewall at a remote wind farm — Netresec identifies it as a FortiGate VPN appliance. From there the attackers took SSH access to a Teltonika cellular router, a RUTX50 5G unit, and tunnelled into the grid operator’s private APN. A private APN is widely treated as a trusted network; this one had no client isolation, so a scan of the entire private cellular IP range was possible from a single compromised site. That scan found a WAGO PLC still carrying default administrator credentials. The attackers then issued unauthorised stop commands to Siemens PLCs controlling the steam turbine, over Modbus and S7comm. Netresec adds the timeline that matters most: malicious activity was visible in the traffic as early as December 18, against destructive actions on December 29 — more than eleven days of dwell time in an environment where nobody was watching. The attackers put Siemens S7-1500 controllers into STOP mode, enabled PLC password protection to slow recovery, and altered the configuration of industrial serial device servers and network switches. No CVE is named in either account; nothing here required one.

Netresec’s conclusion is the title of its post, and the evidence supports it plainly. CERT Polska’s own investigators wrote that “due to the lack of logs, our investigation relied on the development and testing of hypotheses” — eleven days of adversary activity reconstructed by inference because the network recorded nothing. The ICS ports Netresec recommends monitoring are specific and short enough to act on this week: TCP 102, 502, 2404, 5094, 20000, 44818 and 47808. It also ties the case to the NSA/CISA/FBI/DOE/EPA joint advisory of August 19 on the active threat to Siemens S7 series PLCs, which makes the Polish case a worked example rather than an isolated event. Three questions follow directly. Does your private APN isolate clients from one another, or does every remote site see every other one? Which cellular routers, firewalls and remote-access appliances at unstaffed remote sites are on a patch cadence, and who owns it — you, or the renewables developer who commissioned the site? And if an adversary spent eleven days on your process network, what record would exist afterwards?

Sources: Zscaler · Netresec

5. Battery storage: a 92% probability, and a hostile swing that looks like a badly tuned controller

Industrial Cyber · Help Net Security · September 2–3, 2026

Centrii’s GRIDLOCK report, presented by CEO and co-founder Rafael Narezzi, models the cyber risk to grid-scale battery energy storage using a Monte Carlo simulation of 10,000 iterations across three security postures. Under the current posture it puts the probability of a major attack on UK battery storage by 2031 at 92%; under mandatory IEC 62443 certification that falls to 61%. The physical scenario behind the headline is what makes the number legible. Compromising 29% of UK national BESS capacity — roughly 400 units — would be enough to trigger a national blackout affecting 67 million people. The Texas comparator is starker in ratio: 5.4% of the ERCOT battery fleet, about 1,500 units, would affect 30 million people. Damage estimates run to £2bn–£10bn for the UK and USD 12bn–65bn for Texas, against prevention spending of £400m–£1bn in Great Britain and USD 800m–2.8bn in ERCOT to reach IEC 62443 Security Level 2 — a return of five to eighty times. The precedents cited are real events, not scenarios: wind-turbine manipulation in Poland in December 2025, and the April 2025 Spain and Portugal outage in which 2.5 GW was lost in twenty seconds.

The companion interview, published a day earlier, is the same research turned toward detection, and it is the more operationally useful half. Narezzi’s framing is that Britain’s system is engineered to withstand a sudden loss of 1,320 MW without breaching statutory frequency limits, that Low Frequency Demand Disconnection triggers at 48.8 Hz, and that the grid can hold around 49.2 Hz for up to sixty seconds. Those numbers define the attack envelope. They also explain his smaller-scale figure, which deserves more attention than the blackout headline: 11 to 21 compromised 2 MW units are enough to destabilise a regional grid, against 400 to 1,500 for a national event. Regional destabilisation is within reach of an adversary who compromises one optimiser’s portfolio.

The detection problem is the genuinely hard part, and Narezzi states it exactly: “A hostile swing and a revenue-driven one look identical on the wire.” A battery that responds aggressively to a frequency excursion may be arbitraging, or it may be attacking; the command traffic looks the same. The distinguishing signature he offers is behavioural rather than protocol-level — inverter output that amplifies oscillations rather than damping them, a “reverse governor” response that no legitimate commercial strategy produces. The forensic obstacle is structural: the evidence needed to tell the two apart sits with the optimisers and OEM cloud platforms that dispatch these assets, not with the grid operators who would have to make the call. Neither piece names specific inverter or BMS manufacturers. For an operator, the actionable items are contractual as much as technical: establish now, in writing, what dispatch and inverter telemetry your optimiser and OEM retain, for how long, and how quickly you can obtain it after an anomaly. Then ask whether anyone in your organisation is monitoring for damping response at all, or only for availability and revenue.

