How we protect critical infrastructure

Protected by Kaspersky solutions

Examples of critical infrastructure

Why this matters

Modern industrial automation systems are increasingly digital, connected, and intelligent, utilizing the cloud, AI, the Internet of Things, and digital twins. This makes production more efficient but also increases risks: the attack surface grows, and the critical infrastructure facilities themselves become attractive targets for attackers. Moreover, many critical systems were originally designed to operate in an isolated environment but are now forced to operate in a highly open and connected environment.

Key researches in 2024–2025

• At the beginning of 2025, Kaspersky ICS CERT announced it discovered SalmonSlalom ‑ a campaign targeting industrial organizations in the Asia‑Pacific region. The attackers used legitimate cloud services to manage malware and employed a complicated multi‑stage malware delivery scheme using legitimate software to avoid detection. As a result, they could spread malware over victim organizations’ networks, install remote administration tools, manipulate devices, steal and delete confidential information.
• At the Security Analyst Summit 2025, Kaspersky ICS CERT presented the results of a security audit that has exposed a significant security flaw enabling unauthorized access to all connected vehicles of one automotive manufacturer. By exploiting a zero‑day vulnerability in a contractor’s publicly accessible application, it was possible to gain control over the vehicle telematics system, compromising the physical safety of drivers and passengers. For instance, attackers could force gear shifts or turn off the engine when the vehicle is driving. The findings highlight potential cybersecurity weaknesses in the automotive industry, prompting calls for enhanced security measures.
• In 2025, Kaspersky ICS CERT discovered a hardware‑level vulnerability affecting Qualcomm chipsets that are widely used in a range of consumer and industrial devices, including smartphones and tablets, car components, IoT devices and more. The vulnerability resides in the BootROM – firmware embedded at the hardware level. Attackers could potentially get access to any data stored on the device or device sensors like camera and microphone, implement complicated attack scenarios and in some circumstances get full control of the device.

Energy, water supply, and transport—sectors that directly impact people's daily lives and a country's sustainable development—are increasingly vulnerable.

At the same time, the manufacturing sector remains the main target of attackers. According to our quarterly reports of the main incidents in industrial cybersecurity, the vast majority of organizations attacked in 2024–2025 were in manufacturing.

Our approach to protecting critical infrastructure

Today, cyber resilience goes beyond traditional cybersecurity. This means that simply blocking attacks is no longer enough: the entire OT infrastructure OT (Operational Technology) infrastructure is the systems, equipment, and software that directly control physical processes in industry and at critical infrastructure facilities. must be kept stable even during incidents.

Therefore, we are building a security platform for cyber‑physical systems, where Kaspersky solutions protect IT, OT and IIoT Industrial Internet of Things. environments and help organizations implement digital technologies without compromising business stability, human safety, or the environment.

We protect at every level

Kaspersky OT CyberSecurity

Kaspersky Industrial CyberSecurity (KICS) is the foundation of the Kaspersky OT CyberSecurity ecosystem

The core of the cyber‑physical industrial security ecosystem is Kaspersky Industrial CyberSecurity (KICS). This native OT XDR platform provides situational awareness, cyber resilience, visibility into industrial network events, and powerful protection for core automation systems without affecting the availability of industrial processes.

KICS helps prevent costly downtime, security incidents, data theft, and sabotage caused by mass threats, targeted attacks, ransomware, or insider activity, while also protecting legacy equipment, extending its service life, and supporting compliance with national and international standards and information security best practices.

The platform consists of:

• KICS for Nodes — protection of servers, workstations, and operator panels running Linux and Windows
• KICS for Networks — network traffic analysis, asset inventory, anomaly and intrusion detection, and network threat response.

Geographic distribution of KICS

During the reporting period, we significantly strengthened our relationships with companies specializing in energy storage systems and the manufacture of electric vehicles and solar panels. Our clients include five manufacturing companies, each of which is among the top 5 global leaders in their industries, according to independent sources.

In 2025, these relationships gave the business a boost that led to the organization of KICS Con China 2025 in Shenzhen, an innovative region known for its technology cluster. This conference brought together more than 100 participants. Industry roundtables for the oil and gas sector in the META Middle East, Turkey, Africa. region were also held.

We consistently expand our technology partnership program. The KICS platform has been tested for interoperability with industrial automation vendors in Latin America, East Asia, and China, including Altus, Chint, Consen, Supcon and HollySys, helping customers build resilient supply chains and make responsible technology choices.

