Industrial and critical infrastructure organizations have known that their IIoT and ICS/SCADA assets are susceptible to compromise ever since ICS-CERT published its first Black Energy alert in 2014. The extent to which our industrial control networks are vulnerable, however, has historically been much harder to know in any quantitative sense. In this session, we’ll give a brief review of the results of our “2019 Global ICS & IIoT Risk Report,” a data-driven analysis of real-world network traffic captured from more than 850 production ICS networks worldwide.