ENISA 2026 Threat Report: What Manufacturing OT Teams Should Act On
ENISA’s 2026 report puts manufacturing at 6.9% of recorded incidents. The useful response is to tighten remote access, patch ownership and recovery records.
ENISA published its Threat Landscape 2026 on 22 September 2026. The report analysed 8,257 incidents observed from January through December 2025.
Manufacturing Accounted for 6.9% of Recorded Incidents
Manufacturing represented 6.9% of affected organisations in ENISA’s dataset. Public administration, business services and transport ranked higher.
The percentage is not a plant-level probability. It does show that manufacturing remained a material target in the EU dataset.
The Access Path Matters More Than the Headline
DDoS accounted for 51.3% of recorded activity, while unauthorised access accounted for 39.5%. Where ENISA identified an intrusion vector for unauthorised access, 60.4% involved exploitation of a vulnerability.
ENISA also highlighted supply-chain attacks, third parties, cloud services and other digital dependencies. Those dependencies often sit outside the PLC program yet still affect production access.
Checks for OT and Automation Teams
- Inventory remote-access gateways, VPN concentrators and externally managed edge devices.
- Record firmware and patch ownership for each network appliance.
- Separate vendor access from permanent engineering workstation access.
- Keep offline backups of controller projects, HMI applications and network configurations.
- Test restoration paths before a production outage.
- Review third-party accounts when service work ends.
For implementation details, see Securing Remote PLC Access Beyond the VPN and IEC 62443 Explained.
Engineering Impact
The report does not justify replacing every controller or closing every remote connection. It supports tighter ownership of the systems that bridge IT, vendors and production networks.
Original source: ENISA, press release dated 22 September 2026, with the linked Threat Landscape 2026 report.