Dragos-OT-Cybersecurity-Report-A-Year-in-Review-2026.md

Dragos' 2026 OT/ICS Year-in-Review documents a sharp escalation in OT-focused adversary activity during 2025: three new tracked groups (AZURITE, PYROXENE, SYLVANITE), expansion and destructive operations by established actors (ELECTRUM, KAMACITE, VOLTZITE, BAUXITE), rapid weaponization of disclosed vulnerabilities, and a large surge in ransomware impacting thousands of industrial organizations. The report highlights adversaries actively mapping control loops and exfiltrating OT data, short exploit windows (median 24 days), pervasive visibility gaps in OT networks, and provides prioritized mitigations and hunting guidance emphasizing asset visibility, segmentation, secure remote access, and risk-based vulnerability management.