Sources: Industrial Cyber · Help Net Security

6. USD 535.74 and eight hours: what it actually costs to port a PLC exploit with an LLM

Forescout Vedere Labs · SecurityWeek · September 1, 2026

Amine Amri of Forescout Research — Vedere Labs set out to answer a question the industry has been arguing about without data: can an AI model take an existing PLC exploit and port it to a different device, and what does that cost? The vulnerability chosen was CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus RTOS FTP server stack. The source exploit targeted a WAGO 750-852 controller; the target was a WAGO 750-831 running firmware V01.04.16 — same vendor, different hardware, different memory layout. The models were Claude Sonnet 4.6 with a 200k context window and Claude Opus 4.6 with a 1M window, driven through Claude Code with terminal access and Ghidra for disassembly. This is a well-resourced setup operated by someone who already knew what he was doing.

The numbers are the contribution. The final remote-code-execution development stage consumed USD 535.74 in API tokens across a session totalling 8 hours 32 minutes spread over several days, with 2.6k input and 1.3 million output tokens. Once working RCE existed, the character of the work changed sharply: the model produced two functional ARM shellcode payloads in twelve minutes, one an ICMP echo-request payload and the other a UDP beacon transmitting the string “PWNED”. Then the researcher pushed further, attempting to extend the exploit into a command-and-control implant, and bricked the target device. Forescout’s own verdict is the one to quote to anyone claiming a step change: “One could argue that the researcher could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive.” SecurityWeek’s write-up of the same experiment, published the same day, rounds these to “over $500” and “more than 8 hours”; the precise figures above are Forescout’s.

The defensive reading is specific, and it is not reassurance. What the model was good at was the mechanical, well-specified, heavily-documented work — generating architecture-correct shellcode for a known payload objective, twelve minutes for two working payloads. What it was bad at, expensive at, and ultimately destructive at was everything requiring judgement about an unfamiliar embedded target: understanding a different memory layout, adapting an exploit primitive, knowing when to stop before the device dies. For OT defenders this maps to a concrete expectation. Assume the payload and adaptation stages get cheaper and faster from here. Do not assume the discovery stage does. That means the exposure and access controls that stop an attacker from reaching a controller in the first place retain their full value, while any defence premised on the difficulty of writing a working payload for your particular architecture is on a shortening clock. The other detail worth carrying into a risk conversation is the bricked controller: an adversary experimenting with AI-assisted exploitation against production equipment is likely to destroy some of it, which is a safety consideration rather than an availability one.

Sources: Forescout Vedere Labs · SecurityWeek

7. Booz Allen tests eighteen frontier models — and finds them scoring zero where it counts

Industrial Cyber · CyberScoop · August 19 – September 4, 2026

Booz Allen Hamilton published “The Offensive Frontier: AI as the Attacker” on September 4, reporting on tests of eighteen US and Chinese frontier models against offensive tasks. The headline finding is that one model, Anthropic’s Claude Mythos, autonomously completed a full cyber kill chain in enterprise testing, gaining administrative access using stolen credentials, and that roughly two-thirds of the eighteen reliably gained initial network access without credentials. Booz Allen expects most of the tested models to reach full autonomous kill-chain capability within six months, and argues that the response windows available to critical-infrastructure defenders in energy, communications, financial services, water and healthcare narrow accordingly. Its framing sentence is the useful one: “The unit of risk is no longer the individual model but the system as a whole.” The report calls for enforceable, sector-specific readiness deadlines for critical infrastructure.

Two qualifications belong next to that headline. The first is a finding inside the report that cuts against it: every frontier API model tested scored zero against actual real-world vulnerabilities. Enterprise test environments are built to be solvable; production OT is not, and the gap between those two results is the entire practical question. The second is commercial. The figure that counter-AI playbooks reduced autonomous attacker success by more than 95% describes Booz Allen’s own playbooks, and the report accompanies Vellox Labs Guile, its counter-AI defence tool. That does not make the measurement wrong; it does mean the number is a vendor’s claim about a vendor’s product, and should be read as one.

The field evidence sits alongside it and is more concrete. On August 19 the NSA, CISA, the FBI, the Energy Department and the EPA issued a joint alert on Siemens S7 series programmable logic controllers, reporting attackers using AI-generated exploitation scripts disguised as legitimate monitoring tools across water, food, energy, chemical, manufacturing and commercial facilities. That is the pattern to plan against, and note what it is: AI used to mass-produce and disguise tooling for known targets, not AI discovering novel flaws in a controller. Michael Garcia of Monument Policy Advocacy, a former CISA official, and Brian Proctor, CEO of Frenos, both commented on the alert. Taken with Forescout’s cost measurement, a consistent picture emerges across three independent sources this week: the volume, speed and disguise of attack tooling are improving quickly; the ability to find genuinely new ways into industrial equipment is not, yet. Plan detection and exposure reduction for the first, and do not let the second become an argument for delay.

