The Cybersecuritybeeld Nederland 2025 (CSBN 2025) from the Dutch National Coordinator for Counterterrorism and Security marks a watershed moment for operational technology security: the Netherlands experienced its first documented case of deliberate cyber-sabotage targeting a digital control system. This milestone, combined with sophisticated ransomware attacks halting industrial production for weeks and state-backed actors manipulating water infrastructure across Europe, signals that OT and industrial control systems are no longer theoretical targets—they are active battlegrounds.
For CISOs, plant managers, and executives overseeing critical infrastructure, this report provides evidence-based validation that cyber risk quantification and management for OT environments has become a business-critical imperative, not merely an IT concern.
Source: Cybersecuritybeeld Nederland 2025, Dutch NCTV
Source: CSBN 2025, Dutch MIVD
1. Water Infrastructure Manipulation (Denmark)
Pro-Russian hackers attacked a Danish water treatment facility, deliberately increasing water pressure through control system access. The attack left customers without water for several hours after a pipe burst due to the pressure manipulation.
Source: CSBN 2025, Danish and Norwegian incidents
2. German Pharmaceutical Wholesaler (AEP)
3. UK Retail Sector (Co-op, M&S, Harrods)
The Scattered Spider group targeted multiple UK retailers with ransomware. Co-op experienced empty shelves and operational disruptions, with attackers stealing data from 6.5 million customers before encryption.
Source: CSBN 2025, ransomware case studies
70-80% of European cloud market is controlled by US companies, creating concentration risk. The report emphasizes that edge devices—VPN gateways, firewalls, Citrix appliances, and routers—remain the primary entry points for attackers targeting OT networks.
Key Examples:
Source: CSBN 2025, edge device threats
The CSBN 2025 explicitly identifies all vital sectors as attractive targets for both state-backed and criminal actors. For OT environments, the following sectors face the most significant exposure:
Energy & Utilities
Water Management
Manufacturing
Transportation & Logistics
Telecommunications
The report devotes an entire chapter to telecom, noting that many vital sectors depend on telecom infrastructure with inadequate fallback options. A telecom outage in Luxembourg disabled 4G and 5G networks nationwide for over three hours, preventing emergency calls and online banking.
Source: CSBN 2025, vital sectors analysis
Based on CSBN 2025's evidence-based analysis, industrial organizations should prioritize these OT-specific actions:
State-backed groups have demonstrated willingness and capability to interfere with digital control systems in the Netherlands and across Europe. Organizations in vital sectors must align OT security with standards applied to other critical national infrastructure.
Given documented exploitation of VPNs, firewalls, and remote access systems:
Incidents at Blue Yonder, Cleo, Salesforce, and other providers demonstrate that:
Example: Blue Yonder ransomware affected 3,000+ customers including major manufacturers (Microsoft, Renault, Lenovo, P&G, Carlsberg) and Dutch retailers (Jumbo, Hema).
The CSBN emphasizes that digital dependencies and concentration risk are governance issues, not merely technical topics. Industrial companies should:
Source: CSBN 2025, recommendations
CSBN 2025's findings validate what leading industrial organizations already recognize: qualitative risk assessments and compliance checklists are insufficient for managing OT cyber risk in 2025 and beyond.
Why Cyber Risk Quantification Matters for OT
The report's documented incidents demonstrate that cyber events translate directly into quantifiable business impacts:
Cyber Risk Quantification and Management (CRQM) provides the methodology to translate these technical vulnerabilities into financial metrics that executives and boards can act upon.
Quantified Vulnerability Management (QVM): Addressing the Edge Device Crisis
CSBN 2025 emphasizes that attackers systematically target edge devices and exploit vulnerabilities "within hours to days" of public disclosure. Traditional vulnerability management approaches—prioritizing by CVSS score alone—leave organizations perpetually overwhelmed.
Quantified Vulnerability Management addresses this by:
This approach directly responds to the CSBN's finding that organizations need more sophisticated methods to handle the volume and velocity of edge device vulnerabilities.
DeNexus's DeRISK™ platform was purpose-built to address exactly the challenges highlighted in the CSBN 2025 report. Here's how the platform supports each critical recommendation:
DeRISK Capability: Industry-specific risk models for energy, manufacturing, water, and transportation sectors that quantify cyber risk in financial terms aligned with board-level decision-making.
CSBN Connection: Translates technical OT vulnerabilities into business metrics, enabling organizations to demonstrate why OT security deserves strategic investment priority.
DeRISK Capability:
CSBN Connection: Directly addresses the "hours to days" patching window by enabling risk-based prioritization of edge device vulnerabilities based on financial exposure, not just CVSS scores.
Source: DeRISK QVM product information
DeRISK Capability:
CSBN Connection: Enables organizations to see the risk that their trusted service providers (third-parties) would have upon their risk profile.
DeRISK Capability:
CSBN Connection: Provides financial justification for ICS/OT cybersecurity investments (better incident response, etc.) by quantifying the cost of scenarios of cybersecurity projects.
Source: DeRISK platform overview
DeRISK Capability:
CSBN Connection: Directly addresses the report's emphasis on board-level oversight by providing the quantified risk metrics executives need to make informed decisions about cybersecurity projects, buying-down risk, and transferring risk to insurance coverage.
Real-World Validation
DeNexus clients have demonstrated the practical value of CRQM:
Source: DeNexus case studies and insurance optimization research
Key Takeaways:
CSBN 2025 Critical Insights for OT Security Leaders
The Threat is Real and Present
Key Statistics
Highest-Risk Sectors
Top 5 OT Security Priorities
CRQM Solution
CSBN 2025 provides industrial organizations with clear, evidence-based validation: OT and ICS environments are active targets for sophisticated actors capable of causing physical disruption and business interruption. The report's strength lies in its documentation of real incidents—not hypothetical scenarios—affecting control systems, production lines, and critical infrastructure across Europe.
For CISOs and operational leaders, the path forward requires moving beyond qualitative risk assessments to cyber risk quantification that translates OT vulnerabilities into financial metrics. When you can quantify that a specific edge device vulnerability represents $2.3 million in business interruption risk, prioritization decisions become clear. When you can model the financial impact of a supplier compromise before it occurs, you can justify the investments needed for resilience.
The industrial organizations that will thrive in this threat environment are those that embrace quantified risk management, treating OT cybersecurity as what it truly is: a strategic business imperative with measurable financial consequences.
The CSBN 2025 report makes clear that industrial organizations can no longer afford to manage OT security through qualitative assessments and compliance checklists. DeNexus DeRISK™ provides the evidence-based, financially quantified approach that today's threat landscape demands.
Learn how DeRISK™ can help your organization:
References and Sources