State-sponsored hacking groups have altered their strategy, now prioritizing the disruption of physical industrial processes over merely gaining access to operational technology (OT) networks. This shift in tactics poses a substantial threat, as fewer than one in ten OT networks are equipped with monitoring capabilities to detect such malicious activity, according to Dragos, an industrial cybersecurity firm1. The threat group known as Voltzite, linked to China's Volt Typhoon campaign, has been observed manipulating OT systems, highlighting the potential for devastating attacks. With the majority of OT networks lacking adequate monitoring, the risk of undetected attacks is significant. The lack of visibility into OT network activity makes it challenging for operators to identify and respond to potential threats, so this development matters to practitioners because it underscores the urgent need to enhance monitoring and detection capabilities in OT environments to prevent catastrophic disruptions.