Growing use of social engineering capabilities by cyber adversaries across OT (operational technology) environments is driving a new class of high-consequence threats that threaten the stability of critical systems. Deception, technical compromise, and human manipulation are being combined in ways that abuse the traditional trust models on which industrial systems rely, leaving asset owners and operators to face new and emerging threats and attacks. While conventional IT breaches typically lead to data loss or financial fraud, a successful social engineering attack across OT installations has the potential to shut down production, interrupt critical services, and even threaten public safety.
With the expanding IT/OT footprint, the attack surface is increasingly providing attackers additional opportunities to compromise targets by stealing credentials, impersonating trusted insiders, and moving laterally from one system to another inside the network. AI-driven phishing, voice cloning, and deepfake-enabled pretexting are lowering the barrier to entry, enabling cyber adversaries to deploy powerful tools that have the potential to erode the reliability of human judgment across critical infrastructure installations.
Microsoft security researchers warn that a single compromise, say via a contractor’s infected laptop, can breach previously isolated OT systems, turning them into a breach gateway.
While phishing and identity theft are now common access tools, the impact in OT environments is much worse. One compromised identity can result in total stop-work, equipment destruction, or worse. The FBI warns that such breaches can have operational, economic, societal, and even national security consequences.
AI-driven deception is rapidly reshaping the social engineering landscape. Attackers are using voice cloning and deepfake technology to impersonate executives with unnerving accuracy. Qantas recently fell victim to a similar scheme, where an AI-powered ‘vishing’ attack compromised the personal data of up to six million customers. These incidents highlight how artificial intelligence has lowered the barrier for convincing, high-impact fraud.
Across OT environments, such as energy distribution or manufacturing plants, the impact of social engineering goes way beyond stolen funds or data. This means that a single phishing email or stolen credential can lead to operational disruptions, downtime for weeks, and safety incidents that extend beyond the digital world. Traditional awareness training has not proven effective against adversaries with scalable AI-enabled capabilities that outstrip human judgment in critical environments.
Critical infrastructure operators are reacting by re-evaluating the human layer of security. The future of these critical systems calls for insider threat monitoring, OT-tailored identity and access management, and resilience-focused security cultures. Clearly, in the face of evolving social engineering techniques, the human factor is still the weakest link and the only solution.
Industrial OT faces new wave of social engineering attacks
Social engineering and phishing campaigns are becoming more sophisticated, increasingly tailored to exploit human and procedural weaknesses of industrial OT environments. Industrial Cyber spoke with industry experts to examine how attackers are adapting their tactics in these settings and what countermeasures critical infrastructure operators are prioritizing in response.
Paul Smith, director of Honeywell operational technology cybersecurity engineering, said that as deepfake audio and video are starting to take shape, “we can only assume that these will trickle down into critical infrastructure in the form of internal urgent requests or compromised supply chain communications. As for now, we haven’t seen or heard of these types of techniques taking place.”
“An interesting tactic that I have seen would be internal post-RIF announcements, a spoofed HR email sending out anonymous employee feedback surveys,” Smith described to Industrial Cyber. “This exploits the vulnerable nature of the disgruntled employee who wants to be heard. Implementing email security gateways and AI threat detection to filter out email spoofing, lookalike domains, and malicious attachments would be a tooling recommendation. Security awareness training is still paramount, as we are the last line of defense to mitigating ‘click compromises.’”
Detailed information about industrial projects, supplier relationships, and personnel are often publicly available, especially in sectors like energy and utilities, Neelima Rustagi, vice president and general manager of ServiceNow technology workflow solutions, told Industrial Cyber. “Attackers can use this information to create highly plausible emails, text messages, and phone scripts. They can also use information about production schedules and shift changes to pick moments when their targets are likely to be too busy to recognize suspicious communication.”
Rustagi observed that social engineering attacks depend on catching employees off guard, and this is often easier in OT settings due to low levels of cyber awareness, so cybersecurity training is essential. “Operators are also developing OT-specific incident response playbooks and implementing stricter third-party access protocols. The goal is to make social engineering attempts more visible and less likely to succeed in high-stakes, high-consequence environments.”
“Threat actors are increasingly leveraging AI and generative AI to supercharge social engineering campaigns,” Marco Pereira, global head of cybersecurity, cloud infrastructure services at Capgemini, told Industrial Cyber. “By analysing vast amounts of publicly available data, such as social media posts, blogs, and YouTube content, they can craft highly personalized and convincing spear phishing messages. These tools also enable the creation of realistic voice and video deepfakes, making impersonation attacks more credible and harder to detect.”
Cam Cullen, CMO of BlastWave, told Industrial Cyber that attackers are leveraging IT/OT convergence and the human factor, exploiting credentials as a primary attack vector. “They’re using highly targeted phishing emails and social engineering to gain a foothold in the less-secure IT network before laterally moving to the more critical OT systems.”
