Dynamics of External and Internal Threats to Industrial Control Systems

This report presents an analysis of the threat landscape for industrial control systems (ICS) during the second quarter of 2025. It outlines the dynamics of both external and internal threats, detailing the percentage of ICS computers attacked and the types of malicious activities observed. The document provides statistics indicating a decrease in the percentage of ICS computers on which malicious objects were blocked, suggesting improvements in proactive protection measures. The report categorizes threats into three sets: external threats, borderline threats, and internal threats, each representing different levels of risk and exposure. The analysis emphasizes the importance of context in understanding the threat landscape, including the stages at which threats are blocked and the implications for network security. Additionally, the report discusses the methodology used to prepare the statistics and highlights the significance of monitoring these threats to enhance cybersecurity measures within industrial environments.