{"id":14738,"date":"2026-11-09T12:18:08","date_gmt":"2026-11-09T10:18:08","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=14738"},"modified":"2026-11-09T12:18:54","modified_gmt":"2026-11-09T10:18:54","slug":"from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/","title":{"rendered":"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">By Ignacio Quiralte P\u00e9rez, Inprosec.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In operational technology (OT), the systems that control industrial machinery and processes, knowing which vulnerability to address first is not enough. A patch often exists, but installing it requires testing, vendor approval or waiting for a maintenance window: the planned shutdown during which equipment can be worked on. And part of the industrial infrastructure runs on equipment no longer supported by the vendor, which will never receive patches.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The OT Cyber Alerts Report III (Informe de Ciberalertas OT \u2013 III) from the Industrial Cybersecurity Observatory, published by the Xunta de Galicia through the Galician Agency for Technological Modernization (Amtega), focuses on that gap: how to reduce risk while the definitive fix cannot yet be applied.<\/span><\/p>\n\n<h2><b>What this third report adds.<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The first report laid the groundwork: it defined vulnerabilities in industrial environments, analyzed how long attackers take to exploit them and quantified the return on investment of mitigating them early. The second addressed how to prioritize based on real risk, using three tools:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The Known Exploited Vulnerabilities (KEV) catalog of the US Cybersecurity and Infrastructure Security Agency (CISA). It lists the vulnerabilities already being exploited in real attacks.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The Exploit Prediction Scoring System (EPSS). It estimates the probability that a vulnerability will be exploited in the next 30 days.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The Now\/Next\/Never model, which sets when to act:<\/span>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"> Now: fix immediately if it is safe to do so or, if not, mitigate right away.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Next: reduce exposure and prepare a maintenance window.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Never: do not intervene, but document the reason, monitor and review the decision periodically.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">If the Now\/Next\/Never model decides when to act, this third report explains how to act when an immediate fix is not possible. It also draws a line: postponing a patch is not the same as simply accepting the risk. The decision must be documented and accompanied by three things: a proportionate alternative measure (what the report calls a \u201ccompensating control\u201d), a review date and a clear path to remediation.<\/span><\/p>\n<h2><b>Three pillars for containing risk.<\/b><\/h2>\n<h3><b>Defensible architectures. <\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The report draws on the international standard ISA\/IEC 62443-3-2, from the International Society of Automation (ISA) and the International Electrotechnical Commission (IEC). It proposes moving away from \u201cflat\u201d industrial networks, in which any device can communicate with any other. Instead, it suggests dividing them into zones, which are groups of assets with similar security requirements. Zones connect only through conduits, the only communication channels allowed between them. This limits lateral movement, that is, an intruder jumping from one device to another.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Segmenting the network with virtual local area networks (VLANs), logical divisions of a single physical network, is not enough. Each conduit needs verifiable rules that define who communicates with whom, over which protocol and port, in which direction and for what purpose. The Zero Trust model does not consider any access trustworthy simply because it originates inside the network. It can reinforce this approach, but it does not replace it.<\/span><\/p>\n<h3><b>Virtual patching.<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">It consists of blocking, at network level, the attack that would exploit the vulnerability, before it reaches the device and without modifying it. This is done with deep packet inspection (DPI) rules, which analyze the content of communications. These rules are deployed on industrial firewalls and intrusion prevention systems (IPS) capable of interpreting industrial communication protocols such as Modbus TCP, EtherNet\/IP, S7comm, OPC UA or DNP3.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Before enabling a rule, three steps are needed:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">measure latency, the delay it adds to communications;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">rule out false positives, that is, legitimate traffic blocked by mistake;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">where possible, start in detection mode, in which the rule alerts but does not block.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Virtual patching complements the official patch; it does not replace it: once the patch is installed, the rule is withdrawn in a controlled manner.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Compensating controls. These are alternative measures that reduce risk while a fix is not possible. The report highlights three:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Isolating the device through network configuration (logical isolation).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Restricting or disabling legacy protocols that transmit information unencrypted, such as Telnet, FTP, HTTP or SNMP versions 1 and 2.