He added that asset operators are prioritizing zero trust to prevent this rather than traditional firewall protection, removing implicit trust and enforcing least privilege access. “This includes granular network segmentation and applying MFA everywhere, especially for access to legacy OT devices. This approach contains threats and limits lateral movement, making it harder for attackers to cause real damage.”
Phishing and credential theft escalate as IT and OT systems integrate
As IT and OT systems grow more interconnected, the executives assess how this convergence expands the attack surface for phishing, impersonation, and credential theft. They also weigh whether traditional IT-focused defenses are enough or if new approaches are emerging to address the challenge.
Smith noted that as IT and OT systems become more interconnected, this convergence opens the door to introducing a ‘trust debt,’ as outsourcing has been a de facto practice for IT support. “This practice of providing third parties access without full control over their behavior or security posture will open dangerous backdoors for phishing, credential abuse, and lateral movement. If not tightly governed, outsourced support becomes the attacker’s easiest entry point.”
He further mentioned that tightly controlled access is critical, with the ‘Who, What, When, and How’ being managed closely. “Introducing ‘JIT,’ Just-in-Time access to only grant access when it’s needed, for the minimum time required, is a new approach emerging in the OT environment. Other techniques, such as time-boxed credentials to set access expiration automatically, are starting to take shape to address the IT traditional approach of granting blanket-type administrative access,” he added.
ServiceNow’s Rustagi observed that as IT and OT systems converge, social engineering and phishing attacks gain new entry points, including OT users with limited cyber training and cross-domain access credentials. “Traditional IT-centric defenses like email filters and MFA are still necessary, but in converged environments, companies also need OT-specific data points.”
She added that defenses must now integrate IT-grade identity controls with OT-aware context, ensuring access is not only verified, but also appropriate for the operational situation.
“OT environments, traditionally isolated and less frequently updated than other environments, often lack the robust identity and access controls found in IT systems,” Pereira said. “When IT and OT systems converge, compromised IT credentials can be used to pivot into OT networks, where detection and response capabilities may be limited.”
Pereira added that traditional IT-centric defences are often insufficient in these hybrid environments. “However, new defensive approaches are emerging, including zero trust architecture extended to OT and IoT, behavioural analytics to detect anomalies across IT/OT boundaries, micro-segmentation to limit lateral movement, and identity-centric security with strong MFA and just-in-time access.”
IT/OT convergence creates a massive attack surface if not managed correctly, Cullen said, adding that an attacker can leverage a phishing attack on a traditional IT employee to gain a foothold, then move laterally into the previously isolated OT network. “Traditional IT defenses like firewalls and VPNs are no longer sufficient because they are easily bypassed with stolen credentials, known vulnerabilities, and most importantly, they don’t address the unique needs of OT.”
Social engineering in OT raises stakes with safety, operational risks
Unlike most IT breaches, social engineering attacks in OT environments can lead to serious operational disruptions and safety risks. The executives discuss the factors that amplify the severity of these incidents and why their impact often extends far beyond what is immediately visible.
“In OT, trust is the vulnerability. OT personnel often rely on explicit trust when reading through a work order, service ticket, or email that drives a technical task inside their environment,” according to Honeywell’s Smith. “A single socially engineered action can have physical, economic, and societal consequences. Unlike IT, where you can often ‘Reboot and Recover,’ OT compromises can ripple through entire industries and human safety is often on the line.”
Rustagi said that unlike IT breaches, where the fallout is financial or reputational, OT compromises have the potential to cause physical harm or environmental damage. “Fortunately, this is a rare occurrence. The more common outcome of an attack against OT is production downtime, which can be financially devastating—in some cases, causing losses of millions of dollars per day. Once an attacker has access to an OT network, they can typically move much more easily than in an IT network, due to the prevalence of older systems, default or shared passwords, and lack of cybersecurity technology,” she added.
“Social engineering attacks in OT environments can have disproportionately severe consequences due to the direct link between digital compromise and physical operations,” Pereira said. “Critical infrastructure is disrupted, production lines are halted, and human safety can be endangered. The true impact often extends beyond the immediate disruption, affecting supply chains, regulatory compliance, public trust, and even national security.”
He added that OT systems often control processes that cannot tolerate downtime, making them attractive targets for extortion or sabotage. “At the same time, many OT systems run on outdated software with limited security controls, making them more vulnerable once access is gained. They also often lack traditional monitoring tools, allowing attacks to persist undetected.”
Cullen noted that IT breaches often lead to data theft, while a successful OT attack can directly impact the physical world. “The impact of an attack is far-reaching because an OT breach can cause equipment damage, production shutdowns, and (most critically) threats to public safety and the environment. These consequences cascade beyond the immediate business, affecting communities and critical supply chains.”
