Your Integrators Are Part of Your Attack Surface

On September 23, 2026, the FBI and CISA published a short fact sheet that deserves more attention than its four pages might suggest. It is aimed at critical infrastructure owners and operators who rely on third-party industrial control system (ICS) integrators—the firms that design, install, support, and sometimes run the control systems behind power, water, and transportation networks globally.

The incident behind the guidance

According to FBI technical analysis, between March and April 2025 foreign cyber actors gained access to the network of a U.S. industrial automation company that provided integration, engineering consulting, and SCADA programming to customers including power utilities and transportation entities. Once inside, the actors searched for terms such as "customers" and "SCADA" and built nine .zip files containing roughly 800 files, including customer SCADA information, ICS device details, and schematics apparently for exfiltration.

Note what was targeted. The attackers did not go through a utility's defenses. They went to a trusted vendor holding the documentation for many utilities at once. The agencies warn that this information could later be used to carry out disruptive attacks on operational environments.

Why this is a structural problem

Anything that accesses your network digitally or physically (take note, security integrators) can create serious risk. Integrators can introduce security issues by exposing systems and services that were not configured to the customer's physical and network security requirements. Owners and operators also face supply chain risk when neither side enforces clear requirements for the secure handling of system components. Integrators that host data outside the U.S. add another layer, because different data storage and management laws may not meet the needs of U.S. critical infrastructure.

The agencies' central instruction is least privileged. In OT environments, that means granting users, processes, and systems only the minimum access needed for their assigned tasks and no more.

Four questions to put to every integrator

The fact sheet asks operators to build these into their risk assessments:

1. What data do they hold? Network designs, device specifications, and logs are all useful to an adversary.
2. Where is it stored? The answer determines which country's laws apply, even when the integrator is a U.S. subsidiary of a foreign-owned firm.
3. Do they have remote access? If so, an attacker who breaches the integrator's network could pivot into yours.
4. Can you operate without them? Redundancy, independent recovery, and secure offline backups of the software needed to run equipment all reduce the damage if an integrator is compromised.

What the agencies recommend doing

• Put security in the contract. Specify data storage locations, remote access capabilities, patch and change management, securing of deployed components (changing default passwords, disabling unused ports), authorized personnel, and processes for local engineering support that limit how often the integrator must intervene.
• Find and reduce internet exposure. Work with integrators to learn where devices are hosted and disconnect them from the public internet.
• Monitor and log remote access. Make sure integrators connect through routes you can monitor, and use on-demand access where possible so operators must actively allow each session.
• Demand an inventory. Ask for all integrator-supplied hardware and software, with documentation of how it connects and how it will be updated.
• Practice manual operations. Maintain the ability to operate manually and account for where third parties fit into your recovery procedures.

The takeaway

None of this is new or groundbreaking. Least privilege, logged access, and tested manual fallback are established practices. What is new is where the agencies are directing it: at the vendor relationship. If an integrator can reach your control environment, or holds the drawings of it, that relationship is part of your attack surface. Treat it like any other risk: scoped, monitored, contractually bound, and reviewed on a schedule.

Suspected incidents can be reported to your local FBI field office or IC3, or to CISA's 24/7 Operations Center. Contact details are in the fact sheet.

Source: FBI and CISA, Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators, September 23, 2026 (TLP:CLEAR).