Attack detection systems in municipal utilities, water works, and network operators

This article examines significant real-world incidents, the actual evolution of OT malware, the TTPs (tactics, techniques and procedures) of modern threat actors, and key findings from the situation reports published by the BSI and Dragos.

When temperatures rise in the summer, millions of people head to the water. Whether it’s relaxing at the lake, visiting public pools, or enjoying a cold, refreshing drink straight from the tap. The availability of clean water is something wetake for granted as part of our quality of life. This makes what happens behind the scenes all the more critical: securing our water supply and wastewater management systems.

In the modern industrial landscape, operational technology (OT) is no longer isolated. While connectivity drives efficiency, it also introduces unprecedented risks. The publication of the German Technical Rule for Operational Safety (TRBS) 1115 Part 1 explicitly addresses this reality, setting stringent guidelines for the cybersecurity of safety-relevant measurement, control, and regulation (MSR) systems.

What about undetected backdoors and blind spots in your industrial control systems? Learn how to make your OT infrastructure more secure by implementing initial hardening measures, using real-world examples from a penetration tester’s diary.

What is the aim of the Cyber Resilience Act and what does it mean for the development of OT Cybersecurity solutions and their users in the field.

How can companies implement the NCSC guideline “Creating and maintaining a definitive view of your Operational Technology (OT) Architecture” without being overwhelmed. Time to prioritize.

How does a network-based intrusion detection system (NIDS) enable the implementation of the NCSC's core principles 3 and 4 to document and evaluate the OT infrastructure? VÖ Teil 2: 06.01.2026

On November 11, the German Federal Office for Information Security (BSI) published its annual report on cybersecurity in Germany. The findings confirm the trend toward increasingly covert cyberattacks. What this means for OT.

The OT risks communicated in media are diametrically opposed to the number of documented cyberattacks on industrial networks. So is this much ado about nothing? Or are we falling prey to a misunderstanding that has been projected from IT security into OT?

US tech companies are currently fighting for their image and trying to retain EU customers with promises of sovereignty. As is often the case, appearances are more important than reality. In this case it can even be called false labeling and sovereignty washing.

Public cloud connections make some things easier, but they also increase the attack surface and security dependence on third-party providers. For its NIDS for OT, Rhebo opts exclusively for on-premise operation without connection to a public cloud.

Can OT operators and IT security become a united force for cybersecurity? How can OT security be organized so that it detects purely passively, but still allows for quick and controlled response?

In a nutshell: no! In this post we dig into the specifics of why – especially in OT – both solutions are not sufficient.

In the first part of this blog post, we mapped the general functions of an intrusion detection system (IDS) according to internationally accepted definitions to possible solutions. This article highlights the additional recommendations for an IDS by national cybersecurity authorities.

In customer meetings, there is often uncertainty about what exactly an intrusion detection system in OT entails. A firewall? A SIEM? A network monitoring system? What exactly does it need to be capable of? In two blog posts, we compare the legal and technical requirements with possible solutions.

Rhebo is commited to maximum data protection, trustworthiness and digital sovereignty for its customers. Here's why that's not quite so trivial in today's cybersecurity world.

For hospitals, cybersecurity for HVAC systems and diagnostic devices is not just a matter of compliance with NIS2 or national legislation. Reducing the cyber risk of these critical assets is also crucial for supply security, data protection, and patient well-being. A network intrusion detection system (NIDS) lights the way.

The situation of OT cybersecurity remains challenging in 2025. Although only a few attacks - compared to the total number of cyberattacks - targeted industrial facilities directly in 2024, the attack surface continues to evolve.

In our blog post “How useful is AI in OT security monitoring?” we examined the added value and risks of artificial intelligence in OT security solutions. Time to put the some common arguments for AI to the test.

Artificial intelligence seems to be seen as a panacea these days – from tomorrow’s shopping list to world peace.