One-third of industrial organisations reported a cyber incident in 2026, with nearly three-quarters of those incidents disrupting operations. Slower detection, growing safety and intellectual property risks, and limited readiness for manual operations expose persistent weaknesses in industrial cybersecurity.
Industrial organisations are facing a widening gap between their ability to detect cyber threats and their capacity to maintain operations when attacks succeed. The SANS Institute’s 2026 State of ICS/OT Security Survey found that 34% of respondents experienced a cyber incident during the year, up from 22% in the previous survey. Of those reporting incidents, 72% said their operations were disrupted.
The increase represents the largest single-year jump in reported incidents in the survey’s history. More significantly, the findings suggest that industrial cybersecurity is no longer simply a question of identifying malicious activity or deploying additional detection tools. Organisations must also demonstrate that critical facilities can remain safe and operational during an attack and recover quickly when systems are compromised.
The report, SANS 2026 State of ICS/OT Security Survey Insights: Industrial Cybersecurity at a Crossroads, was written by Jason Christopher, SANS Principal Instructor. It draws on responses from nearly 700 industrial security professionals across major critical infrastructure sectors. The survey has been conducted annually since 2017.
The findings come amid growing concern over attacks targeting industrial environments, including reported incidents involving power systems in Poland and water infrastructure in the United States. Such incidents highlight the consequences of cyber threats extending beyond corporate networks into the operational technology (OT) environments that control physical processes and essential services.
Detection is slowing despite better security tools
One of the survey’s most concerning findings is the decline in the speed of incident detection. Only 41% of reported incidents were identified within 24 hours, a deterioration from the previous year. This marks the first time the survey has recorded a slowdown in detection.
The result is notable because industrial security teams have gained access to increasingly specialised monitoring and threat detection technologies. Dedicated ICS/OT visibility and detection platforms now account for 38% of reported incident discoveries, making them the leading detection method. They have moved ahead of traditional IT perimeter security tools and detection by trained operators.
A decade ago, dedicated ICS/OT security platforms were barely established as a category. Their growing role reflects the recognition that industrial environments have distinct requirements and cannot be secured effectively through conventional enterprise IT controls alone.
However, the adoption of specialised tools has not eliminated the visibility problem. Only 13% of respondents said they had full visibility across IT and OT environments throughout the cyber kill chain. This indicates that many organisations still lack a complete understanding of how an attacker might enter a network, move between systems, compromise operational assets and affect critical processes.
The survey identifies budget as the most frequently cited obstacle to expanding ICS/OT detection capabilities, with 43% of respondents naming it as a barrier. For industrial operators, the challenge is therefore not simply selecting technology. It is making the business case for sustained investment in visibility, monitoring and response capabilities across environments where security upgrades can be difficult to implement.
Operational disruption is the defining risk
The fact that 72% of incident-affected respondents experienced operational disruption underlines the direct business consequences of industrial cyberattacks. In conventional IT environments, an incident may affect data, applications or employee productivity. In an industrial setting, the consequences can extend to production stoppages, interrupted services, equipment availability and potentially physical safety.
The survey also recorded a rise in incidents affecting safety. The proportion of respondents reporting a safety impact increased from 8% in the previous year to 13% in 2026. This is a particularly significant indicator because industrial cybersecurity failures can affect the processes and systems responsible for protecting workers, facilities and the surrounding environment.
Intellectual property theft also increased sharply. The share of respondents reporting such theft rose from 6% to 31%, more than a fivefold increase. The finding points to a broader range of potential attacker objectives. Industrial organisations may be targeted not only to disrupt production but also to obtain engineering information, proprietary processes and other sensitive business assets.
The duration of disruption can be substantial. The longest shutdown reported by a survey respondent lasted a year. While this represents the most extreme case rather than a typical outcome, it demonstrates how an industrial cyber incident can create consequences that extend far beyond the initial compromise.
