Hollywood has been warning us about attacks on critical infrastructure. Think hackers taking down power grids, water systems, and factories with a mere few keystrokes. It’s truly terrifying.
Working in OT security recruitment, we know that some of the warnings are closer to the truth than you’d expect. Luckily, most of it isn’t. Or at least not to the dramatic effects displayed on screen.
Here’s how a handful of well-known films and shows actually hold up against what OT security professionals deal with in real life.
Die Hard 4.0 (2007)
The premise – villains attacking national infrastructure through its control systems – is grounded in something real. Critical infrastructure genuinely is controlled by the kind of industrial systems OT security exists to protect. It’s a scenario taken seriously enough that a NATO cyber defence strategist has cited the film as a surprisingly accurate depiction of cyberwarfare.
Where the film departs from reality is speed. Infrastructure-wide chaos doesn’t unfold in a single afternoon since real attacks on industrial systems typically require extended reconnaissance and patience. Although I realise a nation grinding to a halt in a single afternoon is far-fetched, I appreciate that the film at least got the target right: it’s the control systems.
Zero Day (2025)
The idea of a simultaneous, multi-sector collapse makes for a dramatic premise, but cybersecurity experts who reviewed the series called the single-attack, multi-system scenario far-fetched. The premise leans on every sector of critical infrastructure falling over at exactly the same moment.
It overstates how uniform industrial technology is. In reality, energy, water, manufacturing, and transport all run on different technology stacks, with different protocols and different vendors. There’s no universal hack that can infiltrate a power grid and a water treatment plant in the same afternoon. A real large-scale event would look like a series of separate, sector-specific attacks, but I do realise slowing down the threat diminishes the tension that makes a story compelling to watch.
Mr Robot (2015 – 2019)
Gritty and widely regarded as the most technically accurate hacking drama ever made. I can see why. The writers and producers made a conscious effort to avoid the frantic-typing cliché in favour of realistic techniques like social engineering and phishing.
As a series released before the short-form content boom, the story had the liberty to take time to show the slow, unglamorous parts of the work -research, patience, and detail. I appreciate this pacing. It’s truthful and honest that a career in this field rarely has a dramatic countdown clock on the wall.
Blackhat (2015)
A bit less popular with many assuaging that it’s boring and it is a bit slow in places. Still, the opening sequence, a hack that overheats a nuclear cooling system, is one of the more credible things Hollywood has done with this subject. It’s a genuine, well-documented category of OT risk. Industrial control systems that manage safety-critical processes really are a target, and the consequences of interference are exactly as serious as the film suggests.
Google’s then-head of information security agrees with me. Unfortunately, although incredibly serious, a lot of OT security work looks dull in practice. It’s hard to display the physical threat without taking some liberties, so I’ll excuse the compressed timeline and the CGI journey through the circuit board. The film understands the stakes.
WarGames (1983)
No list covering films with cybersecurity plots would be complete without mentioning the OG, WarGames. Its release date alone emphasises that this is definitely not a novel field or problem.
Ronald Reagan watched the film at Camp David and reportedly asked his advisors afterwards whether something like that could really happen. The answer was something along the lines of, “the problem is much worse than you think.” Fifteen months later, that conversation became NSDD-145, one of the first US policies to treat computer security as a national security issue.
While the mechanics have changed a lot since the 80s, WarGames nails something integral: the danger was never the system turning on its operators. It’s the system doing exactly what it was designed to do, for someone who was never supposed to have access to it.
The Pattern I Keep Noticing
Across almost every one of these, the same thing gets exaggerated: speed. Real attacks on operational technology aren’t cinematic. They’re slow, deliberate, and precise, built on patient reconnaissance and a level of restraint designed specifically to avoid triggering alarms. Defending against them doesn’t take a hero with a gun. It takes someone who understands both the engineering and the security side of these systems well enough to notice what doesn’t belong, sometimes weeks before anything actually happens.
If you’re outside the industry, these films and shows aren’t a bad entry point when trying to understand the field. We’re aware that these stories are fictional and dramatised for effect, because reality doesn’t always translate to screen in an interesting way. They get the stakes right even when they get the mechanics wrong. If you’re hiring in this space, it’s worth remembering that the real job is less dramatic and more skilled than the on-screen version. It’s discipline that keeps the systems we can’t afford to fail, safe.
About the author
Charlie Hackett founded Paradigm Tech with his long-time friend and partner. His experience in IT and cyber security recruitment forged a unique appreciation for the technical specificity found in OT security. It’s not just IT security with a fancier name. Getting it right requires specific certifications and deep knowledge of the physical assets OT systems manage. At Paradigm Tech, they only focus on OT recruitment. That’s how they move quickly to deliver exceptional and qualified candidates. Connect with Charlie on LinkedIn.