As someone who's spent the last two years securing operational technology (OT) systems in healthcare manufacturing, the kind that keeps essential drugs and medical products flowing, I've seen a scary pattern: Companies pour millions into firewalls and AI threat detection, but they overlook the basics that keep everything running when the lights go out.
I'm talking about power redundancy. Not the sexy part of cybersecurity, but the one that can turn a minor glitch into a full-blown crisis.
Last year alone, ransomware and state-sponsored attacks on critical infrastructure surged, with incidents like those hitting energy and healthcare causing billions in disruptions. But many of these could've been contained or prevented entirely if backup power systems weren't riddled with misconfigurations.
In one assessment I led for a major facility, we discovered core network devices relying on single power sources. A brief outage would've wiped out internet connectivity, halting production lines and risking patient safety downstream. Worse, these setups often fly under the radar because they're "physical" issues, not digital ones. Cyber teams ignore them, and facilities teams assume IT has it covered.
- Time to reimagine the CISO’s role as OT security takes center stage
- Critical infrastructure facing cyber surge in OT and supply chains in 2026
- Why OT environments are vulnerable – and what to do about it
This isn't rare. In OT environments — factories, hospitals, utilities — power redundancy gaps create cyber-physical vulnerabilities. Hackers don't always need sophisticated malware; sometimes they exploit outages (natural or induced) to amplify chaos.
Why is this exploding now?
1. Hybrid IT/OT convergence: More devices are networked, meaning a power flick can cascade into data loss or unauthorized access.
2. Rising attacks on supply chains: Healthcare and manufacturing are prime targets. The Colonial Pipeline hack showed how one disruption ripples economy-wide.
3. AI and edge computing boom: These demand constant uptime, but many legacy systems lack robust backups.
The business cost? Downtime in manufacturing can hit $50,000 per hour or more. In healthcare, it's lives and regulatory fines.
But here's the good news: Fixing this doesn't require a massive budget. From my hands-on work, here are practical steps executives and security leaders can take today:
- Map your dependencies: Start with comprehensive diagrams of IT/OT core devices — switches, firewalls, servers. Identify single points of failure in power delivery (PDUs, UPS systems).
- Audit and test: Check for loose connections, mismatched cables, or outdated redundancy setups. Run simulated failovers quarterly.
- Integrate into Zero-Trust: Treat power resilience as a verification layer — no device operates without confirmed backup.
- Implement checklists: Simple ones for securing cables, replacing aging PDUs, and verifying dual feeds. In one project, this alone prevented potential outages during storms.
- Partner cross-functionally: Cyber teams + facilities + vendors. Tools like automated monitoring can flag issues early.
As we head into 2026, with threats evolving faster (thanks, generative AI), ignoring power redundancy is like leaving your front door unlocked while installing a fancy alarm system.
Business leaders: It's time to bridge the IT/OT divide and prioritize these "boring" fixes. Your bottom line and national infrastructure will thank you.
