Threat landscape for industrial automation systems. Q1 2026
July 7, 2026 · Kaspersky (Securelist) · Severity: MEDIUM
In Q1 2026, Kaspersky reported a continued decline in cyber threats targeting industrial control system (ICS) computers, with only 19.6% of systems affected—the lowest rate in three years. Regional variations were significant, with Africa experiencing the highest attack rate (27.4%) and Northern Europe the lowest (9.1%). Southern Europe, Northern Europe, and Russia saw notable increases in threats, particularly internet and email-based attacks, spyware, and phishing scripts. Russia stood out with rising internet and email threats, including denylisted resources and spyware, bucking the global downward trend. Biometric systems remained the most vulnerable industry, with 26.4% of ICS computers affected, primarily due to poor cybersecurity controls and heavy reliance on email for data exchange. Manufacturing was the only sector with a slight increase (1.0 percentage points) in attacks, driven by spikes in Western Europe, Northern Europe, and Russia. Kaspersky blocked malware from over 10,000 families, with denylisted internet resources and AutoCAD malware showing renewed activity. Malicious scripts and phishing pages remained dominant threats, highlighting persistent risks to industrial automation systems.
All threats
The percentage of ICS computers on which malicious objects were blocked continued to decrease, reaching 19.6% in Q1 2026. This is the lowest value in three years, and it is 1.4 times lower than in Q2 2023.
Percentage of ICS computers on which malicious objects were blocked, Q2 2023–Q1 2026
Regionally, the percentages ranged from 9.1% in Northern Europe to 27.4% in Africa.
Regions ranked by percentage of attacked ICS computers
The percentage of ICS computers on which malicious objects were blocked increased in five regions over the quarter, most notably in Southern Europe, Northern Europe, and Russia.
In Q1 2026, Southern Europe led the way in growth for internet and email threats. The region also saw the fastest growth in spyware, as well as malicious scripts and phishing pages.
In Russia, the percentage of ICS computers on which malicious objects were blocked exceeded the figures for the previous two quarters. Russia saw an increase in the percentage for threats from the internet, and a slight increase in the figure for threats from email clients (Russia is one of three regions where this figure did not decrease).
Among the threat categories, the greatest increases were observed in the percentages for denylisted internet resources, as well as spyware (distributed in the region via the internet and email clients).
Selected industries
Biometric systems (26.4%) traditionally rank top among the industries and OT infrastructure types covered in this report in terms of the percentage of ICS computers on which malicious objects were blocked. These systems are characterized by internet access, extensive email use for data exchange and approvals (such as access granting), and, in many cases, minimal cybersecurity controls within the organizations that use these systems.
Industries ranked by the percentage of ICS computers on which malicious objects were blocked
Biometric systems rank first among industries in terms of email threats. At the same time, unlike other industries, the percentage for email threats in biometric systems exceeds that for internet threats.
In all selected industries, the global average follows a downward trend. In Q1 2026, the percentage of ICS computers on which malicious objects were blocked increased only in the manufacturing sector — by 1.0 pp. The percentages for this industry increased across 10 regions, with the most notable increases in Western Europe, Northern Europe, and Russia.
Threat categories
In Q1 2026, Kaspersky security solutions blocked malware from 10,052 different malware families of various categories on industrial automation systems.
Over the quarter, the percentage of ICS computers on which denylisted internet resources were blocked increased (after decreasing over the previous two quarters), and there was a slight increase in the percentage for AutoCAD malware.
Percentage of ICS computers on which the activity of malicious objects from various categories was prevented
Malicious scripts and phishing pages (JS and HTML)
Malicious scripts and phishing pages retained their to spot among threat categories by the percentage of ICS c
Key Takeaways
- All threats The percentage of ICS computers on which malicious objects were blocked continued to decrease, reaching 19.6% in Q1 2026.
- Percentage of ICS computers on which malicious objects were blocked, Q2 2023–Q1 2026 Regionally, the percentages ranged from 9.1% in Northern Europe t.