After the Salt Typhoon Disclosures, Critical Infrastructure Cybersecurity Has Become a Board-Level Emergency

Salt Typhoon Changed the Conversation From Risk Management to National Security

The Salt Typhoon campaign , attributed to a People's Liberation Army unit and disclosed publicly by the FBI and CISA in late 2024 , achieved penetration of at least nine major US telecommunications providers including AT and T, Verizon, and Lumen Technologies. The access obtained was not purely credential theft or ransomware positioning: the intrusion targeted lawful intercept infrastructure , the systems telecommunications providers operate to comply with court-ordered wiretap requirements under the Communications Assistance for Law Enforcement Act. The national security implication was immediate and alarming: a foreign state actor had positioned itself to intercept communications that US law enforcement agencies were authorised to surveil, including communications involving senior US government officials and members of Congress during the 2024 election cycle.

The disclosure reset the framing of enterprise cybersecurity from a risk management discipline to a national security imperative in a way that no previous cyber incident had fully accomplished. CISA's emergency directive on telecommunications security issued in December 2024, followed by congressional testimony from senior intelligence and law enforcement officials, produced a regulatory and procurement response that is now flowing through the cybersecurity market in 2025 and 2026. Federal and state critical infrastructure operators received direct CISA guidance on specific remediation steps, and compliance with that guidance is now a condition of federal grant eligibility under several infrastructure programmes.

Operational Technology Security Has Become the Emergency Spending Category

Salt Typhoon was an IT-network intrusion, but its disclosure has accelerated spending on operational technology security , the protection of industrial control systems, SCADA infrastructure, and programmable logic controllers that operate physical infrastructure. The logic is straightforward: if a state actor can penetrate telecom lawful intercept systems, the same capabilities can presumably be directed at power grid control systems, water treatment SCADA, and pipeline monitoring infrastructure. The 2021 Colonial Pipeline ransomware attack demonstrated the economic consequences of OT disruption; Salt Typhoon demonstrated the adversary access methods being deployed against critical infrastructure operators. The combination has produced a spending urgency in OT security that did not exist at this level before.

Claroty, Dragos, Nozomi Networks, and Fortinet's OT security division are the primary commercial beneficiaries. Dragos specifically , founded by former NSA personnel with deep expertise in state-sponsored ICS threat actors , has seen contract volumes increase significantly since the Salt Typhoon disclosures as utilities, water authorities, and energy companies request OT network visibility assessments and threat detection deployments. The recurring revenue model of OT security platforms, which deliver continuous network monitoring for anomalies in industrial protocols like Modbus, DNP3, and IEC 61850, is producing subscription contract durations of three-to-five years as operators seek sustained visibility rather than one-time assessments.

Telecom Infrastructure Security Is Receiving Regulatory Remediation Requirements

The FCC's December 2024 order on communications security required telecommunications carriers to certify their network security practices annually and submit risk management plans for lawful intercept infrastructure. The order gave carriers 180 days to complete remediation of identified vulnerabilities in the systems targeted by Salt Typhoon , a timeline that most carriers have struggled to meet given the complexity of legacy network infrastructure involved. The remediation requirements have created emergency procurement for network detection and response platforms, network traffic analysis tools capable of identifying state-actor lateral movement patterns, and zero trust architecture components for isolating lawful intercept systems from general carrier network traffic.

Palo Alto Networks, Zscaler, CrowdStrike, and Cisco's Talos threat intelligence division have all reported increased demand from telecommunications sector customers in 2025 and 2026 for services directly linked to the FCC remediation requirements. The professional services component , incident response retainers, architecture reviews, and compliance documentation for FCC certification , has been particularly strong, with Mandiant (now part of Google Cloud), CrowdStrike Services, and Booz Allen Hamilton's cyber practice all reporting telecom sector revenue growth significantly above their overall cybersecurity services averages. The regulatory compliance requirement is converting emergency spending into recurring professional services contracts in a way that accelerates backlog visibility for the service providers involved.

