September 2025 will be remembered as the month when ransomware stopped pretending it was just a corporate problem. On September 3rd, Jaguar Land Rover halted production across facilities in the UK, China, India, and Slovakia after a Qilin ransomware infection encrypted systems across their manufacturing floor. By mid-month, European airport operators were canceling flights and reverting to manual check-in processes after their baggage and booking systems went dark. Days later, Asahi Brewery announced production delays affecting distribution across multiple continents, also from Qilin. These weren’t isolated incidents; they were the visible edges of a much larger attack surface that the cybersecurity industry has been severely understaffed to defend.

What happened in September wasn’t new in its mechanics. Ransomware has been targeting manufacturing for years. The critical difference is speed, scale, and the sheer brazenness of the attackers. Manufacturing environments, power utilities, and transportation networks have been treated as secondary security problems by many organizations, partly because they sit outside the IT department and partly because the assumption was that “nobody would dare attack infrastructure.” That assumption has proven catastrophically wrong. The attacks are happening, they’re happening faster, and the people who know how to defend operational technology systems are in desperately short supply.

Why OT Security Became an Afterthought

Operational technology systems, which control everything from airport baggage handlers to brewery fermentation tanks to power grid substations, operate under fundamentally different constraints than traditional IT networks. OT systems prioritize availability and safety above all else; a brewery fermentation vessel that goes down isn’t just an expense, it’s an actual safety issue if temperature controls fail. OT networks are often isolated, running proprietary protocols that predate the modern internet, and staffed by people who are experts in manufacturing or power systems, not cybersecurity. This created a dangerous gap: IT security teams knew networks and encryption; OT teams knew industrial processes and control systems. Neither side fully owned the security problem.

Many organizations, particularly large manufacturers, treated OT security as a compliance checkbox rather than a genuine risk. They assumed that air-gapped networks would keep them safe, that the specialized nature of the systems would deter attackers, or that “we’ve never been targeted before” was a reliable defense strategy. When budget cuts came, OT security was often first on the chopping block because it didn’t directly feed the business and it required expensive specialized knowledge to maintain. The result was a ten-year period where OT security matured far more slowly than IT security, leaving massive vulnerabilities in place.

September 2025 exposed what happens when attackers realize they don’t need to crack the IT fortress: they can walk around it. Qilin and other sophisticated ransomware groups identified that manufacturing environments often have better data assets than their IT counterparts (consider the value of a automotive manufacturer’s proprietary designs versus their email servers) and far weaker defenses. They developed tools and techniques specifically designed to work with OT protocols. They built supply chain access through IT contractors who had legitimate reasons to be on the network. They waited for the right moment to encrypt systems and hold production hostage.

The Skills Gap That Should Terrify Your Organization

Here’s what makes this moment different for your career: if you work in cybersecurity or infrastructure, there is no deeper skills shortage in the field right now than in OT and ICS (Industrial Control Systems) security. Consider the numbers. The Bureau of Labor Statistics estimates there are roughly 1.2 million cybersecurity professionals in the United States. The number of people with genuine, applied expertise in OT security? Estimates range from 5,000 to 15,000. That’s not a shortage; that’s a vacuum.

The gap exists for several reasons. First, OT expertise itself is rare; most security professionals come from pure IT backgrounds and have never worked with a PLC, a SCADA system, or an industrial protocol like Modbus or Profinet. Second, the learning curve is steep and requires hands-on access to specialized equipment that most organizations don’t provide for training purposes. Third, the market has been slow to recognize OT security as a genuine career path until very recently, so few universities or bootcamps offered the training. Fourth, and perhaps most importantly, experienced OT security professionals have been hoarded by the organizations that have them, which means the knowledge is concentrated rather than distributed.

This creates an unusual dynamic in the job market. A cybersecurity professional with five years of traditional IT security experience might command a salary of 120K to 150K. An OT security professional with equivalent experience currently commands 150K to 200K, and that premium is growing. Organizations are desperate. They’re hiring contractors at premium rates because they can’t find full-time staff. They’re promoting IT security people into OT roles and hoping they figure it out quickly. They’re investing heavily in training programs. The demand is real and it’s accelerating.

