Intelligence-Driven Active Defense Report 2026

82.8% of adversary activity occurs during an extended precursor phase, long before operational impact is realized, with an average dwell time of 185 days .

There's been a 332% increase in unique internet-exposed OT devices and services, with nearly 20 million OT-related devices now observable on the public internet .

The highest concentrations of exposed OT devices was in the United States, China, and Germany.

The most populous OT application fingerprint we observed on the internet were Tridium Niagara, Linear eMerge, and Saia PCD Web Server.