Human factor drives new security approaches in industrial environments
The executives address how asset owners and industrial operators are rethinking human-layer risk, from awareness training and insider threat programs to identity and access management tailored for OT environments.
Smith said that asset owners and industrial operators are recalibrating their entire approach to human layer risk, recognizing that humans and not just machines are the soft underbelly of converged IT/OT environments. “They are shifting from compliance-based training and generic Identity and Access Management (IAM) to more contextual, risk-aware, and OT-specific human risk management strategies.”
He added that one of the industry topics that is currently being ‘watercooler shop-talked about’ is modernizing insider threat programs, as OT insider threats may not be malicious, but are often accidental enablement. “A mindset shift, Insiders are not just employees, but they are contractors, integrators, outsourced support staff, and anyone with hands on the system. An industry research institute is actively talking about performing an ‘Insider Threat’ evaluation to raise awareness.”
“Industrial operators are increasingly addressing human-layer risk with OT-specific strategies,” Rustagi evaluated. “These include cyber awareness programs tailored to specific operational roles and routines, and OT-specific vulnerability management solutions that prioritize security for the assets that are most critical for production.”
Capgemini’s Pereira identified that asset owners and industrial operators are moving beyond traditional awareness training toward more integrated, identity-centric strategies. “Recognizing that human error and insider threats remain top vectors for compromise, organizations are tailoring security awareness programs to OT-specific scenarios such as phishing attempts targeting control room staff or impersonation of trusted vendors. Insider threat programs are evolving to include behavioural monitoring and anomaly detection that account for both digital and physical access patterns.”
He added that IAM is being adapted for OT, where shared accounts, weak authentication, and lack of visibility persist as challenges. “Emerging approaches include zero trust architecture extended to OT and IoT, role-based access control (RBAC) aligned with operational roles and safety protocols, and multi-factor authentication (MFA) adapted for environments with limited connectivity or legacy systems.”
Cullen said asset owners need to face a critical truth that security awareness training alone is not enough. “While training is helpful, it must be part of a broader strategy that acknowledges the unique environment of OT. Asset owners are beginning to understand that human error is unavoidable and must be designed around in any cybersecurity solution.”
Deepfakes, AI phishing redefine social engineering in OT environments
With AI-driven phishing, voice cloning, and deepfake-enabled pretexting becoming more accessible, the executives focus on how the nature of social engineering threats is evolving over the next few years, especially for sectors like energy, water, and manufacturing.
Smith said that artificial intelligence continues to reshape nearly every facet of business and society, and it is also redefining how attackers exploit trust. “For sectors such as energy, water, and manufacturing, the rise of AI-driven phishing, voice cloning, and deepfake-enabled pretexting is ushering in a new era of cyber risk, one where the human layer becomes the most direct and dangerous target. Unlike typical IT breaches, these social engineering tactics have real-world consequences.”
He added that the potential impact of a single convincing voice call or spoofed video meeting grows exponentially. “Imagine a hydro facility technician, who has a predefined process and standard operating procedures for allowing remote connectivity to internal equipment, receiving a call that validates and adheres to all the procedural correctness to allow the remote user privileged access. Or a shift manager joining a Zoom call with someone who looks and sounds like a trusted vendor delivering a ‘critical’ patch. These aren’t hypothetical scenarios; they are the next wave of cyber-physical threats.”
“AI is transforming social engineering from mass phishing to personalized deception. Deepfakes and voice cloning allow attackers to impersonate supervisors, vendors, or emergency responders, and can put tremendous pressure on OT personnel,” according to Rustagi. “These threats are expected to increase as generative tools become more accessible.”
To stay ahead of the threat, she called upon operators to enhance their defenses with AI-driven capabilities of their own in areas including access control, anomaly and threat detection, and incident response.
Pereira evaluated that phishing campaigns will use generative AI to craft hyper-personalized messages based on real-time data from social media, professional networks, and public records.
“Voice cloning and deepfake-enabled pretexting will also allow attackers to convincingly impersonate executives, engineers, or trusted third parties, bypassing traditional verification methods and exploiting the trust inherent in OT environments,” according to Pereira. “Sectors like energy, water, and manufacturing are particularly vulnerable because of their reliance on human-machine interactions, legacy systems, and third-party contractors. The convergence of IT and OT further amplifies the risk, as attackers can use social engineering to gain initial access in IT and pivot into OT systems.”
“We’ll see highly personalized, scalable attacks using deepfakes and voice cloning that are nearly impossible for a human to detect,” Cullen said. “An engineer in a water treatment plant could get a deepfake video call from their ‘boss’ instructing them to make a critical change, or a deepfake voice call to a utility’s finance department could authorize a fraudulent wire transfer,” he concluded.
