More than a third of industrial organizations—specifically, 34%—have faced a cyber incident impacting their operational technology (OT) environments within the last year, as revealed by recent research conducted by the SANS Institute. Alarmingly, 72% of the incidents reported led to facility or system downtime, highlighting a growing trend in vulnerabilities within this sector.
The findings stem from the 2026 State of ICS/OT Security Survey, which collected responses from 696 industrial security professionals. Notably, the percentage of organizations experiencing incidents surged from 21.5% in 2025 to the current 34% in 2026, marking a staggering increase of approximately 58% and representing the largest single-year rise recorded in the history of the survey.
The repercussions of these incidents have become increasingly severe. For instance, reported impacts on safety nearly doubled, growing to 13% in 2026. Additionally, incidents involving intellectual property theft skyrocketed from 6% to 31%. Financial repercussions are also noteworthy, as 34% of those affected by cyber incidents reported experiencing losses, including reduced revenue and ransom payments.
Ransomware has remained a persistent threat, with 31% of respondents citing this as the primary issue. However, the risks linked to the compromise of shared IT/OT credentials and identities have reached a concerning level, matching the figures for ransomware, which indicates vulnerability in interconnected corporate and industrial systems. Other vulnerabilities included the exploitation of firewalls and edge network devices, accounting for 24% of reported incidents, and 21% attributed to supply chain compromises.
### Industrial Threat Detection Falters
Despite the growing investment in industrial security technology, detection of attacks is taking longer. Only 41% of incidents were discovered within a 24-hour window, a notable decrease from previous years where more than half of incidents were detected in a similar timeframe. This trend marks the first decline in detection times since SANS began compiling this data.
Dedicated platforms specifically designed for ICS/OT detection are now the leading means of identifying industrial cyber incidents, responsible for uncovering 38% of reported cases. Traditional IT perimeter technologies, such as firewalls and intrusion detection systems, contributed to 31% of detections. Human operators also played a role, identifying 20% of incidents based on errors or unusual system behaviors they observed.
However, significant gaps in monitoring coverage remain evident. A mere 13% of respondents indicated they possess full visibility over their IT and OT environments, and 46% noted having only partial alignment. Organizations achieving comprehensive IT/OT visibility reported fewer incidents of perimeter device exploitation and unauthorized access.
Increasing visibility poses challenges for many organizations; budget constraints represent a concern for 43% of respondents, while 40% worry that enhancing visibility might disrupt ongoing operations. Additionally, the same percentage expresses a lack of adequate manpower to manage such initiatives. Despite these challenges, the utilization of threat intelligence continues to rise, with 74% of respondents indicating they have adopted it—up from 67% in 2025.
### Operational Resilience During Cyber Disruptions
The findings also prompt critical questions about how well industrial organizations could endure an extended cyber disruption. Notably, only 15% of respondents felt confident in sustaining safe production manually for over 48 hours without centralized supervisory control and data acquisition (SCADA) or distributed control systems (DCS). An additional 34% believed they could manage partially, while 40% were uncertain of their facilities’ ability to maintain such manual operations.
Recovery planning shows similar weaknesses, as only 16% reported fully integrating ICS/OT cyber resilience into their business continuity and disaster recovery plans. Moreover, only 29% had tested their resilience strategies on an annual basis. Interestingly, the survey highlighted a significant difference in expectations from organizations implementing these measures. Those incorporating cyber resilience into business continuity strategies and conducting regular testing were 46% more likely to anticipate restoring critical facilities within a day compared to only 27% of overall respondents.
Staffing is another major concern, with more than two-thirds of participants (68%) noting that the loss of one or two experienced employees could lead to operational delays or severely hinder their incident response and recovery capabilities. While 41% of organizations are training existing IT staff in OT security, and the same proportion are developing security skills among engineering and operational staff, only 25% leverage financial incentives or career development programs to retain specialist talent.
### Vendor Dependency and Associated Risks
Furthermore, the research explored the implications of losing access to their primary automation vendor due to sanctions, bankruptcy, or a catastrophic breach. Shockingly, only 10% of respondents believed they could maintain production indefinitely without that vendor, while 58% expected their facilities to become inoperable within a year. Transitioning to an alternative vendor poses significant challenges, with 42% of those unable to operate indefinitely estimating the transition would take one to three years, 28% predicting three to five years, and 13% anticipating it would exceed five years.
Despite the apparent risks associated with reliance on automation vendors, only 20% of respondents have implemented fully functional supply chain cyber risk management programs. Organizations that do have mature supply chain security procedures were nearly twice as likely to sustain production in the hypothetical scenario of vendor loss.
### Conclusion: A Disconnect in Confidence
A striking discovery emerged from a separate, smaller survey involving senior industrial security executives included in the report. All executives expressed confidence in their organization’s ability to maintain production, with 38% believing that industrial systems could operate independently without interruption. This outlook sharply contrasts with the broader survey, where 40% of practitioners were uncertain about sustaining manual operations beyond 48 hours.
This divergence raises concerns about the discrepancies between management expectations and operational realities, particularly during prolonged attacks. Moreover, while 83% of executives mandated enterprise IT security personnel’s participation in incident response exercises, only 58% required frontline engineers or plant managers to do so. Such omissions could prove disastrous in a crisis, as those responsible for maintaining operational continuity may lack sufficient practice in the necessary emergency procedures.
The full report is available for further review, providing an in-depth exploration of these critical security issues plaguing the industrial sector. For more details, interested readers may access the report directly through the SANS Institute’s website.