A new OT-focused scoring model called the OTI Impact Score is being unveiled to gauge the magnitude of cyber incidents affecting operational technology, with the aim of clarifying how such events actually affect business outcomes. According to co-creator Dale Peterson, the score draws on three criteria—severity, reach and duration—by multiplying the three separate scores and dividing by 100.
The definition emphasises that an OT cybersecurity incident is one where the OT system cannot operate normally, even if the attack does not directly touch the OT network, reflecting that IT disruptions can ripple into OT operations. The model was used to retrospectively score notable incidents, including the 2021 Colonial Pipeline attack, which received an OTI Impact Score of 3.9 for “high impact,” with a severity of 8, reach of 7 and duration of 7.
It was also applied to a 2024 water-utility attack in Muleshoe, Texas, which achieved a 0.0 score, including a severity of 1, reach of 1 and duration of 1. The OTI is presented at the S4x26 Conference in Miami, with potential adoption by OT industry groups and possibly government bodies such as CISA. 24 February 2026.