In the world of operational technology (OT) and industrial control systems (ICS), threats aren’t all created equal. Each type of attacker brings different motivations, tools, and capabilities — and together they form what we call the risk curve.
The risk curve helps us understand how the likelihood and consequence of cyberattacks change as threat actor capability evolves.
How the Risk Curve Works
• As capability increases, the likelihood of an attack generally decreases.
• As capability increases, the consequence of an attack increases.
Why?
More skilled actors invest significant time and resources in reconnaissance, exploit development, and operational discipline. They conduct passive and active enumeration of targets, learning network behaviors, asset dependencies, and safety constraints. Building custom toolkits or zero-day exploits takes months or years — meaning advanced attackers strike less often.
But when they do, the results are far more severe. Advanced threat actors can trigger wide-scale process disruption, damage physical assets, or even cause cascading safety effects. In OT and ICS environments, those consequences jump quickly from the digital to the real world — production loss, environmental harm, or human safety risks.
The Three Groups of Threat Actors
• Group 1: Everyone — “Script Kiddies” and Opportunists
: Actors with minimal skills who rely on public tools or leaked exploit kits. Their attacks are frequent and noisy but usually low-impact — scanning exposed HMIs or attempting weak default passwords. Consequences are often limited to nuisance-level disruptions.
• Group 2: Organized Groups
: These are cybercriminal collectives or ideologically aligned organizations that conduct targeted, profit-driven attacks. They may use known ICS vulnerabilities, commodity malware, or adapted tools. While less frequent than Group 1, their attacks can result in operational downtime, data theft, or financial loss — moderate consequence, medium likelihood.
• Group 3: Nation-State or State-Sponsored Actors
: The pinnacle of capability and consequence. These adversaries invest in custom ICS malware, covert persistence, and sophisticated delivery methods. Attacks from this group are rare but strategically devastating — think production outages, physical damage to assets, or deliberate targeting of critical infrastructure. Low likelihood, extremely high consequence.
Why It Matters for OT/ICS Defenders
Understanding the balance between likelihood and consequence across the risk curve helps organizations apply their defenses efficiently.
Most day-to-day alerts will come from low-skill attackers (high likelihood, low consequence), but your preparedness must scale up to anticipate those rare, high-consequence events driven by top-tier adversaries. Effective OT security programs build layered defenses, combining continuous monitoring and basic hygiene for lower-tier threats with segmentation, detection engineering, and incident response playbooks for advanced ones.