Cybersecurity trends show rising OT intrusions and organized insider threat markets

Recent cybersecurity reports highlight a dual threat to industrial and corporate infrastructures: evolving operational technology (OT) vulnerabilities and the rise of organized insider threat markets.

A Fortinet report on the state of OT cybersecurity reveals that 71% of surveyed organizations detected between one and nine intrusion incidents over the past year, a significant increase from 2025. The data suggests that many organizations are undergoing a ‘pragmatic correction’ in how they assess their own security maturity, as improved visibility allows them to detect previously hidden risks. Key challenges remain in network segmentation, remote access, and incident response, with attackers increasingly maintaining a presence in networks for weeks or months.

Simultaneously, research from Trend Micro indicates that cybercriminals are increasingly targeting employees to bypass sophisticated external defenses. An underground market has emerged where brokers and recruiters facilitate the sale of legitimate access and ‘workflow authority.’ Examples include the exploitation of Meta Platforms’ internal account recovery tools by employees for bribes, and the targeting of telecommunications staff to perform SIM swapping. This commoditized crime market is expanding into sectors like cryptocurrency exchanges and logistics, with growing concerns regarding future targets in the artificial intelligence industry.