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Hardening remote access with three elements:<\/span>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"> Multi-factor authentication (MFA);<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">An encrypted virtual private network (VPN);<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A jump server, a controlled intermediate host through which all connections must pass. It sits in the industrial demilitarized zone (DMZ), an isolated network zone between the corporate network and the plant network.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Remote access deserves particular attention. According to the report, connections from vendors, maintenance staff and integrators (the companies that install and configure the systems) are among the most frequent intrusion vectors.<\/span><\/p>\n<h2><b>Managing the exception, not forgetting it.<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Every vulnerability that is not fixed within the usual timeframe is an exception. To manage it, the report proposes a minimum seven-step procedure:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Confirm that the device is affected.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Assess exposure and consequences.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Select the treatment.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Validate the measure: test it under controlled conditions before applying it.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Apply it with traceability: record who is responsible, the change, how to roll it back and when to review it.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Verify that it blocks the attack path and leaves evidence.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Close the exception.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">A control only counts as valid if it reduces or blocks the targeted attack without blocking legitimate communications or affecting production unacceptably. It must also meet four conditions:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">generate evidence that it works;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">have a tested rollback, that is, a plan to undo the change if something goes wrong;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">have an owner;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">have a review date.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Each exception must be recorded with, among other details:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">its status: remediated, mitigated or accepted;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the residual risk, the risk that remains after the measures are applied;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the condition for retiring it.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The difference between statuses matters. A mitigated vulnerability is still present; only the likelihood of exploitation or the severity of its consequences has been reduced.<\/span><\/p>\n<h2><b>What the third-quarter advisories show.<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The report\u2019s advisory catalog brings together 84 security advisories published between July and September 2026. Each advisory may cover several vulnerabilities, each identified by its public CVE (Common Vulnerabilities and Exposures) code. Only advisories with at least one high or critical severity vulnerability that are also relevant to industry are included.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The report distinguishes two groups:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">OT and industrial control system (ICS) products;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">information technology (IT) or cross-cutting technologies that can affect operations, such as Citrix NetScaler or WatchGuard and HPE (Hewlett Packard Enterprise) wireless access points.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">A product appearing in the catalog does not mean that a specific installation is exposed. Priority combines five factors:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the technical severity of the flaw;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">whether an attacker can actually reach the device;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">how easy it is to exploit;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the criticality of the asset;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the consequences for the process.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Two of the cases analyzed illustrate this:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Citrix NetScaler ADC and Gateway, appliances that manage application traffic and remote access for many companies. Two of their vulnerabilities are already being exploited in real attacks and are listed in the KEV catalog, so the priority is Now. The report also advises treating the case as a potential incident: checking for signs of compromise before updating and preserving evidence if an attack is suspected.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Phoenix Contact, Carlo Gavazzi and Pepperl+Fuchs. The same critical vulnerabilities affect input\/output (I\/O) modules from all three manufacturers. These are the devices that connect control systems to sensors and actuators. The priority is Now if the device is reachable from untrusted networks and Next if its exposure is tightly restricted. The case also shows how a single flaw spreads to products from several manufacturers through the supply chain.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The report\u2019s conclusions point to recurring weaknesses:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">exposed interfaces, that is, device panels or services reachable from places they should not be;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">flaws in credential management;<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">vulnerabilities inherited from third-party components.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Hence its emphasis on three lines of action:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Gaining visibility over assets and their dependencies with a software bill of materials (SBOM), the inventory of software components in each product.