Operational Technology cyber security applies to medicines just as much as it applies to meat in fridges and Dr Richard Horne of the National Cyber Security Centre has issued a stark warning: years of underinvestment in operational technology have left businesses exposed to cyberattacks, with AI now making vulnerabilities easier for adversaries to exploit.
Dr Richard Horne, head of the NCSC, has highlighted the extent to which organisations across the UK depend on technology that has not received the investment required to keep it secure.
His warning extends beyond conventional IT systems to Operational Technology (OT) – the technology responsible for controlling physical equipment and processes across industry and essential services. From refrigeration and water infrastructure to the complex operational systems underpinning industrial supply chains, OT plays a critical role in keeping businesses and essential services running.
Years of Underinvestment Have Left Critical Systems Exposed
According to Dr Horne, many organisations have continued operating ageing technology without adequately upgrading or securing it. Systems have remained in service beyond their intended lifespan, while insufficient separation from internet-connected networks has left critical infrastructure exposed to cyber threats.
These vulnerabilities are becoming increasingly concerning as artificial intelligence gives adversaries new capabilities to identify weaknesses more easily and the implications extend across all industries where technology is fundamental to maintaining operational continuity.
Cybersecurity Is a Leadership and Investment Priority
Dr Horne emphasised the importance of organisations reviewing the technology they rely upon and addressing vulnerabilities created by years of insufficient investment. Perhaps the most significant message from the NCSC is the need for business leaders to reconsider how they approach technology investment. Maintaining secure and capable operational systems may require substantial expenditure, but Dr Horne argues that organisations must recognise the essential contribution technology makes to business performance.
“It might require thinking less of technology as a cost to be minimised and more as something that powers your business.”
For industries heavily dependent on OT, the warning reinforces the importance of maintaining, renewing and securing the systems on which everyday operations depend. The NCSC’s message is unequivocal: organisations cannot rely solely on external warnings and intervention. Business leaders must take ownership of the technology risks within their operations and make informed investment decisions to address them.
This is where we come in…
Working in partnership with Siemens, we can tell you where your Operational Technology stands and how you score against international standards. We work with any industry and by systematically comparing your OT against defined international expectations and standards IEC 62443 and ISO27001 as well as local legislation, we’ll uncover where the risk is highest so you can prioritise action and investment.
Find out more about how can help you assess, prioritise and continuously manage your OT cyber security risk long after we’ve left.
