Threat is the product of an actor's capability, opportunity and intent, and feeds likelihood; if any factor is near zero, so is the threat. OT-specific attacks are growing but still rarer than IT attacks, partly because much OT is not externally connected, attacks carry safety consequences and OT lacks monitoring, yet internet-connected monitoring devices can be entry points and malware via updates, USB or crew access still causes downtime, so OT risk should not be underestimated. IT threats are easier to quantify from incident history and, as liner incidents show, can disrupt operations and cargo and cascade into safety (for example losing control of perishable or dangerous cargo).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.