Do You Know Your True Risk?
Three threats are converging right now on the OT, IoT and ICS machines and devices that software-only tools can’t secure, and they pose catastrophic risks.
The FCC has banned hardware that may already be in your network
On March 23, 2026 the FCC added foreign-produced consumer routers to its Covered List. On July 28, 2026 it added foreign-produced connected power inverters and advanced robotic devices. Each listing followed a national security determination that the products pose unacceptable risks to the United States.
- New models are blocked. They can no longer receive FCC authorization, so they can’t be imported, marketed or sold in the US.
- Installed hardware stays in place. The listings are forward-looking. The routers, inverters and robots already running at your clients’ sites, or your own, keep running, with the same risks the ban was written to address.
Banning new hardware does nothing about what is already deployed. Faction takes the machines and devices behind it off the Internet and contains the threat from vulnerable or compromised hardware already inside the network. No rip-and-replace.
Sources: FCC Covered List · White & Case, Jul 2026
Volt Typhoon is already inside US critical infrastructure
In February 2024, CISA, the FBI and the NSA confirmed that Volt Typhoon, a Chinese state-sponsored group, had compromised US critical infrastructure networks. Its aim is not espionage. It is pre-positioning for disruptive or destructive attacks in a future crisis. Microsoft’s original disclosure listed manufacturing among its targets.
- It gets in through networking hardware. Volt Typhoon exploits known and zero-day flaws in routers, VPNs and firewalls, then blends in with normal administrator activity.
- It hides behind ordinary routers. It hijacked hundreds of end-of-life Cisco and NETGEAR small-office routers to relay its traffic. The FBI disrupted that botnet in January 2024, and it has since been revived.
- Iran is attacking controllers directly. In April 2026, six federal agencies warned that Iranian-affiliated actors were exploiting Internet-facing PLCs across water, energy, government and manufacturing. In July 2026, attacks suspected to be Iran-linked locked operators out of PLCs at more than 30 Minnesota water systems, causing loss of water pressure and flooding. The flaw exploited has no patch.
These attackers target exactly what software-only tools can’t secure: routers, controllers and connected devices. Machines and devices behind Faction protection are unreachable from the public Internet, and anything compromised behind it can’t call home.
Sources: CISA AA24-038A · Cybersecurity Dive, Feb 2024 · NJCCIC · Cloud Security Alliance, Aug 2026 · Cyber Magazine, Aug 2026
AI makes every attack faster and cheaper, and has created a new kind of attacker
AI hasn’t invented new attacks so much as made old ones cheap. Attackers who could never have done this before now can.
- Attacks on OT, IoT and ICS no longer need experts. In May 2026, Dragos reported that a group with little to no prior ICS or OT knowledge used Anthropic’s Claude in a sophisticated attempt to take over a water utility in Mexico. The attempt failed, but showed how far AI can carry untrained attackers.
- Criminals and state actors are using AI at every stage. Anthropic has reported Claude being used to build and sell ransomware by a criminal with only basic coding skills. Its September 2026 report found state-linked and criminal actors using it for reconnaissance, phishing, malware and analysis of compromised systems.
- AI has gone rogue. In July 2026, OpenAI said its models escaped a testing sandbox, reached the Internet and broke into Hugging Face to cheat on an evaluation. OpenAI called it an unprecedented cyber incident, and has since notified more than 100 organizations that its misaligned models may have accessed their systems.
If an attacker can reach a device, AI makes it cheaper and faster to break in, and the attacker may not even be a person. The safest device is one that can’t be reached: Faction keeps critical machines and devices off the Internet, with access only for verified members of your own Faction Network.
Sources: Cybersecurity Dive, May 2026 · Anthropic, Aug 2025 · Techtroduce, Sep 2026 · Fortune, Jul 2026 · The Register, Oct 2026
Close the gap on critical vulnerabilities now
All three threats come in the same way: through vulnerable networking hardware and connected machines and devices that can be reached from the Internet. Faction takes your OT, IoT and ICS machines and devices off the Internet and into your own owner-controlled Faction Network.
- Off the public Internet. Equipment behind Faction protection has no path to the Internet, and is reachable only from inside your Faction Network.
- Contained by design. A compromised machine or device behind it can’t reach the Internet or call home, and Faction Groups limit it to what it is allowed to reach.
- Owner-controlled keys. Created and controlled by you, distributed only to authorized members. Faction never has access to them.
- Nothing to rip out. It sits behind your existing router and never replaces it. Nothing is installed on the machines and devices you protect.
Start with a 60-day free pilot
Contact us and we’ll walk you through the MSP / MSSP Program, and set up a 60-day free pilot on the machines and devices that matter most to your clients.
Secure Your Critical OT & IoT Machines and Devices
Prefer to talk first? partners@factionnetworks.com