Sources: Industrial Cyber · CyberScoop

8. The patch desk: seven ICS advisories across two releases, and one numbering trap

CISA · September 1 and 3, 2026

CISA issued two ICS advisory batches this week, on September 1 and September 3. Seven of them belong on a plant-floor patch desk, and three are Rockwell Automation. ICSA-26-244-01, RSLinx Classic, carries four denial-of-service flaws: CVE-2026-9621, an integer overflow (CWE-190) rated 8.6 on CVSS v3.1 and 9.2 on v4.0; CVE-2026-9622, an integer underflow (CWE-191) at the same scores; CVE-2026-9624, also CWE-191, at 7.5 and 8.7; and CVE-2026-9625, a buffer overflow (CWE-120), at 7.5 and 8.7. Versions 4.50 and earlier are affected, and Rockwell’s advisory gives 4.60 as the corrected release. A single crafted CIP packet crashes the service, and it must then be restarted by hand — which on a site where RSLinx is the data path between the control network and everything above it means the operator loses visibility until someone walks to the machine.

ICSA-26-244-03, the Logix Platform advisory, is the one carrying a CVE, and it is easy to confuse with its same-day neighbour. CVE-2026-9637 is a memory-boundary flaw (CWE-119) rated 7.5 on CVSS v3.1 and 8.7 on v4.0. It affects ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380 at V33 and earlier, V34.011–V34.014, V35.011–V35.013 and V36.011–V36.012, with fixes in V34.015, V35.014, V36.013 and V37.011. Defective input validation during Common Industrial Protocol message handling lets a crafted network message induce a major non-recoverable fault, which requires a physical power cycle to clear. Separately and on the same day, ICSA-26-244-05 covers a wider Rockwell product list — ControlLogix, CompactLogix including the 5480, GuardLogix and Compact GuardLogix — and describes a crafted-data denial of service across those families. The two advisories are distinct despite the overlapping product names, and CVE-2026-9637 belongs to the Logix Platform advisory, not to this one. If your change record cites a single Rockwell Logix advisory this week, check which.

The September 3 batch spreads wider than Rockwell. ICSA-26-246-01 covers CVE-2026-77477 in OPC Foundation UA LocalDiscoveryServer installers before 1.04.420; it is not remotely exploitable, requires an attacker able to launch an elevated installer and interact with the keyboard, and has no known public exploitation — update to 1.04.420 or later and move on. ICSA-26-246-02 is more urgent: CVE-2026-75925 in the IXON VPN Client, a CRLF-injection flaw rated 9.6 on CVSS v3.1, affecting versions before 1.4.7, where unauthenticated attackers can modify configuration files used by privileged processes and potentially reach root or SYSTEM. Remote-access clients installed on engineering laptops are exactly the software nobody inventories; find yours. ICSA-26-246-06 covers CVE-2026-77393 in Inductive Automation Ignition, CVSS v3 8.8, a permissions-default problem (CWE-269/276) in which the Gateway’s “Create Project Role(s)” setting shipped blank, so any authenticated user able to execute gateway scripts could create projects; 8.1.53 and earlier are affected, the 8.3 line is unaffected, and 8.1.54 restricts project creation to Designer sessions. And ICSA-26-246-07 is the highest-scoring of the set: CVE-2026-78012 in the Pyramid Solutions NetStaX EtherNet/IP stack, a stack-based buffer overflow (CWE-121) at 9.8 on CVSS v3.1 and 9.3 on v4.0, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, in versions before 5.6.1, where a large Class 3 explicit-message request can exceed the application-side receive buffer without generating any error or warning.

Two of these deserve a note beyond the patch list. The NetStaX finding is a protocol-stack vulnerability in licensed OEM software, which means the affected inventory is not “devices from Pyramid Solutions” but every device from every vendor that embedded this stack — and your asset register almost certainly does not record that. Ask your EtherNet/IP device vendors directly whether they ship it, and treat a slow answer as a finding in its own right. The RSLinx and Logix advisories share a pattern worth naming: all of them are denial of service reachable by a crafted CIP message, and none of them requires credentials. Any environment where an untrusted network segment can send CIP traffic to a controller or to an RSLinx host is one crafted packet away from a manual restart or a physical power cycle. That is an architecture finding, and it will still be true after these particular CVEs are patched.

