During a chat with Sam Lambert, EMEA Channel Director at Gigamon we got his thoughts on cyber-physical resilience and he had so much insight to offer that we created a series of posts to discuss his thoughts, check out the second of the series:
When leaders hear “cybersecurity”, the first image is often a data centre, a laptop or a cloud platform. In a hybrid-conflict scenario, the more consequential target may be less visible: a programmable controller, a building-management system, a fleet-management platform, a remote maintenance connection or a sensor that quietly feeds an operational decision. These systems are not peripheral to the mission; they are part of the operational terrain.
IoT and OT environments are different from conventional IT. Their priorities are availability, safety, reliability and physical outcomes. A software update that is routine in an office may be unacceptable in a live industrial process. A device that cannot be taken offline may still be connected to a wider network. A legacy controller may be essential to operations but difficult to authenticate, patch or replace.
This creates a difficult security environment. Organisations may have thousands of connected assets, but lack a reliable answer to basic questions:
- What is deployed?
- Who owns it?
- What process or service does it support?
- What is it communicating with?
- What would happen if it stopped, changed behaviour or became a route into another system?
The risk is not limited to a dramatic takeover. Hybrid pressure can be quieter. It can involve reconnaissance, credential theft, manipulation of legitimate tools, disruption at a politically sensitive moment or a sequence of small actions that tests how an organisation responds.
ENISA’s threat-landscape work identifies geopolitics as a continuing driver of malicious cyber operations and highlights threats to availability, including distributed denial-of-service and ransomware. Its 2026 Cyber Europe exercise focused on the continuity of interconnected rail and maritime networks, including the challenge of integrating legacy OT with modern systems while preserving safety and reliability. As AI accelerates both attacker and defender activity, AI-driven applications, agents and automated systems also create additional communications paths and dependencies that need to be understood. ENISA Threat Landscape and Cyber Europe 2026
The strategic lesson is that visibility is not an administrative exercise. When combined with context, it becomes a form of operational intelligence that helps leaders distinguish normal complexity from an emerging operational threat.
A government or defence organisation does not need more data for its own sake. It needs independent evidence and context that explain operational change: a new connection between zones, unusual remote access, a controller communicating with an unexpected service, a device behaving outside its normal pattern or a dependency changing at the wrong time.
This requires a common view across IT, OT, facilities, physical security, intelligence and mission owners. It also requires restraint. Monitoring must be designed around safety, privacy, classification and the need to avoid disrupting sensitive environments.
Closing thought
IoT and OT are often described as the “attack surface”. That is incomplete. They are also part of the operational terrain. The organisations that understand this terrain will be better placed to protect services, preserve trust and maintain freedom of action.