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Reducing implicit trust, that is, no longer assuming an access is safe just because it comes from inside the network.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">For remote maintenance, relying on privileged access management (PAM) solutions, which control and log access with administrator privileges.<\/span><\/li>\n<\/ul>\n<h2><b>Conclusion<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The report sums it up in one sentence: \u201cIn OT, not patching immediately should not mean not acting.\u201d The definitive fix remains the goal; until it arrives, every temporary measure must be justified, tested and have a removal date.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">At Inprosec, we continue to work with Amtega to help Galicia\u2019s industrial sector better manage its OT vulnerabilities.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Full report on the Ciberseguridade Galicia portal:<\/span><a href=\"https:\/\/ciberseguridadegalicia.gal\/es\/recursos\/documentacion\/informe-ciberalertas-3\"> <span style=\"font-weight: 400;\">https:\/\/ciberseguridadegalicia.gal\/es\/recursos\/documentacion\/informe-ciberalertas-3<\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>By Ignacio Quiralte P\u00e9rez, Inprosec. In operational technology (OT), the systems that control industrial machinery and processes, knowing which vulnerability to address first is not enough. A patch often exists, but installing it requires testing, vendor approval or waiting for a maintenance window: the planned shutdown during which equipment can be worked on. And part&#8230;<\/p>\n","protected":false},"author":6,"featured_media":14743,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-14738","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.7 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III - Inprosec<\/title>\n<meta name=\"description\" content=\"Key takeaways from Amtega\u2019s OT Cyber Alerts Report III: how to contain industrial vulnerabilities with virtual patching, segmentation and compensating controls.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III\" \/>\n<meta property=\"og:description\" content=\"Key takeaways from Amtega\u2019s OT Cyber Alerts Report III: how to contain industrial vulnerabilities with virtual patching, segmentation and compensating controls.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-09T10:18:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-09T10:18:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2026\/11\/post-amtega-III.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1100\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III\",\"datePublished\":\"2026-11-09T10:18:08+00:00\",\"dateModified\":\"2026-11-09T10:18:54+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/\"},\"wordCount\":1425,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/post-amtega-III.jpg\",\"articleSection\":[\"General\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/\",\"name\":\"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/post-amtega-III.jpg\",\"datePublished\":\"2026-11-09T10:18:08+00:00\",\"dateModified\":\"2026-11-09T10:18:54+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"Key takeaways from Amtega\u2019s OT Cyber Alerts Report III: how to contain industrial vulnerabilities with virtual patching, segmentation and compensating controls.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/post-amtega-III.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/post-amtega-III.jpg\",\"width\":1100,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III - Inprosec","description":"Key takeaways from Amtega\u2019s OT Cyber Alerts Report III: how to contain industrial vulnerabilities with virtual patching, segmentation and compensating controls.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/","og_locale":"en_US","og_type":"article","og_title":"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III","og_description":"Key takeaways from Amtega\u2019s OT Cyber Alerts Report III: how to contain industrial vulnerabilities with virtual patching, segmentation and compensating controls.","og_url":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/","og_site_name":"Inprosec","article_published_time":"2026-11-09T10:18:08+00:00","article_modified_time":"2026-11-09T10:18:54+00:00","og_image":[{"width":1100,"height":627,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2026\/11\/post-amtega-III.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III","datePublished":"2026-11-09T10:18:08+00:00","dateModified":"2026-11-09T10:18:54+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/"},"wordCount":1425,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2026\/11\/post-amtega-III.jpg","articleSection":["General"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/","url":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/","name":"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2026\/11\/post-amtega-III.jpg","datePublished":"2026-11-09T10:18:08+00:00","dateModified":"2026-11-09T10:18:54+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"Key takeaways from Amtega\u2019s OT Cyber Alerts Report III: how to contain industrial vulnerabilities with virtual patching, segmentation and compensating controls.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2026\/11\/post-amtega-III.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2026\/11\/post-amtega-III.jpg","width":1100,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/from-when-to-act-to-how-to-act-key-takeaways-from-the-ot-cyber-alerts-report-iii\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/14738","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=14738"}],"version-history":[{"count":2,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/14738\/revisions"}],"predecessor-version":[{"id":14741,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/14738\/revisions\/14741"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/14743"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=14738"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=14738"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=14738"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}