[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-Jr2L-T94XVcb8wAFnWBC2Idx6ACB0ZQu1pvDFrdxn0":3},{"article":4,"iocs":37,"watch_terms":38,"solutions":39,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"833c94cd-94db-4e8c-abbc-438fdd2d21d8","The threat to critical infrastructure has changed. Has your readiness?","the-threat-to-critical-infrastructure-has-changed-has-your-readiness","Five facts critical infrastructure (CI) leaders need to act on in 2026, grounded in what Microsoft Threat Intelligence is observing across sectors right now. The post The threat to critical infrastructure has changed. Has your readiness? appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence reports that critical infrastructure threat landscape has fundamentally shifted, with threat actors now establishing persistent, stealthy footholds rather than pursuing opportunistic disruption or data theft. The observation is backed by global regulatory momentum including NIS2, Japan's Active Cyber Defense legislation, and Canada's Bill C8, with law enforcement initiatives like Operation Winter SHIELD emphasizing verified readiness over awareness. Key vulnerabilities stem from legacy systems operating in hybrid IT-OT environments with identity as the central control layer, creating convergence of identity-driven intrusions, living-off-the-land persistence, and nation-state prepositioning.","Microsoft threat intelligence warns CI leaders of persistent nation-state intrusions targeting critical infrastructure","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fsecurity-insider\u002Fthreat-landscape\u002Fthreat-to-critical-infrastructure-has-changed",null,"2026-03-31T17:00:00+00:00","2026-03-31T18:00:16.846532+00:00",7,[],"c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":17,"icon":12,"name":19,"slug":20},"Policy","policy",[22,27,32],{"category":23},{"id":24,"icon":12,"name":25,"slug":26},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":28},{"id":29,"icon":12,"name":30,"slug":31},"4fd32ef4-29b8-4ee4-b88f-ecfb77fbf9c1","NIS2","nis2",{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",[],[],{"controls":40,"vendors":125},[41,70,96],{"slug":42,"name":43,"problem":44,"products":45},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[46,54,62],{"vendor_slug":47,"vendor_name":48,"vendor_logo":49,"product_slug":50,"product_name":51,"url":52,"description":53},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":71,"name":72,"problem":73,"products":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[75,83,88],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":47,"vendor_name":48,"vendor_logo":49,"product_slug":84,"product_name":85,"url":86,"description":87},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":97,"name":98,"problem":99,"products":100},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",[126],{"slug":47,"name":48,"logo_path":49,"roles":127},[128],"reported_by",{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":141},"critical-infrastructure-faces-advanced-persistent-threats-through-identity-compromise","Critical Infrastructure Faces Advanced Persistent Threats Through Identity Compromise","Critical infrastructure organizations are experiencing a fundamental shift in threat tactics, with adversaries now establishing persistent, stealthy access rather than conducting opportunistic attacks. These sophisticated threat actors exploit identity as the central attack vector in hybrid IT-OT environments, using living-off-the-land techniques to maintain long-term presence. The convergence of legacy systems with modern infrastructure creates expanded attack surfaces that nation-state actors are actively positioning within for future operations. This evolution requires organizations to move beyond traditional awareness-based security to verified, continuous readiness postures.",[134,135,136,137,138,139,140],"NIST AC-2","NIST AC-6","CIS Control 12","CIS Control 14","NERC CIP-005","IEC 62443","NIS2 Directive",{}]