Industrial control systems that are operated without any connection to the outside world are becoming increasingly rare. Modern manufacturing and production processes need to exchange information with upstream and downstream production steps and are often connected to central production planning and control systems in an organisation. To exchange information electronically, the production facilities must also be connected to third-party networks, such as the organisation's office IT or the networks of partners and service providers. Interactive access from office or mobile workstations and the operational electronic exchange of data (e.g. for the provision of software and updates) entail further networking with the outside world. Setting up remote accounts for on-call employees or service providers can also make external access possible.

If the required communication channels are too broad or insufficiently secured, attackers can exploit and compromise them. Industrial control systems can be affected by targeted malware attacks. They can also be compromised by malware actually seeks to manipulate office IT. Malware can reach the systems due to a lack of segmentation or control of data traffic.

That said, the use of anti-virus software can also pose a risk to OT if there is no manufacturer approval for the environment in question or if error detections and active system interventions endanger operations, for example. The operation of network-based intrusion prevention systems (IPS) poses a comparable risk of disruption because such systems can interrupt connections.