Our new KICS‑protected clients:

• Nuevo Hospital de Toledo (Spain) — the largest hospital in the Iberia region
• Birla Sugar Group — India's largest sugar producer
• Holy Stone — a leader in China's cement industry
• Atlas Tapes (Greece) — the largest manufacturer of electrical tape in the European Union
• OLED — China's largest OLED display manufacturer

We build Cyber Immunity

Why this matters

A Cyber Immune system is an approach to building IT systems with innate protection against cyberattacks. We believe that such systems can be created using KasperskyOS. To achieve this, KasperskyOS combines best practices in information system development with a focus on secure architecture, secure system design principles and patterns, quality control, secure software development methodology, industry standards, and mandatory penetration testing. This is how we draw closer to a wonderful future where systems solve security problems out of the box.

We propose to build systems so they are secure-by-design by separating them into isolated parts and controlling the interactions between those parts.

As a result, even if an attacker manages to penetrate one line of defense, the rest of the system continues to operate securely. This is especially important for industrial automation, wearable devices, the Internet of Things (IoT), and remote access to critical infrastructure.

KasperskyOS

The KasperskyOS operating system, consisting of a microkernel and the Kaspersky Security System subsystem, provides standard security and enables the development of Cyber Immune solutions.

By combining a microkernel architecture with concepts of MILS (Multiple Independent Levels of Security) and FLASK (Flux Advanced Security Kernel), KasperskyOS creates a fundamentally new level of cybersecurity, significantly increasing a system's resilience to cyberattacks.

In 2024–2025, we took a significant step in our development of KasperskyOS: we adjusted our strategy and began expanding the scope of its use as a full‑fledged general‑purpose operating system.

Flagship release: Kaspersky Thin Client 2.3

During the reporting period, the key product was the new commercial version of Kaspersky Thin Client 2.3, which combined the achievements of 2024 with new features from 2025:

• extended support for peripherals (webcams, headsets, scanners)
• centralized management of monitor settings via Kaspersky Security Center
• Technical support through remote administration
• Secure Boot mode.

This is the first release certified on the Dell Wyse 3040 platform, marking a significant step in expanding hardware compatibility.

Examples of successful deployment of Kaspersky Thin Client

• Aswant Distribution, an international partner, became the exclusive distributor of Kaspersky Thin Client in Malaysia and Indonesia. Between 2024 and 2025, it delivered cyberimmune thin clients to government bodies, industrial enterprises, and financial and educational institutions in the region.
• The Kulim Municipal Council's deployment of the system reduced operating costs by 20% and increased the cyber resilience of infrastructure.

Kaspersky Automotive Secure Gateway is a solution for protecting connected vehicles, including a security gateway, an intrusion detection and prevention system (in‑vehicle IDPS), telemetry services, remote control, and a navigation system.

Care for the environment

Our solution can continuously monitor vehicle systems (battery, electronics, driving parameters, etc.), enabling, for example, optimized charging and extended battery life, as well as fewer service vehicle trips and, consequently, reduced CO₂ emissions, thanks to predictive diagnostic data.

Human safety

Our solution and its development processes and individual software components are certified as compliant with ISO 26262 (ASIL B). This functional safety standard for the automotive industry minimizes the risk of harm to human life and health resulting from vehicle system failures.

Accounting for data security and functional safety requirements opens the way to remote business scenarios (remote maintenance, autonomous transportation, flexible operating models for access to vehicles) without compromising on human safety and cyber risks.

Management quality

Kaspersky Automotive Secure Gateway helps automakers comply with international vehicle cybersecurity standards, including by monitoring information security events and sending them to the Vehicle Security Operations Center (VSOC) for a prompt response and incident investigation.

These features of Kaspersky Automotive Secure Gateway facilitate the implementation of ESG principles in the transportation industry.

We comply with requirements and standards when developing solutions

Our results

Kaspersky OT CyberSecurity in 2024–2025

The Kaspersky OT CyberSecurity platform and Kaspersky Industrial CyberSecurity, one of the solutions included in the platform, showed strong sales growth in the reporting period. Interest in these solutions increased due to:

• market factors, including increased attacks on industrial enterprises, tighter regional regulations, import substitution, a focus on cyber sovereignty and diversification of security suppliers, and increased customer maturity
• Kaspersky's long‑term strategy to strengthen its position in domestic markets and expand geographically
• a strategic approach to cross‑product ecosystem sales for public sector and critical infrastructure customers

KICS in 2025

The KICS platform has demonstrated 25% annual business growth, demonstrating strong momentum in all key markets, including regions affected by geopolitical issues. International sales are growing by more than 50% year‑on‑year thanks to Kaspersky's strategy to expand its geographic reach.

KasperskyOS

In 2024–2025, the KasperskyOS ecosystem demonstrated sustainable growth and expanded into new markets. The portfolio of KasperskyOS‑based solutions has expanded, covering the corporate, transport, and embedded segments. During this period, the platform achieved double‑digit growth in the number of installations worldwide and triple‑digit growth rates in the Russian market (as percentages).

Our plans for 2026–2027