A new SANS Institute survey shows that 34% of industrial organizations suffered a cyber incident, putting fresh pressure on ICS/OT security. Of those incidents, 72% disrupted operations.

The findings come from the SANS 2026 State of ICS/OT Security Survey. The share of respondents reporting an incident rose from 22% last year. It is the largest single-year jump in the survey’s history. Detection also slowed for the first time.

Industrial control systems are being targeted more often. Recent attacks on power systems in Poland and water systems in the United States are examples.

The Insights report was written by Jason Christopher, SANS Principal Instructor. It looks past detection to resilience. It asks whether a facility stays safe and running while an incident is still under way.

The survey gathered responses from nearly 700 industrial security professionals. They work across every major critical infrastructure sector. The survey has run annually since 2017.

Christopher teaches SANS ICS456: Essentials for NERC Critical Infrastructure Protection. He also co-authors ICS418: ICS Security Essentials for Leaders. In addition, he is Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners.

Detection times slipped this year. Only 41% of incidents were found within 24 hours, down from last year. Dedicated ICS/OT visibility and threat detection platforms now rank first among detection methods. They found 38% of reported incidents, ahead of IT perimeter tools and trained operators. The report notes that this capability barely existed 10 years ago.

Impacts were also more severe than a year ago. The share of respondents who said an incident affected safety rose from 8% to 13%. Reports of intellectual property theft rose more than fivefold, from 6% to 31%. In the longest case reported, the shutdown lasted a year.

Shared IT/OT credential and identity compromise tied ransomware as the most common incident type. Each was cited at 31%.

Visibility remains limited. Only 13% of respondents report full IT/OT visibility across the cyber kill chain. Budget is the most commonly cited barrier to expanding ICS/OT detection, named by 43% of respondents.

“Industrial security has come a long way over the past decade, and the data this year shows how much is still left to do,” said Christopher. “What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable. Most of the industry has not answered those questions yet.”

Manual operations are the fallback when a facility loses centralized SCADA or DCS control. Just 15% of respondents are fully capable of sustaining critical operations in manual mode for more than 48 hours. Meanwhile, 40% do not know whether they could.

Planning appears to make a difference. Organizations that test their plans at least annually and build ICS/OT into business continuity and disaster recovery programs restore faster. Among them, 46% can bring their most critical facility or system back online within the first day. That compares with 27% of all respondents. However, only 16% of respondents have fully integrated cyber resilience into those programs.

The survey also points to dependence on vendors and key staff. If their primary automation vendor disappeared, 58% of respondents would shut down or be unable to operate within a year. Only 10% could operate indefinitely. Just 20% have a fully functional supply chain cyber risk management program.

People are another risk. In total, 68% say losing one or two key individuals would delay or severely risk ICS/OT security and incident response.

AI use is growing as well. About 33% of respondents are deploying AI or automation tools to augment staff. Among them, real-time threat and anomaly detection is the most common use, at 42%.

Threat intelligence use has reached a survey high. Some 74% use ICS/OT-specific threat intelligence, up from 67% last year.

The report finds that the capabilities behind its strongest results are ordinary ones. These include testing, documentation, cross-training, and integration with disciplines industrial operators already trust.

It closes with three steps. Organizations should test plans at least annually with the operators who would run manual mode. They should fold ICS/OT into the continuity and disaster planning they already exercise. They should also map dependencies on key people and key vendors.

“Acting on this does not take a new framework,” Christopher added. “The organizations that understand their own systems best are the ones most likely to get through a hard day.”

The full SANS 2026 State of ICS/OT Security Survey Insights: Industrial Cybersecurity at a Crossroads report is free to download. Readers can register and download the report here.

The survey was sponsored by Acronis, Claroty, Corsha, Dispel, Dragos, Fortinet, and OPSWAT. For many operators, the findings put ICS/OT security resilience, not just detection, at the center of planning.

Related post

View all