All sectors operating critical infrastructure or industrial systems face exposure, but certain sectors concentrate the majority of threats—either because they are strategically sensitive or because their cyber maturity levels remain low.

  1. Energy (Electricity, Oil & Gas, Nuclear)

Why? National critical infrastructure, high societal dependency, primary targets for state-sponsored attacks.
Major incidents: Ukraine (2015, 2016), Colonial Pipeline (2021), refinery attacks.
Specific Risks: Massive power outages, production sabotage, energy supply disruption.

  1. Water & Wastewater Utilities

Why? Legacy systems, limited budgets, direct public health impact, growing exposure (remote SCADA operations).
Major incidents: Attempted water contamination in Oldsmar, Florida (2021), multiple ransomware attacks.
Specific Risks: Water contamination, service disruption, environmental damage.

  1. Manufacturing (Automotive, Food & Beverage, Chemicals, Pharmaceuticals)

Why? Automated production lines, heavy legacy systems, economic pressure (critical uptime).
Major incidents: Norsk Hydro (2019), JBS Foods (2021), ransomware attacks on Jaguar Land Rover (2025).
Specific Risks: Production line shutdowns (massive financial impact), IP theft, quality sabotage.

  1. Transportation (Rail, Aviation, Maritime, Metro Systems)

Why? Highly connected signaling and control systems, passenger safety at stake.
Major incidents: Deutsche Bahn cyberattack (2023), compromised metro systems.
Specific Risks: Accidents, mobility paralysis, massive economic impact.

  1. Healthcare (Hospitals, Pharmaceutical Manufacturing)

Why? Connected medical devices (MRI, CT scanners, infusion pumps), building management systems.
Major incidents: Hospital ransomware attacks (patient redirects, canceled surgeries).
Specific Risks: Human life endangerment, critical drug production halts.

Cross-Sector Trend : The convergence of IT and OT is accelerating across all sectors. Today, 70% of OT systems are now connected, and 22% of OT enterprises have already experienced a cyber incident in 2024. No sector is immune.