Unit 42 research reveals most OT attacks begin in IT. Learn how edge-driven defense stops threats early and turns dwell time into advantage.

Unit42 is a cybersecurity research team known for its  analysis of cyber threats, malware, and cyber attack trends. Through research reports, threat intelligence briefings, and data analysis, Unit42 offers insights into emerging cyber threats and adversary tactics. Readers can learn about threat detection methodologies, vulnerability trends, and cyber attack attribution to enhance their cybersecurity posture and protect their organizations from advanced cyber threats.

Unit 42

Joint research by Palo Alto Networks, Siemens, and Idaho National Laboratory reveals that ~70% of OT-impacting attacks originate in IT environments, with adversaries spending an average of 185 days in precursor activity before causing disruption. This extended dwell time, combined with predictable attacker behavior patterns, means defenders have more opportunity than commonly assumed. The key is shifting focus to the IT–OT network edge — the convergence point where early-stage attack signals (credential abuse, lateral movement, protocol misuse) are most detectable. The post advocates for an OT SecOps maturity model progressing from architectural defense through passive monitoring to active defense, and argues for IT–OT SOC convergence that preserves operational safety constraints while enabling coordinated early intervention.

Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security

Threats That Disrupt OT Operations Are Rarely OT-Centric

Predictable Adversary Behavior Creates a Window for Defense

From Passive Monitoring to Active Defense in OT Environments

IT–OT SOC Convergence Without Compromise