# The Evidence Was Never There: Why OT Security Needs Deception to See the Attackers It Can't Log
Twelve years after attackers plunged Ukrainian substations into darkness, the same fundamental trap still catches defenders responding to attacks on industrial systems: you arrive at the scene, and there is nothing to find. No logs. No process execution history. No SIEM alerts. The operational technology that runs power grids, water treatment plants, and factory floors was built to keep machinery running reliably — not to tell you who was in it and what they touched.
That silence isn't a bug that vendors will eventually patch. It's the architecture. And it's what makes OT the most dangerous blind spot in critical infrastructure security today.
## When the Network Goes Quiet at Exactly the Wrong Moment
The 2015 BlackEnergy attack on Ukraine's grid — one of the first confirmed cyber-to-physical attacks on civilian infrastructure — followed a pattern that has since become a template. The adversaries spent months inside the IT environment: establishing persistence, harvesting credentials, mapping the path from enterprise systems toward the industrial control systems beneath. When they finally crossed into the OT environment, they did so with a level of familiarity that made their presence nearly undetectable.
The IT half of that investigation yielded artifacts. The OT half gave defenders almost nothing.
This isn't unique to Ukraine. The Colonial Pipeline attack in 2021 shut down 45 percent of the US East Coast's fuel supply. Investigators found the initial access vector in IT systems — not OT — but the operational impact came from the decision to proactively shut down OT as a precaution, precisely because the operators couldn't be confident in what was or wasn't compromised. That's the tell: when your visibility is zero, you shut everything down to be safe. The attacker doesn't need to touch your PLCs. They just need to make you afraid they might have.
Volt Typhoon, the Chinese state-sponsored group that CISA has been warning about since 2023, has made pre-positioning in US critical infrastructure OT environments something close to a doctrine. They're not there to attack — they're there to be *ready* to attack, using living-off-the-land techniques that leave minimal traces even in well-instrumented IT environments. In OT environments, they leave practically none.
## What Forensics Looks Like When There Is No Forensics
In a conventional IT investigation, the questions are familiar: Which account authenticated? Was it interactive or remote? What process spawned what child process? Did PowerShell execute anything unusual? Did traffic touch a known C2?
In an OT investigation, most of those questions don't apply. Programmable logic controllers don't run antivirus. Historians and HMIs are often running Windows XP or Windows 7 — not because operators are careless, but because the industrial software they host hasn't been certified to run on anything newer. Patching cycles measured in years, not weeks. Endpoint detection agents that vendors won't support on their platforms. Systems that can't be rebooted during production without stopping the line.
The result is an environment designed from the ground up to be operationally reliable and forensically invisible. An attacker who reaches OT doesn't need to cover their tracks. There were never any tracks to begin with.
## Honeypots Grew Up — and OT Finally Benefits
Cyber deception has historically meant honeypots: deliberately vulnerable systems placed to attract and observe attackers. The problem with honeypots in OT was always the same as the problem with everything else in OT — they required care and feeding that operational teams didn't have, and a sophisticated attacker could usually identify them.
Modern deception platforms have evolved significantly. Rather than a single obvious trap, current approaches distribute fake assets across the environment — fabricated PLCs, decoy historian servers, phantom engineering workstations, credential breadcrumbs that lead nowhere useful — creating a detection layer that doesn't depend on logging or signature matching. An attacker moving laterally through an OT network will eventually touch one of these decoys. The moment they do, defenders get an alert based on *behavior*, not on a log entry that was never written.
This matters for a specific reason: the IT-to-OT lateral movement phase. Before an attacker reaches a real PLC, they typically spend time in the IT/OT boundary — in jump servers, in historian systems, in engineering workstations that sit in both worlds. That boundary is where deception can catch what traditional controls miss, and catch it before the attacker takes a step that could cause physical consequences.
## HackWire Analysis
The timing of renewed focus on OT deception isn't accidental. Volt Typhoon's documented pre-positioning in US water, power, and transportation infrastructure has created a legitimacy problem for traditional OT security arguments: you can't sell "just segment the network and keep up with patches" to an operator who knows that a nation-state adversary may already be inside, has been there quietly for months, and specifically chose living-off-the-land techniques to avoid detection.
Deception fills a real gap that other controls can't, because it doesn't require the target system to produce telemetry — it creates a separate detection surface that the OT environment doesn't need to participate in. A fake PLC doesn't need to run an agent. It just needs to exist somewhere an attacker scanning for real PLCs will find it.
What coverage of this topic consistently misses is the *lateral movement window*. Most OT security discussions focus on either the initial compromise (IT-side) or the final payload (the PLC command that opens a valve or trips a breaker). The middle — the dwell time between IT and OT, the reconnaissance of industrial networks, the credential harvesting targeting engineering accounts — is where deception has its highest leverage and where almost no traditional control has meaningful visibility.
The practical implication for defenders: deception in OT isn't a replacement for network segmentation, asset inventory, or vendor patch coordination. It's the sensor layer you deploy *because* you know those controls will sometimes fail, and you need a way to know when they have. Industrial operators running Purdue model architectures should be mapping deception assets to their Level 2 and Level 3 zones specifically, not sprinkling them uniformly across the plant floor.
The gap between what OT environments can tell you and what attackers can do inside them isn't closing. The tooling to compensate for that gap is finally catching up.
— HackWire Editorial
## Related Coverage