Most Targeted Nation: Australia now tops global OT/IoT alert rankings

Australia was the most targeted country for IoT and OT cyberattacks in Nozomi Networks Labs’ latest report, up from third place in the previous edition. 

Nozomi’s summer 2026 report, published on 12 October, shows Australia moving up two positions from the second half of 2025, with the UK second and France replacing Germany in third. 

What the ranking means

The ranking uses average alerts per organisation, and only countries with a statistically significant number of participating customers are included. All data comes from anonymised telemetry shared by Nozomi customers. 

Australia’s rise in rank was already under way, having moved from fourth to third in the second half of 2025. 

What the telemetry says about attacker methods

Credential-related techniques, including default, valid and brute-forced credentials, accounted for roughly a third of all detections globally. 

Discovery techniques involving network and system scanning also featured among the top techniques. Nozomi says attackers use them to explore environments before acting. 

Denial-of-service and data manipulation attacks were also prominent, which suits OT and IoT environments where availability and data integrity matter most. 

Manufacturing was the most targeted industry, and Energy, Utilities and Waste rose to third. 

For Australia specifically, Nozomi’s previous report found that Default Credentials and Valid Accounts accounted for more than a third of Australian alerts. 

What Australian guidance says about connectivity

The ASD’s Australian Cyber Security Centre, working with international partners and led by the UK’s NCSC, released Secure connectivity principles for Operational Technology in January 2026. It notes that as connectivity expands through remote access, third-party support and data sharing, organisations need practical guidance to manage intrusion risk. Its eight principles focus on reducing exposure, applying consistent and secure connectivity patterns, limiting the impact of a compromise, and monitoring to detect threats early. 

Earlier ACSC guidance also advises segmenting and segregating OT from all other networks, including IT and the internet. 

How MFT contains the risk

MFT governs one of the most common crossings between IT and OT - moving files. A modern MFT such as the class-leading GoAnywhere MFT:

1. Controls access on the transfer pathway. GoAnywhere offers role-based access controls and a built-in key management system covering PGP keys, SSH keys and SSL certificates. That keeps credentials for file movement in one managed place.

2. Makes file movement visible. GoAnywhere logs all file transfer activity in a centralised database, creating an audit trail, with reports available. That supports the “monitor and detect” principle in the ACSC guidance. 

3. Replaces ad-hoc transfers. GoAnywhere replaces manual transfer processes and custom FTP scripts with workflows that are scheduled, monitored and encrypted in transit and at rest. 

4. Supports a segmented architecture. GoAnywhere supports a DMZ reverse proxy gateway to keep files within the internal network. This helps make file movement a deliberate, monitored crossing point. Segmentation itself still comes from your network design. 

   
   

The takeaway

Nozomi’s data shows attackers still succeed with basic techniques such as weak credentials and exposed assets. Nozomi recommends aligning security spending with operational risk, improving visibility into critical processes, and separating IT and OT networks. 

Securing the pathways that carry data between operational systems and the rest of the enterprise is one part of that layered approach, alongside asset visibility, strong authentication and network segmentation. 

Local help at hand

Generic Systems Australia are Australia’s experts in MFT, with many years of practical experience with MFT solutions. 

Get in touch if you’d like an obligation-free discussion about how we can help you.