What’s the biggest threat to the industrial internet of things (IIoT) space?

Probably the mindset that they are not as exposed as they really are.

Lack of security control standards around IoT. Multiple operating systems and firmware types make it difficult to prescribe one single standard coverage strategy for most of these devices.

Basically the impact mostly depends on the type of industry but I would assume device hijacking would definetly be a serious threat.

Inherently insecure OT networks: Complex and widely distributed architecture, limited OT visibility, and inadequate security controls gave attackers hundreds of possible entry points into companies OT networks. As a result, small-scale attacks usually can go unnoticed despite aggregating substantial damage—and posing substantial risks to OT availability, safety, and reliability—over time. 

A native industrial cyber attack has truly yet to happen. Most of the cyber attacks that have touched industrial environments have been IT-level attacks, like ransomware, or breaking in through enterprise remote access protocols. But for example, the world has yet to see a legitimate massive DNP3 attack, which is an industrial protocol, or a Modbus/TCP denial-of-service attack. When that starts to happen, it will be a game changer, because most security initiatives and products focus on protecting the IT side. The thinking is that those attack vectors are the only ones that will be relevant to the industrial side, but that is an incorrect way of looking at this space. That's an outside-in approach. If you look at it from the inside out, you’ll see that there are so many different attack surfaces on the inside of these networks, which is why native-level protection is important. 

The challenge is that native-level protection is difficult. It requires an in-depth understanding of the network, protocols, devices and the settings of those devices. If you consider Stuxnet, the fanciest part of that attack, from the ICS perspective, was a settings change on the centrifuge controllers. That change took the target out of its normal range of operation in terms of a numerical value. There was nothing on the network that could prevent that numerical value from surpassing an acceptable threshold. And that led to physical damage.