Threat landscape for industrial automation systems. Q1 2026
July 7, 2026 · Kaspersky (Securelist) · Severity: MEDIUM
In Q1 2026, the percentage of ICS computers with blocked malicious objects dropped to 19.6%, the lowest in three years, according to Kaspersky's report. Regional variations were significant, with Africa experiencing the highest rate (27.4%) and Northern Europe the lowest (9.1%). Southern Europe, Northern Europe, and Russia saw notable increases in attacks, particularly in internet and email threats, spyware, and phishing. Russia recorded a rise in threats from internet sources and email clients, with denylisted resources and spyware being the most prevalent. Biometric systems remained the most targeted industry (26.4%) due to internet access, email reliance, and weak cybersecurity controls. Manufacturing was the only sector with an increase (1.0 pp), driven by attacks in Western Europe, Northern Europe, and Russia. Kaspersky blocked malware from 10,052 families, with denylisted internet resources and AutoCAD malware seeing slight upticks. Malicious scripts and phishing pages remained the top threat category, highlighting persistent risks to industrial systems.
All threats
The percentage of ICS computers on which malicious objects were blocked continued to decrease, reaching 19.6% in Q1 2026. This is the lowest value in three years, and it is 1.4 times lower than in Q2 2023.
Percentage of ICS computers on which malicious objects were blocked, Q2 2023–Q1 2026
Regionally, the percentages ranged from 9.1% in Northern Europe to 27.4% in Africa.
Regions ranked by percentage of attacked ICS computers
The percentage of ICS computers on which malicious objects were blocked increased in five regions over the quarter, most notably in Southern Europe, Northern Europe, and Russia.
In Q1 2026, Southern Europe led the way in growth for internet and email threats. The region also saw the fastest growth in spyware, as well as malicious scripts and phishing pages.
In Russia, the percentage of ICS computers on which malicious objects were blocked exceeded the figures for the previous two quarters. Russia saw an increase in the percentage for threats from the internet, and a slight increase in the figure for threats from email clients (Russia is one of three regions where this figure did not decrease).
Among the threat categories, the greatest increases were observed in the percentages for denylisted internet resources, as well as spyware (distributed in the region via the internet and email clients).
Selected industries
Biometric systems (26.4%) traditionally rank top among the industries and OT infrastructure types covered in this report in terms of the percentage of ICS computers on which malicious objects were blocked. These systems are characterized by internet access, extensive email use for data exchange and approvals (such as access granting), and, in many cases, minimal cybersecurity controls within the organizations that use these systems.
Industries ranked by the percentage of ICS computers on which malicious objects were blocked
Biometric systems rank first among industries in terms of email threats. At the same time, unlike other industries, the percentage for email threats in biometric systems exceeds that for internet threats.
In all selected industries, the global average follows a downward trend. In Q1 2026, the percentage of ICS computers on which malicious objects were blocked increased only in the manufacturing sector — by 1.0 pp. The percentages for this industry increased across 10 regions, with the most notable increases in Western Europe, Northern Europe, and Russia.
Threat categories
In Q1 2026, Kaspersky security solutions blocked malware from 10,052 different malware families of various categories on industrial automation systems.
Over the quarter, the percentage of ICS computers on which denylisted internet resources were blocked increased (after decreasing over the previous two quarters), and there was a slight increase in the percentage for AutoCAD malware.
Percentage of ICS computers on which the activity of malicious objects from various categories was prevented
Malicious scripts and phishing pages (JS and HTML)
Malicious scripts and phishing pages retained their to spot among threat categories by the percentage of ICS c
Key Takeaways
- Threat landscape for industrial automation systems. Q1 2026 — This report contains industrial threat statistics for Q1 2026, including industrial threat...
- Regular threat intelligence reports provide essential context for proactive defense posture adjustments.
- Staying informed on emerging threats is key to maintaining a strong security posture.
- Regular security awareness training and layered defenses remain the foundation of any effective cybersecurity program.