More than a third of industrial organisations (34%) experienced a cyber incident affecting their operational technology (OT) environments in the past year, with 72% of reported incidents causing facility or system downtime, according to new research from the SANS Institute.
These were some of the findings of the 2026 State of ICS/OT Security Survey, which gathered responses from 696 industrial security professionals.
The proportion reporting an incident rose from 21.5% in 2025 to 34% in 2026, an increase of approximately 58% and the largest single-year rise in the survey’s history.
The consequences are becoming more serious, too. Reported safety impacts nearly doubled to 13% in 2026, and incidents involving intellectual property theft increased from 6% to 31%.
Financial losses, including lost revenue and ransom payments, affected 34% of respondents who experienced incidents.
Ransomware remained a leading threat, cited by 31% of respondents who reported incidents.
However, compromise of shared IT/OT credentials and identities reached the same level, highlighting the risks associated with interconnected corporate and industrial systems. Exploitation of firewalls and edge network devices accounted for 24%, while 21% reported supply chain compromises.
Industrial threat detection is slowing down
Despite growing investment in industrial security technology, organisations are taking longer to discover attacks.
Only 41% of incidents were detected within 24 hours, compared with more than half in the previous two years. SANS said this was the first deterioration in detection times since it began collecting the data.
Dedicated ICS/OT detection platforms have become the most common way industrial cyber incidents are discovered, identifying 38% of those reported. Traditional IT perimeter technologies, like firewalls and intrusion detection systems, made up 31%.
Human operators played a role as well, helping identify 20% of incidents through errors or unusual system behaviour they observed.
However, the survey exposed substantial gaps in monitoring coverage. Just 13% of respondents reported full visibility across their IT and OT environments, while 46% had only partial alignment.
Organisations with full IT/OT visibility reported fewer incidents involving exploited perimeter devices and unauthorised access.
Increasing visibility is not easy. The most common challenge mentioned was budget constraints, which impacted 43% of the respondents.
Another 40% feared that expanding visibility would interrupt operations, and the same number lacked the necessary manpower. These limitations persist even as industrial organisations make greater use of threat intelligence. Adoption reached a survey high of 74%, up from 67% in 2025.
Could industrial facilities continue operating during an attack?
The findings raise questions about how well industrial organisations could withstand an extended cyber disruption.
Only 15% of respondents believed they could maintain safe production manually for more than 48 hours without centralised supervisory control and data acquisition (SCADA) or distributed control systems (DCS).
Another 34% said they could do so partially, while 40% did not know whether their facilities could sustain manual operations for that long.
Recovery planning showed similar weaknesses. Just 16% had fully integrated ICS/OT cyber resilience into their business continuity and disaster recovery programmes, and only 29% tested their resilience plans at least annually.
The survey found a significant difference among organisations that took both measures. Of those that integrated cyber resilience into business continuity planning and tested their procedures annually, 46% expected to restore critical facilities within a day, compared with 27% of respondents overall.
Staffing presents another concern. More than two-thirds of respondents (68%) said losing one or two experienced employees would cause operational delays or severe disruption to their incident response and recovery capabilities.
Although 41% were training existing IT personnel in OT security and the same proportion were developing security skills among engineering and operational staff, only 25% used financial incentives or career development programmes to retain specialist talent.
Dependence on automation vendors creates further risks
The research also examined what would happen if an industrial organisation suddenly lost access to its primary automation vendor because of sanctions, bankruptcy, or a catastrophic supplier breach.
Only 10% of respondents believed they could maintain production indefinitely without that vendor. Some 58% expected their facilities to become inoperable within a year.
Replacing an automation supplier would also be difficult. Among respondents unable to operate indefinitely, 42% estimated that moving critical processes to an alternative vendor would take between one and three years. Another 28% expected the transition to take three to five years, while 13% anticipated more than five years.
Yet only 20% of respondents had fully functional supply chain cyber risk management programmes.
The survey found that organisations with mature supply chain security programmes were nearly twice as likely to sustain production indefinitely in the hypothetical vendor-loss scenario.
Security leaders are more confident than frontline teams
Perhaps one of the more striking findings emerged from a separate, smaller survey of senior industrial security executives included in the report.
All the executives who responded to a question about the total compromise of their organization’s IT infrastructure were confident that production would continue. Of these, 38% thought that industrial systems operating independently would keep going forever, whereas 62% anticipated temporary resorting to manual controls.
This contrasts with the wider survey of practitioners, in which 40% were uncertain whether manual operations could be sustained beyond 48 hours. The questions were different, yet SANS found a discrepancy between management’s expectations and operational capabilities.
The executive findings also revealed that just 14% routinely conducted technical validation of their ICS/OT security capabilities. Although 83% required enterprise IT security personnel to participate in incident response exercises, only 58% required plant managers and frontline engineers or operators.
Those omissions could prove consequential during a prolonged attack. The people responsible for keeping industrial processes running may have little opportunity to practise the procedures they would need if automated controls became unavailable.
To read the full report, click here.
Information Security Buzz News Editor
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.