Critical infrastructure (CI) — which we define as energy and utilities, telecommunications, transportation, and trucking/shipping enterprises — represents a major segment of the world economy. Successful cyberattacks against organizations in these industries represent significant risks to national security, economic prosperity, and public health and safety. In response, governments worldwide have taken notice of threats to their critical infrastructure and have issued multiple cyber-resilience-related regulations to address the problem, such as the European Union’s Network and Information Security directive 2 (NIS 2) and the United States Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).
In this paper, we share key findings from the 2024 Thales Data Threat Report (DTR) focused on critical infrastructure organizations, examining the differences between critical infrastructure survey respondents and overall global responses across all industry verticals. Unsurprisingly, many of the critical infrastructure DTR survey results were similar to overall responses, but we do note some key differences.