{"id":108350,"date":"2026-11-12T14:48:40","date_gmt":"2026-11-12T10:48:40","guid":{"rendered":"https:\/\/techxmedia.com\/en\/?p=108350"},"modified":"2026-11-12T14:48:41","modified_gmt":"2026-11-12T10:48:41","slug":"ics-ot-security-incidents-surge-to-34-in-sans-2026-survey","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/ics-ot-security-incidents-surge-to-34-in-sans-2026-survey\/","title":{"rendered":"ICS\/OT Security Incidents Surge to 34% in SANS 2026 Survey"},"content":{"rendered":"\n

A new SANS Institute<\/a> survey shows that 34% of industrial organizations suffered a cyber incident, putting fresh pressure on ICS\/OT security. Of those incidents, 72% disrupted operations.<\/p>\n\n\n\n

The findings come from the SANS 2026 State of ICS\/OT Security Survey. The share of respondents reporting an incident rose from 22% last year. It is the largest single-year jump in the survey\u2019s history. Detection also slowed for the first time.<\/p>\n\n\n\n

Industrial control systems are being targeted more often. Recent attacks on power systems in Poland and water systems in the United States are examples.<\/p>\n\n\n\n

The Insights report was written by Jason Christopher, SANS Principal Instructor. It looks past detection to resilience. It asks whether a facility stays safe and running while an incident is still under way.<\/p>\n\n\n\n

The survey gathered responses from nearly 700 industrial security professionals. They work across every major critical infrastructure sector. The survey has run annually since 2017.<\/p>\n\n\n\n

Christopher teaches SANS ICS456: Essentials for NERC Critical Infrastructure Protection. He also co-authors ICS418: ICS Security Essentials for Leaders. In addition, he is Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners.<\/p>\n\n\n\n

Detection times slipped this year. Only 41% of incidents were found within 24 hours, down from last year. Dedicated ICS\/OT visibility and threat detection platforms now rank first among detection methods. They found 38% of reported incidents, ahead of IT perimeter tools and trained operators. The report notes that this capability barely existed 10 years ago.<\/p>\n\n\n\n

Impacts were also more severe than a year ago. The share of respondents who said an incident affected safety rose from 8% to 13%. Reports of intellectual property theft rose more than fivefold, from 6% to 31%. In the longest case reported, the shutdown lasted a year.<\/p>\n\n\n\n

Shared IT\/OT credential and identity compromise tied ransomware as the most common incident type. Each was cited at 31%.<\/p>\n\n\n\n

Visibility remains limited. Only 13% of respondents report full IT\/OT visibility across the cyber kill chain. Budget is the most commonly cited barrier to expanding ICS\/OT detection, named by 43% of respondents.<\/p>\n\n\n\n

\u201cIndustrial security has come a long way over the past decade, and the data this year shows how much is still left to do,\u201d said Christopher. \u201cWhat happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable. Most of the industry has not answered those questions yet.\u201d<\/p>\n\n\n\n

Manual operations are the fallback when a facility loses centralized SCADA or DCS control. Just 15% of respondents are fully capable of sustaining critical operations in manual mode for more than 48 hours. Meanwhile, 40% do not know whether they could.<\/p>\n\n\n\n

Planning appears to make a difference. Organizations that test their plans at least annually and build ICS\/OT into business continuity and disaster recovery programs restore faster. Among them, 46% can bring their most critical facility or system back online within the first day. That compares with 27% of all respondents. However, only 16% of respondents have fully integrated cyber resilience into those programs.<\/p>\n\n\n\n

The survey also points to dependence on vendors and key staff. If their primary automation vendor disappeared, 58% of respondents would shut down or be unable to operate within a year. Only 10% could operate indefinitely. Just 20% have a fully functional supply chain cyber risk management program.<\/p>\n\n\n\n

People are another risk. In total, 68% say losing one or two key individuals would delay or severely risk ICS\/OT security and incident response.<\/p>\n\n\n\n

AI use is growing as well. About 33% of respondents are deploying AI or automation tools to augment staff. Among them, real-time threat and anomaly detection is the most common use, at 42%.<\/p>\n\n\n\n

Threat intelligence use has reached a survey high. Some 74% use ICS\/OT-specific threat intelligence, up from 67% last year.<\/p>\n\n\n\n

The report finds that the capabilities behind its strongest results are ordinary ones. These include testing, documentation, cross-training, and integration with disciplines industrial operators already trust.<\/p>\n\n\n\n

It closes with three steps. Organizations should test plans at least annually with the operators who would run manual mode. They should fold ICS\/OT into the continuity and disaster planning they already exercise. They should also map dependencies on key people and key vendors.<\/p>\n\n\n\n

\u201cActing on this does not take a new framework,\u201d Christopher added. \u201cThe organizations that understand their own systems best are the ones most likely to get through a hard day.\u201d<\/p>\n\n\n\n

The full SANS 2026 State of ICS\/OT Security Survey Insights: Industrial Cybersecurity<\/a> at a Crossroads report is free to download. Readers can register and download the report here<\/a>.<\/p>\n\n\n\n

The survey was sponsored by Acronis, Claroty, Corsha, Dispel, Dragos, Fortinet, and OPSWAT. For many operators, the findings put ICS\/OT security resilience, not just detection, at the center of planning.<\/p>\n","protected":false},"excerpt":{"rendered":"

A new SANS Institute survey shows that 34% of industrial […]<\/p>\n","protected":false},"author":67,"featured_media":108351,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1595,9621],"tags":[],"contributor":[9732],"class_list":["post-108350","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-emerging-technologies","contributor-news-desk"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2026\/11\/Jason-Christopher.jpg","author_info":{"display_name":"Muhsin","author_link":"https:\/\/techxmedia.com\/en\/author\/muhsin\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t