One-Third of the World's Machines Run on Siemens. Cyber Criminals Just Noticed, Too.

 

If a Siemens programmable logic controller fails somewhere in the world today, there's a good chance it disrupts more than one factory floor. Siemens holds an estimated 30% to 42% of the global PLC market, depending on how the hardware class is segmented, and by the company's own account, roughly 33% of all industrial machines worldwide run on a Siemens controller. Add in the fact that about 92% of Fortune 500 companies run Siemens engineering and software platforms alongside their hardware, and a simple truth comes into focus: Siemens isn't just a vendor to industrial operators. It's infrastructure.

 

That scale is exactly why a joint advisory issued on August 22, 2026 by CISA, the NSA, the FBI, the Department of Energy, and the EPA should be on every OT and IT security leader's radar, not just Siemens customers who happen to read the trade press. According to reporting from Tom's Hardware, the agencies warned that Iran-linked threat actors are actively targeting Siemens industrial controllers used across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities — and that they're using AI tools to do it faster and more convincingly than before.

 

 

Attacks on industrial control systems aren't new. What's changed is the tooling. Per the advisory, threat actors are using internet scanning services to find Siemens PLCs that are exposed online and running outdated software — then leaning on AI to identify additional attack vectors and adapt in real time to whatever defenses they encounter. The agencies also flagged a more subtle tactic: attackers are disguising malicious files as legitimate monitoring tools by abusing open-source industrial automation libraries, which makes the initial social engineering far more convincing to an operator who thinks they're looking at a routine diagnostic file.

 

The advisory follows a string of real attacks on U.S. water infrastructure attributed to Iranian actors — a reminder that this isn't a theoretical scenario. Water and wastewater utilities, many of which run lean OT teams and legacy Siemens deployments installed years before "internet-exposed PLC" was a phrase anyone worried about, are squarely in the blast radius.

 

 

Here's the uncomfortable math: if your organization runs Siemens controllers — and given the market share numbers above, most industrial operators do somewhere in their environment — you are, by definition, part of the population these advisories describe. The question isn't whether Siemens equipment is a target. It's whether your specific PLCs are internet-exposed, running outdated firmware, or missing the access controls and monitoring the agencies are now explicitly recommending.

 

CISA, NSA, FBI, DOE, and EPA converged on four mitigations in the advisory: keep security patches current, minimize internet exposure of control system devices, implement strong access controls, and deploy monitoring capable of detecting anomalies and malicious activity inside the ICS environment itself — not just at the IT perimeter. Each of those sounds straightforward. In practice, most OT environments were never built with continuous monitoring or rapid patch cycles in mind, which is exactly the gap threat actors are now using AI to exploit faster than manual defenses can keep up.

 

 

This is precisely the gap InfoSight was built to close for critical infrastructure and manufacturing operators.

 

Find the exposure before an attacker does. InfoSight's ICS, SCADA & IoT Vulnerability and Risk Assessments evaluate your SCADA/ICS network and control systems — across on-premise, cloud, and hybrid environments — to identify exactly the kind of internet-exposed, outdated, or poorly protected PLCs the federal advisory describes. You get a remediation report with concrete, prioritized steps, not just a list of findings.

 

Watch the environment the advisory says attackers are already probing. InfoSight's 24x7 ICS, SCADA & OT Managed Detection and Response service provides continuous, passive monitoring of PLCs, RTUs, and industrial protocol traffic — detecting known attack signatures, behavioral anomalies, unauthorized configuration changes, and unexpected new devices on the network. It's staffed around the clock by a dedicated SOC that escalates, triages, and helps remediate in real time, which is the practical answer to an adversary now using AI to move and adapt faster than a quarterly review cycle can catch.

 

Critically, InfoSight already serves the exact sectors named in the advisory — water and wastewater, energy and electric, oil and gas, manufacturing, and government — because those are the environments where the line between a cybersecurity incident and a physical, public-safety incident is thinnest.

 

The takeaway

 

Siemens' dominance of the PLC market is precisely what makes its controllers a high-value, well-understood target — and the August 2026 advisory confirms that nation-state actors are now using AI to scale that targeting. If you haven't recently verified which of your Siemens controllers are internet-facing, what firmware they're running, and whether anything unusual is happening on your OT network right now, that's the first question to answer — before an attacker answers it for you.

 

 

Request an ICS/SCADA risk assessment or talk to InfoSight about 24x7 OT monitoring for your environment.

 

info@infosightinc.com | 305-828-1003