Sources: CISA (RSLinx Classic) · CISA (Logix Platform) · CISA (ControlLogix / CompactLogix / GuardLogix) · CISA (OPC UA LDS) · CISA (IXON VPN Client) · CISA (Inductive Automation Ignition) · CISA (Pyramid Solutions NetStaX)

9. Sector round-up: a new Coast Guard office, ransomware in food and agriculture, and one Forrester Wave announced twice

SecurityWeek · Industrial Cyber · Dragos · Claroty · August 18 – September 4, 2026

The US Coast Guard has established an Office of Maritime Cybersecurity Policy, designated CG-MCP, under the Director of Inspections and Compliance. Its mandate is to act as the central authority for cybersecurity policy governing the Marine Transportation System, to serve as the primary liaison with industry and government, and to develop domestic policy, contribute to international standards and direct compliance strategy. The scope is roughly 360 commercial sea and river ports in the United States, and Rear Adm. Robert C. Compher, Assistant Commandant for Prevention Policy, is the named official. The office follows a February 2025 GAO report that identified shortcomings in the Coast Guard’s cyber approach to the MTS. It arrives alongside two Dragos pieces on what MTSA compliance actually asks of an operator: the routine-maintenance requirements at 33 CFR 101.650(e)(3)(i) through (v) — patch Known Exploited Vulnerabilities or document compensating controls, run a process for publicly submitted vulnerabilities, share threat and vulnerability information, eliminate direct internet exposure of OT, and restrict OT internet connectivity — and the parallel resilience requirement. The line from the first of those is the one to put in a compliance file: “‘We are working on a plan to patch’ is not a compensating control.”

The Food and Ag-ISAC, with the IT-ISAC, published “State of the Threat: Food and Agriculture Sector Cyber Trends”, and its numbers are the clearest sector trend line published this week: 227 ransomware incidents in food and agriculture through July 2026, up 62% from 140 in the same period of 2025, against an all-sector total of 4,272 successful attacks, up 22.7% year on year. Qilin leads the groups active against the sector with 47 incidents, followed by The Gentlemen at 31 and Akira at 14. The report tracks more than 330 adversaries, records ClickFix social engineering up 108% in the first half of 2026, and notes CVE disclosures on pace for roughly 66,000 in 2026, 46.3% above projection. It also names China, Russia — including the FSB Center 16-linked cluster tracked as Berserk Bear, Energetic Bear, Crouching Yeti and Dragonfly — Iran and North Korea as nation-state actors of concern to the sector. On the incident side, Boston Scientific is still recovering from an intrusion detected on August 25 in its on-premises IT systems and disclosed the following day. The global network outage disrupted manufacturing, customer order processing and shipping; implanted cardiac rhythm management devices were unaffected, though remote activations for some cardiac monitors were disrupted. CrowdStrike was engaged, no group has claimed responsibility, no financial figures have been disclosed, and partial shipments were expected to resume in the week beginning August 31. It is the familiar shape of a manufacturing incident: the control system stayed healthy and the company still could not ship.

On the market side, two vendor posts this week announce the same document. The Forrester Wave for Operational Technology Security Solutions, Q3 2026, published September 1, named both Dragos and Claroty as Leaders; Dragos reports the highest possible score in eight criteria, Claroty in nine, and neither post mentions the other. The Dragos post is worth flagging for a second reason: its on-page headline reads as thought leadership about the future of xOT cybersecurity, but it is a placement announcement written by a product marketing lead. Read both as positioning, and go to the Wave itself if you are running a selection. Around them, Cognizant and CrowdStrike expanded a partnership dating from 2025 into Cognizant Cybersecurity for Operational Technology, built on CrowdStrike Falcon for XIoT, with Vishal Salvi of Cognizant and Daniel Bernard of CrowdStrike fronting it; Marlink expanded its own OT security capabilities for connected maritime and industrial systems; and F6, a Moscow-based cybersecurity firm, reported that manufacturing is the top cyberattack target for 2026 and that 80% of companies including critical information infrastructure facilities face a shortage of qualified information security staff, with vacancies taking months to fill and a 24/7 team taking twelve to eighteen months to build from scratch. F6 publishes no sample size or geography for that figure, so treat it as the firm’s claim rather than a sector statistic — the staffing constraint it describes is real enough in Western plants too, but this is not the evidence for it.

Sources: SecurityWeek (Coast Guard) · Dragos (MTSA maintenance) · Dragos (MTSA resilience) · Industrial Cyber (Food and Ag-ISAC) · SecurityWeek (Boston Scientific) · Dragos (Forrester Wave) · Claroty (Forrester Wave) · Industrial Cyber (Cognizant/CrowdStrike) · Industrial Cyber (Marlink) · Industrial Cyber (F6)