CISA’s threat hunters have a rare view across cyber incidents affecting critical infrastructure organizations throughout the United States. Recent activity, including more than 100 incidents observed during a single month over the summer, offers an urgent look at how adversaries are gaining access, where defensive controls are failing, and which recurring weaknesses continue to place essential operations at risk.

In this featured session, CISA’s threat-hunting team will share insights from recent engagements across critical infrastructure environments. Drawing on anonymized, real-world observations, the discussion will examine common intrusion paths, attacker behaviors, visibility gaps, configuration weaknesses, and missed opportunities for earlier detection.

More importantly, the session will translate those findings into practical lessons for owners, operators, and OT cybersecurity teams. Attendees will learn what CISA’s hunters are seeing now, how organizations can identify similar exposure within their own environments, and which defensive actions can make the greatest difference before suspicious activity escalates into operational disruption.