Threat landscape for industrial automation systems. Q1 2026

In Q1 2026, the effectiveness of blocking malicious objects on industrial control systems (ICS) decreased significantly, reaching 19.6%, a three-year low. Growth in blocked threats was most pronounced in Southern Europe, Russia, and Southeast Asia, particularly concerning internet and email threats, spyware, and malicious scripts. Biometric systems consistently exhibited the highest vulnerability across industries, driven by extensive internet access and email use. Kaspersky detected malware from 10,052 families, with a notable increase in denylisted internet resources and AutoCAD malware.