Zero Trust Architecture Has Gone From Best Practice to Regulatory Expectation

CISA's Zero Trust Maturity Model, first published in 2021 and updated in 2023, provided federal agencies with a framework for implementing zero trust architectures across identity, devices, networks, applications, and data. The post-Salt Typhoon environment has seen this framework effectively extended to critical infrastructure operators through the mechanism of conditional grant eligibility: Department of Energy grid modernisation grants now reference zero trust implementation milestones in their award criteria, and CISA's critical infrastructure security assessments use zero trust maturity as a benchmark for evaluating operator security posture.

The commercial beneficiaries of zero trust adoption are identity and access management platform vendors and network access control specialists. Okta, Microsoft Entra ID, and CyberArk are capturing identity layer spending; Zscaler, Netskope, and Palo Alto Networks' Prisma Access are capturing network access control layer spending. The vendors operating across both layers have structural advantages because the purchasing decision for zero trust architecture tends to be made at the CISO level with a preference for platform consolidation rather than point-product proliferation. Gartner's 2025 cybersecurity market analysis estimated zero trust platform consolidation has reduced the average enterprise security vendor count from 45 to 33 since 2022, and the consolidation is ongoing.

Supply Chain Security Has Emerged as the Third Priority Alongside OT and Network Security

The Salt Typhoon investigation revealed that the initial access vector in several affected carriers was through third-party network management software , not a direct attack on carrier infrastructure but a compromise of a supplier whose software had privileged access to carrier systems. This supply chain access pattern, consistent with the SolarWinds campaign methodology, has elevated third-party risk management from a compliance checkbox to an active security investment priority. CISA's Secure by Design initiative and the National Cybersecurity Strategy's software liability provisions are both oriented toward shifting responsibility for supply chain security toward software vendors, but the near-term operational response is enterprise-side: more rigorous vendor security assessments, software bill of materials requirements for critical infrastructure suppliers, and network segmentation to limit what third-party management tools can access.

The software bill of materials requirement is creating new demand for SBOM tooling , software that inventories all components within a software product and flags known vulnerabilities in those components as they are disclosed. Anchore, Chainguard, and Snyk are all competing in the SBOM and software supply chain security space, and the CISA guidance that critical infrastructure operators should require SBOMs from software vendors is translating directly into enterprise procurement criteria. For the larger cybersecurity platform vendors, SBOM integration into their existing vulnerability management and configuration compliance workflows is a product extension that deepens customer switching costs and adds renewal rate protection , the supply chain security wave is improving the net revenue retention metrics that drive security platform valuations.

Top 10 Companies in the Global Cybersecurity Market

1. Palo Alto Networks , Platform cybersecurity leader with Cortex XDR, Prisma Access, and Strata network security across enterprise and critical infrastructure customers
2. CrowdStrike , Cloud-native endpoint detection and response leader with Falcon platform and threat intelligence serving enterprise and government customers
3. Microsoft Security , Integrated security platform with Sentinel SIEM, Defender XDR, and Entra identity management embedded in the Microsoft 365 ecosystem
4. Zscaler , Cloud-delivered zero trust network access and secure web gateway platform adopted by federal agencies and critical infrastructure operators
5. Fortinet , Network security vendor with OT security specialisation across energy, manufacturing, and transportation sectors through FortiGuard and FortiOT
6. Dragos , Industrial control systems threat detection specialist founded by ex-NSA personnel; leading OT security platform post-Salt Typhoon
7. Claroty , OT and IoT security platform providing asset inventory, network visibility, and threat detection for industrial and critical infrastructure operators
8. CyberArk , Privileged access management and identity security platform protecting critical credentials in financial services, healthcare, and government
9. Okta , Identity and access management platform with zero trust integration capability serving enterprise and federal government customers
10. Mandiant (Google Cloud) , Threat intelligence and incident response firm with state-actor attribution capability; leading post-Salt Typhoon telecom remediation engagements