What September Means for Your 2026 Career Plan

If you’re thinking about your next move, there are three concrete paths emerging from the September attacks and the infrastructure vulnerability they exposed.

The first is direct OT security specialization. If you can acquire genuine expertise in industrial control systems, vulnerability assessment in manufacturing environments, and the regulatory environment around critical infrastructure, you’re positioned for a significant salary bump and genuine job security. This isn’t hype; manufacturing companies are actively recruiting right now. The barrier to entry is that you’ll likely need hands-on lab experience, which means seeking out positions at organizations that have the equipment and the funding to let you build that knowledge. Consider roles as an OT security analyst at a major automotive, chemical, or pharma company, or in manufacturing-focused consulting firms like Deloitte or Accenture’s industrial practices.

The second path is supply chain integration. Many organizations attacked in September realized their vulnerability came not from internal weaknesses alone, but from their suppliers’ weaknesses. Hardware vendors, system integrators, and software providers who service manufacturing environments are now racing to audit their own security posture and their customers’ readiness. Roles in vendor security, customer risk assessment, and supply chain resilience for manufacturing-focused companies are exploding. These roles often pay similarly to OT security roles (140K to 180K in most markets) but come with a broader skill set that’s more portable if you want to shift into consulting later.

The third path is incident response and forensics focused on industrial environments. The companies hit in September are still in recovery and investigation phases. Incident response firms specializing in OT forensics can command premium rates, and the expertise you’d build is immediately valuable to any large organization with manufacturing or infrastructure assets. Firms like Mandiant, Kroll, and Fortive’s Roots Security division are hiring aggressively in this space.

For all three paths, certifications matter more than they typically do in IT security. The GICSP (SANS certification) and CAPEC work are more recognized in OT circles than CompTIA or Cisco certifications. If you’re transitioning into OT security, getting credentialed matters for both legitimacy and salary negotiation. Budget for the training and exam costs; they’re real, but the ROI on a 15K to 20K certification investment is solid when it translates into a 30K to 50K salary bump.

The Longer Pattern: Why This Will Happen Again

The September attacks weren’t a random spike. They’re part of a pattern that’s been building for years. Ransomware groups have become more strategic and sophisticated. They’re not just attacking financial services or healthcare anymore; they’re attacking the critical infrastructure that makes entire economies function. They’ve recognized that manufacturing systems are less defended and often more valuable than IT systems. They’ve built supply chains to access these systems. They’ve developed specialized tools. They’ve organized into sophisticated criminal enterprises with business development, customer service, and quality assurance.

What we’re seeing now is the maturation of ransomware as a genuinely systematic threat to industrial operations. September 2025 was visible; it made the news because airports and Jaguar are recognizable brands. But the pattern extends across smaller manufacturers, utilities, transportation companies, and food production that never made headlines. The consensus among serious infrastructure security professionals is that we’re in a multi-year wave of OT attacks, not a temporary spike.

This is your opportunity window. The organizations that are serious about defending themselves need people with real expertise. The market is hot, the salaries are rising, and the barriers to entry are still low enough that someone with genuine drive and the right background can get in. Compare this to, say, cloud security five years ago when AWS expertise was a 30K salary premium; you’re looking at a similar opportunity.

The 2024 Change Healthcare breach illustrated the scale of healthcare supply chain vulnerabilities; read about it and the staffing crisis that followed. Similarly, the CrowdStrike outage in July 2024 exposed how a single software failure can cascade across infrastructure globally, underscoring why security and operational resilience can’t be treated as separate concerns.

The September 2025 incidents are the visible proof of a problem that’s been building in the background for years: critical infrastructure, which underpins everything from transportation to manufacturing to energy, has been vastly underdefended while attackers systematically developed the tools and access to exploit it. If you’re in cybersecurity and you haven’t seriously considered OT security, the market is telling you this is the moment to pay attention.