Internet-connected devices are the most frequently cited cyberattack target among critical infrastructure organisations in sector research from Thales. In the company’s 2026 Data Threat Report analysis, 46% of critical infrastructure respondents identified internet-of-things (IoT) technology, compared with 44% for cloud storage and 40% for cloud infrastructure. The organisations surveyed operate across energy, utilities, telecommunications, and transportation, where digital services can support equipment monitoring, network operation, and the delivery of essential services.
The research was conducted by S&P Global Market Intelligence’s 451 Research and commissioned by Thales. Its wider survey involved more than 3,100 respondents in twenty countries; the figures reported for critical infrastructure relate to that sector rather than the full cross-industry sample. They describe attack targets identified by respondents, not the measured rate of successful intrusions through each technology. The findings also highlight the challenge of protecting interconnected information systems and industrial operations with different availability requirements.
IoT equipment often collects operating information from remote installations and transmits it to monitoring platforms. Sensors can track asset condition, environmental conditions, or equipment status, while applications may make the resulting data accessible to maintenance and operations teams. Every connection introduces an identity, update, and access-management requirement. The operational effect of compromising a particular device depends on the permissions and network routes available to it, especially where monitoring systems interact with equipment used to control a physical process.
Industrial control systems require particular attention because availability and safe operation may depend on equipment remaining responsive during a network incident. Monitoring services can sometimes be separated from command paths, reducing the functions accessible through an exposed sensor or gateway. Where remote control, diagnostics, or maintenance are necessary, the integration needs to be designed around the task that each account or connected system is authorised to perform.
Cloud storage and cloud infrastructure rank immediately behind IoT in the sector findings. Essential-service operators may use cloud systems to store maintenance histories, exchange engineering documents, and support applications across multiple sites. The operational consequence of an incident depends on which services use the data and whether a cloud-hosted application is connected to a control or dispatch workflow. This makes the permissions between enterprise applications, remote maintenance services, and plant networks a relevant part of the system design.
Credential misuse is a prominent concern across the organisations surveyed. Thales reports that 66% of critical infrastructure respondents have seen an increase in credential theft and misappropriated secrets. Stolen passwords, application tokens and other authenticators may let an intruder appear to be an authorised user or service. Preventive controls need to distinguish between human and machine identities, and ensure that access granted for maintenance, monitoring or data exchange remains limited to the functions required.
Remote support illustrates how account security intersects with industrial maintenance. An engineering contractor may need temporary access to diagnose a machine, update an application, or review operating logs. Access limited to the necessary systems and duration reduces the number of functions available through a compromised account. Network segmentation, strong authentication, session recording, and appropriate management of service credentials can be combined so a legitimate support connection does not automatically provide unrestricted movement across an industrial site.
Artificial intelligence creates another security consideration. Among critical infrastructure respondents, 68% identified the speed of change in AI ecosystems as their leading AI-related risk. Automated tools can alter how attacks are prepared and adapted, while organisations deploying AI in their own operations must understand the access and data available to those tools. The survey finding concerns the pace of technological change and perceived risk, rather than a count of cyber incidents involving AI.
Mike Sewart, chief technology officer at Thales in the UK, said: “The challenge is one of pace as much as protection. Threats are evolving rapidly, particularly as AI makes it easier to automate and adapt attacks.” He linked cyber resilience to the ability of essential services to continue operating when a system fails or an intrusion succeeds, rather than treating the absence of an attack as the sole measure of security.
Operational continuity depends on the functions available when connectivity, identity services, or central management systems are disrupted. Some industrial assets can continue under local control, while others depend on remote supervision or coordinated dispatch. Mapping those dependencies establishes which operating functions need an independent fallback, the conditions for a safe shutdown, and the information required to restore normal service. The appropriate arrangements vary with the equipment, network architecture, and safety requirements at each site.
Thales operates a Cyber Resilience Lab in Ebbw Vale, Wales, where control-system environments can be exposed to simulated cyberattacks away from live industrial operations. Such exercises provide a way to test configurations, incident detection, communications, and recovery procedures together. The results can inform changes to access controls and response plans before those measures are used on operational infrastructure.
The sector results bring connected devices, cloud environments, and access credentials into the same operational security picture. Organisations can use an inventory of devices and service accounts to establish which connections reach critical functions, then test how systems behave when individual services fail. Thales’ survey records how security professionals perceive changing attack exposure; the resulting equipment and continuity decisions must still be based on the architecture of each installation.
