Cyber security is still a niche job. The people who protect OT/ICS systems running our most critical infrastructure, like water, power and transport, are a small and specialist group. But the subject itself isn’t as niche anymore.
As cyber attacks increase, they are showing up on the front pages more often. The NCSC already handled 204 nationally significant incidents by August 2025, more than double the year before. Considering this, it makes sense that cyber crimes are showing up more often on both our big and small screens.
This summer, a cyber thriller returned for its second series on both sides of the Atlantic.
Channel 4 released all six episodes of The Undeclared War series 2 in July, and it reached Peacock in the US in August. Of course, I watched it, but mostly to check how close it gets to the real thing.
What The Undeclared War is about
Simon Pegg leads again as Danny Patrick, now head of operations. The second series is set in 2024. GCHQ’s Malware Department is dealing with the fallout of a devastating Russian cyber attack when an even bigger threat appears, and a mole turns up inside the building.
Channel 4’s drama boss calls it a “painstakingly researched series”. And I do believe that some of that research shows.
What The Undeclared War gets right
The work is unglamorous
Real cyber defence is people in rooms reading logs and arguing about what they mean. If it looked thrilling on screen, I’d be more suspicious.
I get why this might not make for the most compelling TV, but it is closed to the truth. Even the long hours and nobody seeming to ever stop isn’t all that far-fetched. When an incident is live, the people who understand the systems don’t get to clock off.
People are the weak point
The mole is the most realistic thing in the series. Systems get attacked, but people get turned, tricked or simply make mistakes. That’s why security clearance and careful vetting are standard in OT/ICS security and critical infrastructure hiring. Character and values matter just as much as skills and is, unfortunately, too often viewed as less important in technical fields.
Because an insider threat doesn’t have to be a spy, either. A contractor with more access than they need, or an engineer who clicks the wrong link, can do the same damage without meaning to.
What it misses
The physical side
Like most cyber drama, The Undeclared War lives on networks: data, comms and elections. OT/ICS barely gets a look in.
That’s a shame, because OT/ICS is where the physical risk sits. It’s the kit that runs pumps, valves, signals and production lines. When it’s attacked, the damage isn’t a data breach. Something in the real world stops working, or works the wrong way. It’s why we keep saying OT/ICS is not IT with a different name.
Real attacks on critical infrastructure look different. Serious incidents happen in water towers and not intelligence agencies. The consequence isn’t a leaked file. When a treatment plant goes offline or a water tower can’t refill there are physical consequences that could really disrupt lives.
The targets
TV likes a clever attacker taking on a clever defender. It’s neat. Real attackers often go for the easy option: a small utility with an internet-facing controller and a weak or default password. It makes for worse television, but it’s what keeps OT/ICS security teams busy.
The clock
Everything moves fast on screen. Real attacks are patient, and spotting them takes people who know what normal (and diversions of normal) looks like on an industrial network. That’s a core part of OT/ICS security work, but it rarely makes a good TV.
So, how real is The Undeclared War?
Closer than I thought it would be going into it. I like that it doesn’t pretend the work is glamorous. Where it falls short is the part we care about most: what happens when an attack reaches physical systems.
The patterns in media I’m noticing
The Undeclared War isn’t the first drama to take on cyber attacks. We already scored Die Hard 4.0, Zero Day, Mr Robot, Blackhat and WarGames in how realistic Hollywood’s take on OT/ICS security is.
The same patterns keep turning up. Films and TV get the stakes right. They speed everything up. And they rarely spend time inside the plant room where OT/ICS attacks actually do their damage. And again, I get why. The people behind these stories are looking to entertain, and reality often needs enhancing.
The Undeclared War is still slower and more careful than most of them. It might have impacted the entertainment value of the show, but that’s not really my area of expertise. Instead, I work and place the real-life heroes keeping our most critical systems safe.
About the author
Charlie Hackett founded Paradigm Tech with his long-time friend and business partner, Ben. His background in IT and cyber security recruitment gave him a sharp appreciation for the technical specificity of OT/ICS security. It’s not IT security with a different name: getting it right takes specific certifications and deep knowledge of the physical assets OT/ICS systems manage. At Paradigm Tech, OT/ICS recruitment is the only thing they do, which is how they move quickly to deliver strong, qualified candidates. Connect with Charlie on LinkedIn.
