The Hidden Blindspot in Industrial Cyberattacks, and How Fake Devices Help Fill It
When hackers cross from a company's office network into the systems that run physical equipment, the trail goes cold. A maturing technique called cyber deception is starting to change that.
Key points
- Industrial control systems, the computers that operate physical equipment like power grids and water plants, generate almost no useful security records for investigators to follow after an attack.
- Ukraine's electricity grid was hit in a landmark IT-to-OT attack nearly twelve years ago, and the forensic blind spot it exposed still exists in most industrial environments today.
- Cyber deception, planting fake devices and credentials that only an attacker would touch, produces high-confidence alerts precisely where traditional security tools go silent.
- A single interaction with a decoy, whether a fake engineering workstation or a simulated industrial controller, tells a defender that something unexpected is happening, with enough confidence to act.
Nearly twelve years ago, parts of Ukraine's electricity grid went dark. Hackers had spent months inside the utility's office computers before quietly crossing into the industrial control systems, the specialised computers that open and close switches on the grid. When investigators arrived, they faced a wall of silence: the industrial half of the network had recorded almost nothing.
That silence isn't a quirk of one incident. It's the normal condition of what the industry calls OT, short for operational technology, meaning the hardware and software that controls physical processes: power generation, water treatment, manufacturing lines, building systems. OT was built to run reliably for decades, not to produce the security records that help investigators reconstruct an attack. Our coverage of more than 30 Minnesota water utilities knocked offline in late July showed the same forensic gap in practice: automated controls failed, but attributing exactly how the attackers moved proved slow.
Why do industrial systems leave investigators with almost nothing to work with?
In a regular office IT investigation, security teams can answer a long list of questions: who logged in, from where, which software ran. Industrial environments make most of those questions impossible to answer.
A programmable logic controller (PLC), a small ruggedised computer that controls machinery on a factory floor or inside a power station, won't record that an attacker queried it. A remote terminal unit (RTU), a similar device used to monitor remote infrastructure, produces no meaningful login history. Cameras and building management systems typically generate no security records at all.
When logs do exist, they're often stored only on the local device, overwritten within hours, or written in formats that security software can't read. A SIEM, which stands for security information and event management system and is essentially software that collects and cross-references security records from across a network, cannot correlate events that were never collected.
How does cyber deception help where cameras and sensors stay silent?
Cyber deception gives defenders something to detect against, even where real devices record nothing. The idea is to scatter convincing fakes across both the office network and the industrial network: a decoy engineering workstation, a simulated PLC, a fake network diagram, a set of credentials that exist only as bait.
Legitimate staff have no reason to touch these decoys. If anything does, it's almost certainly an attacker exploring the network.
That distinction matters enormously. A conventional alert might flag thousands of suspicious events a day, and analysts often can't tell which ones are real. A deception alert is different. If a fake set of credentials is used, or a simulated industrial controller is queried from an unexpected machine, the defender knows something real is happening and can act quickly.
This approach also captures the crossing point the Ukraine attackers exploited. A fake credential stolen from an office computer, then used to open a decoy industrial document, then used to reach a simulated controller: each step is a data point, and together they draw a picture of the attacker's route through both environments.
| Event type | What a real device records | What a decoy records |
|---|---|---|
| PLC queried by attacker | Nothing | Immediate alert with source details |
| Engineering workstation accessed | Possibly nothing, often incomplete | Full access log, high-confidence alert |
| Fake credential used | Not applicable | Alert plus attacker's network location |
| OT network diagram opened | Nothing | File-open event with timestamp |
Scott Hawk, writing in an opinion piece this article draws from, argues that deception doesn't replace every other security tool. It covers the spaces those tools can't reach, without needing every industrial device to behave like a modern computer.
Should you worry if your organisation runs industrial equipment?
The practical starting point is accepting that industrial systems won't protect themselves the way office computers might. Assume that if an attacker reaches your operational network, you'll have very little evidence unless you planned for it in advance.
That planning gap is measurable. A Threat Vectr study from 30 July found roughly 32,000 data centre infrastructure devices sitting just one network hop from the open internet, putting cooling, power and fire systems within easier reach of attackers than most operators realise. Deception layers are one of the few controls that work regardless of whether the underlying device can be patched or upgraded.
Talk to your security team about whether deception tools are in place on both sides of the boundary between your office network and your operational systems. The Ukraine incident showed that attackers are patient: months in the office network before touching anything industrial. That preparation time is also the window to catch them, if the right traps are already set.
