Colonial Pipeline. NotPetya. The Oldsmar water treatment hack. Ukraine's power grid blackouts. Triton/TRISIS at a Saudi petrochemical facility. Jaguar Land Rover ransomware. The list of high-profile OT cyberattacks grows every year — and with it, an industry assumption that these incidents require sophisticated adversaries exploiting novel vulnerabilities. That assumption is wrong, and the data proves it.This session presents a structured analysis of 23 major OT cyberattacks drawn from public incident reports, government advisories, forensic analyses, and security research published between 2014 and 2026. The analysis identifies the specific failure mode that enabled each breach. The finding is consistent and, once you see it, impossible to unsee: fewer than two of the 23 attacks involved a genuine zero-day exploit against a core OT system. The vast majority succeeded through one of three failure modes: (1) internet-exposed systems with known CVEs that remained unpatched, (2) stolen, default, or phishable credentials used to gain authorized-looking access, or (3) lateral movement through flat, unsegmented networks that allowed initial access to escalate into plant-wide compromise. The session walks through selected case studies in detail — showing exactly how each failure mode played out in practice, what defenders saw (or didn’t see) at each stage, and how the attack would have been interrupted if the relevant control had been in place. It then addresses the uncomfortable question this analysis raises: if three controls had stopped virtually every major OT breach over the past decade, why are those breaches still happening? The answer has as much to do with organizational decision-making, regulatory timing, and budget cycles as it does with technical capability — and this session addresses all three dimensions.
KEY AUDIENCE TAKEAWAYS
-Review the specific failure modes (exposed systems, stolen credentials, lateral movement) that enabled 23 documented OT breaches — and understand why novel zero-days were rarely the root cause
-Identify which of the three recurring failure modes is most likely to be present in your own environment based on asset profile and architecture
-Understand the organizational and budgetary dynamics that allow known, preventable failure modes to persist in well-resourced OT environments
-Apply the case study framework to communicate breach risk to leadership using documented, real-world outcomes rather than hypothetical threat scenarios
-Leave with a prioritized defensive checklist based on frequency and impact of each failure mode across the 23-breach dataset