According to new findings from the SANS Institute, a significant one-third of organizations managing Operational Technology (OT) or Industrial Control Systems (ICS) reported at least one cyber incident in the past year. This alarming statistic surfaced from a comprehensive survey in the 2026 State of ICS/OT Security Survey Insights, which involved nearly 700 IT and security professionals.
The survey documented the most substantial year-on-year rise in cyber incidents recorded, jumping from 22% to 34% among the responding organizations—a notable escalation that underscores a growing threat in the industrial sector. In conjunction with the increase in incidents, the repercussions have also intensified. The percentage of organizations reporting that cyber incidents impacted safety rose from 8% to 13%, while incidents involving the theft of intellectual property soared dramatically from 6% to a staggering 31%.
The survey highlighted two primary types of incidents that frequented this year: compromises of shared IT/OT credentials and identity, both reaching 31%, alongside ransomware attacks, which have increasingly plagued organizations.
A crucial factor contributing to the rise in both the number and severity of incidents is the poor visibility many organizations have into their systems. A mere 13% of respondents indicated that they possess comprehensive visibility across the entire cyber kill chain for their IT and OT environments. A significant barrier to better detection, cited by 43% of respondents, is budget constraints.
Early detection of threats is essential to mitigate the impact of these incidents. The survey revealed that nearly three-quarters (72%) of respondents experienced some level of downtime at their facilities or systems as a direct consequence of security incidents. Alarmingly, only 15% of organizations reported being fully capable of maintaining critical operations in a manual mode for more than 48 hours. Adding to the concern, 40% of respondents were uncertain if they could sustain operations in such a manner, highlighting a critical vulnerability in response architecture.
The supply chain also emerges as a locus of significant risk: 58% of participants stated that if their primary automation vendor were to cease operations, they would be unable to sustain operations or would be compelled to shut down within a year. Despite the looming threat, only 20% of organizations have established a fully operational third-party risk management program.
Staffing challenges further exacerbate these vulnerabilities, with 68% of organizations indicating that the loss of one or two key personnel could severely delay or compromise their ICS/OT security and incident response capabilities. In response to this concern, one-third (33%) of organizations are looking toward artificial intelligence and automation tools as a means of addressing potential staffing shortages, with real-time threat and anomaly detection (42%) being identified as the most common area of investment.
The lessons drawn from the survey are poignant. Organizations that conduct annual tests of their business continuity and disaster recovery plans—and integrate ICS/OT into those plans—have shown remarkable resiliency; nearly half (46%) reported being able to bring critical facilities or systems back online within a single day, in comparison to only 27% of all respondents. Yet, despite these improvements, only 16% of organizations have successfully incorporated cyber resilience into their existing disaster recovery frameworks.
Recent cyber-attacks targeting OT equipment in supermarkets across Europe demonstrate the potential for catastrophic operational disruption and financial repercussions. In light of these developments, the SANS Institute has proposed a strategic three-point plan aimed at fortifying resilience within organizations:
-
Regular testing of resilience plans at least once a year, involving the operational staff who would manage manual operations during crises.
-
Integration of ICS/OT cyber resilience into pre-existing business continuity and disaster recovery (BC/DR) programs.
- Analyzing personnel and vendor-related dependencies to better prepare for potential disruptions.
Jason Christopher, a Principal Instructor at SANS and the report’s author, emphasized the importance of understanding ICS/OT systems in order to foster resilience. He pointed out that while progress has been made in industrial security over the past decade, there remains a considerable amount of work to be done.
“What occurs after an alarm is triggered depends significantly on rehearsal,” he asserted. “It’s essential to know who is capable of running the plant manually, who holds vital unwritten knowledge, and what actions to take if a vendor is no longer available—many in the industry have yet to answer these critical questions.”
This comprehensive analysis not only sheds light on the current state of cybersecurity within the OT and ICS domains but also serves as a clarion call for organizations to prioritize security resilience in the face of escalating threats.