Why OT Intrusions Are Only Noticed After the Process Misbehaves
An industrial intrusion rarely announces itself. The adversary who will eventually tell a machine to do something it should never do usually arrives quietly — over a legitimate remote-access session, through a valid engineering tool, in a stream of protocol reads that look, to any signature-based sensor, exactly like every other Tuesday. What finally tips an operator off is not an alert. It is a pump running when it should be idle, a valve position that no longer matches its setpoint, a batch that comes out wrong.
There is a structural reason for this, and it is worth naming plainly: most OT detection sits at the two ends of the attack chain. The middle — where a patient adversary spends the most time — is the least watched part of the network.
Where does OT detection actually sit in the kill chain?
The SANS Industrial Control System Cyber Kill Chain, first described by Michael Assante and Robert M. Lee, divides an OT intrusion into two phases: a cyber-intrusion phase (reconnaissance, weaponization and targeting, delivery, exploitation, installation, and command and control) and an ICS-attack phase (actions on objectives — the moment the adversary finally reaches into the process).
Notice where the tooling tends to cluster. Signature-based controls are strongest at delivery and exploitation, because those are the stages that resemble IT intrusions: a malicious file, a known exploit, a recognizable command-and-control beacon. At the far end, the process itself becomes the sensor — an alarm fires because a variable crossed a threshold, a motor drew current it should not, a tank level moved against its setpoint.
The middle is different. Reconnaissance, lateral movement, installation, and early command-and-control are the stages where an adversary is inside the network but has not yet touched the process. They are also the stages where almost nothing looks “known-bad.”
What do the middle stages look like on the wire?
Here is the uncomfortable part: in a control network, the middle stages travel over the same legitimate protocols as normal operations.
An adversary enumerating field devices does not need malware. A Modbus read of a device ID register, a DNP3 request for object data, an S7 request to a controller’s diagnostic block — these are ordinary, well-formed protocol exchanges. A signature-based detector looking for a known attack pattern sees nothing, because there is no attack pattern to see. It is simply a request arriving from a device that should not be making it.
The same holds for the first step of lateral movement. A jump from the engineering workstation to a Level 1 controller might ride inside a legitimate vendor tool or a shared credential. The bytes are valid. What is wrong is not what the traffic is, but who is issuing it, when, and from where — and that information is not encoded in any signature.
This is why “signature-less” is not a flourish. Signatures catch what has been seen and documented before. The middle of an OT kill chain is, by definition, the part a given network has never seen before — because every plant’s normal is different, and a careful adversary is counting on exactly that.
Why is dwell time the number that matters?
If the middle stages went unnoticed but the impact stage reliably raised alarms, you would expect intrusions to be caught the moment something broke. The data says otherwise. Mandiant’s M-Trends 2026 report put the global median dwell time for 2025 at 14 days — and for the espionage and North Korean IT-worker intrusions that drove that year’s increase, the median reached 122 days.
The OT-specific picture is sharper still. A leading OT threat intelligence vendor’s 2026 year-in-review reported that in roughly three out of ten incident-response engagements during 2025, the investigation did not begin with a detection alert at all. It began with someone in operations noticing that something “seemed wrong” — and in many of those cases, the telemetry needed to establish what had actually happened had never been collected.
Dwell time is not a vanity metric. It is the distance between “the adversary is inside” and “someone knows.” Shortening it is the entire point of detection — and you cannot shorten what you cannot see.
What does learning “normal” buy you that “known-bad” cannot?
There is a different way to watch the middle of the kill chain, and it begins by inverting the question. Instead of asking whether traffic matches something already flagged as bad, ask whether it matches what this network actually does.
A passive, behavior-aware sensor learns the network’s normal — which devices talk to which, over which protocols, at which hours, and with which write patterns. When a PLC that has only ever received Modbus reads from one engineering workstation suddenly receives a burst of register writes from a new address at 03:00, that is a flag. Not because the writes contain malware — they do not — but because they violate the normal the sensor has learned. And the flag is explainable: which asset, which account, which protocol, which register, and at what time, mapped to the right level of the Purdue model and to MITRE ATT&CK for ICS.
A note on the baseline itself. We freeze the baseline, not the detection — the attack is still fully caught. The baseline is the reference of normal; the detection stays live against it. An adversary who tries to poison that reference by drifting slowly over weeks is still caught in the act, and the act remains explainable.
That is the difference between watching the ends and watching the middle. Signatures and process alarms both have their place. But neither can see a patient adversary during the weeks they spend learning a network before touching the process. Only a baseline of normal makes the quiet middle visible — not as a known attack, but as a deviation that demands a look.
Where does that leave the operator?
None of this means abandoning signatures or process instrumentation. It means being clear-eyed about what each layer sees. Signatures see the known. Process alarms see the consequence. The space in between — reconnaissance, movement, staging, the slow positioning that precedes impact — is visible only to something that has learned what the network is supposed to do.
For operators who run systems they cannot patch on schedule and processes they cannot take offline, that middle is not a luxury. It is the part of the attack chain where there is still time to act.
Maigadi — the OT/ICS network detection & response (NDR) platform that passively learns your network’s normal and detects the novel, signature-less attacks others miss. On-premise. Explainable. Sovereign by design.