The Column – Cyber Security Week
On April 7, 2026, a small US institutional chorus including all major agencies such as the FBI, CISA, NSA, Environmental Protection Agency, Department of Energy, and US Cyber Command Cyber National Mission Force jointly issued a statement, warning that Iranian-affiliated cyber actors were targeting Internet-exposed PLCs within US critical infrastructure. The most insidious part of this news is that, at first glance, it may seem like yet another episode from the cyber lexicon: APT, PLC, HMI, SCADA, ports, firmware, indicators of compromise. All material that for the common reader risks sounding like a mass in liturgical Latin. In reality the point here is much simpler and much more serious: they are not trying to steal the digital folder from the office closet, they are sticking their hands into the electrical panel of reality.
For at least ten years I have been talking about how digital technologies are not confined “inside” the screen. A PLC, a nice little object that decides how a large industrial machine should function as desired, is therefore not a Word document with delusions of protagonism, but a piece of logic that governs something physical. When it is reached and manipulated or used to alter what an operator sees, we are no longer in the territory of simple theft of information, but in the much more uncomfortable territory of disturbing the world. Precisely this makes the American agencies’ formula on “disruptive effects” disturbing. You don’t need to imagine apocalyptic scenarios to understand the problem. Indeed, often the mistake is precisely that: we fantasize about catastrophe.
The truth is usually that it doesn’t take much to cause damage: stopping a process, confusing an operator, distorting a representation, forcing people to switch off out of caution, generating costs, delays, mistrust. You don’t need to blow a dam to demonstrate that the line between cyber and physical has become as thin as tissue paper. Then there is the almost offensive aspect in its banality: many of these systems were exposed on the Internet. Every time something like this happens it is tempting to look for the exotic explanation, the secret technique, the attacker’s stroke of genius. Instead, too often, it is just a question of ajar doors. This is the least cinematic and most humiliating part of the entire story.
We persist in talking about sophisticated threats, hybrid warfare, geopolitical tensions, and then we discover that part of the problem arises from poor, too weak, poorly maintained architectures with remote accesses left there for someone to take advantage of. When we talk about thousands of reachable hosts it means thousands of occasions and if we are talking about systems that control water, energy or essential services, then negligence stops being just a technical defect and becomes a governance problem. The most important step, however, is strategic.
Hitting these targets allows you to achieve a lot with relatively little. To be successful, an attack does not necessarily have to aim for collapse, because disquiet can be enough. Let it be understood that water, energy, local services, i.e. the things that a society considers to be taken for granted, might not be so, then something should happen in public opinion, at least a feeling of unease. Instead, nothing. This is the most disturbing point. Now almost nothing really bothers us. Such a dossier should produce at least a small emotional gap, the minimal discomfort that precedes awareness; on the contrary, it slides over public opinion like that drizzle that can be seen, but does not wet.
We continue to perceive digital as a weightless elsewhere, even when it gets its hands on water, energy, services, real processes. This is not just technical ignorance, but a form of anesthesia. We have lost the “useful fear”, the one that does not generate panic but attention, and so the absence of catastrophe seems to us to be proof of normality which unfortunately is not such. It is just the symptom of a society that no longer recognizes risk even when it appears at the entrance to the house. The moment the danger no longer worries us it is because we have already transformed it into a habit, in which case perhaps it is already too late.
