The IT and operational technology convergence market is growing rapidly — with estimates projecting $151 billion by 2030.
But as that convergence accelerates, so do the risks. Years into the push to connect digital and physical systems, many of the technologies running essential services like electrical grids, water systems and healthcare facilities are still deployed insecurely.
What’s more, said cyber experts from across government and industry during a panel discussion for Federal News Network’s Cyber Leaders Exchange 2026, attackers are increasingly taking actions that can disrupt essential services, impact public safety and create real-world consequences.
“In years prior, we saw threat actors in cyber activity conduct actions such as defacement of websites or defacement of human machine interfaces. But in the past year, we have seen threat actors take more advanced actions,” said Rina Rakipi, operations coordinator for threat hunting at the Cybersecurity and Infrastructure Security Agency.
“This includes modifying programmable logic controller code, bypassing safety systems, tampering with sequencing routines of these devices within plants running critical functions and disabling alarms to essentially evade their ability for detections,” she continued. “These changes are representing true operational sabotage.”
Bad actors with more capable tools
In part, that’s because bad actors now have a higher risk appetite than they did five, 10 or 15 years ago, said Leo Taddeo, CEO of AppGate.
“Fifteen years ago, the China adversary, the Russia adversary, the Iran adversary would probe or perhaps do some reconnaissance. Now we are seeing actual prepositioning of potential adverse effects on critical infrastructure from our adversaries,” Taddeo said.
In addition, what was already a difficult problem is now being enabled by frontier Mythos-type, artificial intelligence agents and agentic AI cyber capabilities, giving even poorly funded adversaries much greater capabilities.
At the same time, as external threats are becoming more sophisticated, organizations still struggle to fully understand the risks within many OT environments.
“External threats are very real,” said Scott Bowman, technical lead for cyber-physical systems at the Idaho National Laboratory. “But I think one of the biggest threats is that our organizations that do this work very well day to day, they may not have a complete understanding of the entire risk across their operations. I feel like those silos of communication and knowledge — and tasks and skills not being shared — is one of the largest threats internally that may give us a false sense of security.”
For example, he noted that often the engineering teams that deploy these systems often aren’t trained to understand them from a cybersecurity standpoint. Meanwhile, the cybersecurity teams may not understand the significance of the controllers, the human-machine interfaces or the supervisory control and data acquisition (SCADA) systems that are critical to critical infrastructure operations.
“They can sometimes be oblivious to even the main functions of their operation, whether it’s an electric utility, whether it’s a water plant. They may not even understand the significance of what their organization does so that they know what needs to be protected,” Bowman said.
Tackling cyber risks on the healthcare front
For healthcare organizations, the IT and OT convergence challenge is “most visceral,” said Brian Mazanec, deputy assistant secretary and director of the Center for Preparedness at the Department of Health and Human Services.
Hospitals rely on thousands of internet-facing systems and connected devices, with each device creating a potential attack surface. In 2025, the average hospital had roughly 26,000 connected devices, with more than half of those devices having critical unpatched risks.
“In healthcare, OT and IT haven’t just converged. It’s really a compromised building system and compromised medical record that can both stop patient care and threaten patient health and safety, which is our paramount concern,” Mazanec said.
And organizations have to look beyond their own networks to ensure security of their systems. “The perimeter isn’t internal anymore,” Mazanec said. The 2024 Change Healthcare cyberattack that disrupted healthcare operations nationwide and affected millions of patients, showed how a single compromised vendor can impact the entire healthcare sector.
“The Change Healthcare cyberattack really showed us the stakes there were with that third-party risk. This is a very real and present threat that we are focused on,” Mazanec said. “From our view on the threat generally, it has shifted from really ‘protect my building, protect this hospital’ to really understanding an interconnected ecosystem, third-party risk, OT-IT risk — and a lot of the answer is really architectural.”
Information sharing critical to cyber success
This interconnectedness makes information sharing critical to preventing a widespread cyberattack, but the tight-lipped culture, stigma associated with being breached, as well as concerns about legal repercussions continue to hinder information sharing within the critical infrastructure community.
“We still have that being the victim of cyberattack, cybercrime, ransomware attack — there is still shame, there is reluctance to talk about it. There is reluctance to share that information. There is fear about sharing that information,” said Mischa Beckett, federal civilian deputy chief information security officer and director of cyber threat intelligence at General Dynamics Information Technology. “So, there are organizational and some societal barriers to sharing, as well as technical barriers.”
Information sharing creates litigation exposure too. If a company is breached, Taddeo said, “there is a platoon of lawyers out to make sure that you suffer the consequences.”
There is one industry, however, where findings and lessons learned from a single incident inform changes to procedures, technology and regulations across the entire industry: aviation. That is due to independent bodies such as the National Transportation Safety Board.
“Because you have an agency like the NTSB that, when it finds the cause of the accident, it promulgates the remedy across the industry, and everyone is compelled to take action to correct it,” Taddeo said.
“You don’t have the same type of activity or agency within the U.S. government, where — if we find a breach and the cause of the breach — everybody complies with the remedy. Everyone is basically on their own, trying to do their best. That is going to be the case for a long time. We do not see any pathway where we are going to have the kind of regulatory power over cyber that we do with the aviation industry,” he said.
Without that type of centralized mechanism, the cybersecurity community has to rely heavily on collaboration and building trust, while ensuring that cybersecurity is built into system architectures from the beginning.
“It is about getting the word out, sharing as much of the information that we can, building those trust relationships and then getting into the work process so that security becomes part of the day-to-day activity,” Taddeo said. “That is really the next level of cyber resilience.”
Discover more articles and videos now on our Cyber Leaders Exchange 2026 event page.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.