From Airgap to Zero Trust-A Systematic Review of Operational Technology Cybersecurity Technologies for Critical Infrastructure in the Era of ICS-Specific Malware

Abstract

Traditionally, Operational Technology (OT) environments were comprised of programmable logic controllers (PLCs), distributed control systems (DCSs), safety instrumented systems, and the industrial networks that connect them, which were protected by physical isolation and obscurity. Today, with the merging of information technology (IT) and operational technology (OT) in the era of Industry 4.0, the proliferation of remote access and the increasing number of cloud-connected industrial IoT, that isolation has been broken. At the same time, the threat landscape has evolved, with Dragos reporting 1,693 ransomware attacks against industrial organisations in 2024, representing an 87% increase from the previous year, and the first-ever weaponization of Modbus TCP in a real district-heating system with the emergence of the FrostyGoop malware. To assess the state of OT cybersecurity technology today, this review systematically combines and summarizes peer-reviewed literature, standards documents ISA/IEC 62443, NIST SP 800-82 Rev. 3, NIST SP 800-207, and government advisories CISA, ENISA and vendor threat intelligence published between 2015 and 2026 across five domains asset visibility and passive network monitoring, network segmentation and zero-trust architectures, anomaly detection using artificial intelligence and machine learning, secure remote access and identity management, and resilience engineering including digital twins and consequence-driven design. We discover that detection and visibility technologies have come a long way, while patch management, cryptographic protection of legacy protocols and standardised resilience metrics are still in its infancy. Practitioners and researchers distill five key messages. We define labeled OT datasets research gaps, explainable anomaly detection for safety-critical loops, supply-chain assurance for firmware and quantitative cyber-physical risk models. The review's conclusion is that OT security needs to be rethought as a problem of consequence management, where technology choices are made based on the physical impact, rather than IT-centric measures of confidentiality.