Ransomware and the compromise of shared IT/OT credentials and identities were tied as the most common incident types, each accounting for 31% of reported incidents. The result reinforces the importance of identity security in industrial environments. Shared credentials and interconnected systems can provide attackers with opportunities to move from enterprise IT networks into operational environments, particularly where access controls and network boundaries are weak.
“Most of the industry has not answered the questions around manual operations, undocumented knowledge and fallback arrangements when a vendor is unavailable.”
— Jason Christopher, SANS Principal Instructor
Manual operations remain an untested safety net
A central theme of the SANS report is the need to prepare for situations in which digital control systems become unavailable. Industrial facilities often depend on centralised supervisory control and data acquisition (SCADA) or distributed control system (DCS) platforms. If these systems are disrupted, operators may need to fall back on manual procedures to maintain critical operations.
Yet the survey suggests that many organisations are not prepared to sustain this mode of operation for an extended period. Only 15% of respondents said they were fully capable of maintaining critical operations manually for more than 48 hours. Another 40% did not know whether they could do so.
This uncertainty exposes a fundamental weakness in resilience planning. A facility may have invested in security monitoring, incident response and recovery technologies, but those measures do not necessarily ensure that people can safely operate the plant if centralised systems are unavailable.
Manual operation requires more than a documented emergency procedure. It depends on trained personnel, clear decision-making responsibilities, access to operational knowledge and the ability to perform essential tasks without normal digital support. It also requires regular rehearsal so that employees understand what to do under pressure.
Jason Christopher said the industry had made considerable progress in industrial security over the past decade, but the survey showed that significant work remained. He emphasised the importance of rehearsing who would operate a plant manually, identifying where undocumented knowledge resides and establishing fallback arrangements if a technology vendor becomes unavailable.
The issue of undocumented knowledge is particularly important in environments where a small number of experienced employees understand specialised equipment, processes and recovery procedures. If those individuals are unavailable during an incident, an organisation may struggle to maintain operations even when its technical systems can be restored.
The survey found that 68% of respondents believed losing one or two key individuals would delay or severely jeopardise ICS/OT security and incident response. This makes workforce continuity and cross-training essential parts of cyber resilience, rather than merely human resources concerns.
Recovery planning delivers measurable benefits
The survey offers evidence that organisations which regularly test their plans and integrate ICS/OT security into business continuity and disaster recovery programmes are better positioned to restore operations.
Among organisations that test their plans at least annually and include ICS/OT in business continuity and disaster recovery planning, 46% said they could bring their most critical facility or system back online within the first day. Across all respondents, the comparable figure was 27%.
The difference suggests that preparation and rehearsal can have a direct impact on recovery performance. However, only 16% of respondents said cyber resilience was fully integrated into their business continuity and disaster recovery programmes.
This gap is significant because industrial cyber incidents cannot always be managed through the traditional separation of IT security, plant operations and business continuity. A compromised industrial environment may require coordinated decisions involving security teams, engineers, plant managers, safety personnel, vendors and executive leadership.
Organisations need to establish in advance who has authority to isolate systems, when operations should be moved to manual control, which processes must be restored first and how safety requirements will be maintained. These decisions are difficult to make for the first time during an active incident.
The survey’s findings therefore support a shift towards treating ICS/OT cyber resilience as part of operational continuity planning. Testing should involve the personnel who would actually run the facility during a disruption, rather than being limited to tabletop exercises conducted by security teams.
Vendor and supply chain dependencies create further exposure
The report also highlights the risks created by dependence on automation vendors and specialised suppliers. If their primary automation vendor disappeared, 58% of respondents said their organisation would shut down or become unable to operate within a year. Only 10% believed they could continue operating indefinitely.
The findings expose the operational implications of vendor concentration and the difficulty of maintaining industrial systems that depend on proprietary technologies, specialised support and long-term supplier relationships.
Cybersecurity and resilience planning must therefore account for more than the security of equipment and software. Organisations need to understand how they would maintain, repair and operate critical systems if a vendor could no longer provide support. This includes documenting system configurations, maintaining access to essential technical information and identifying alternative support arrangements.
Despite the risks, only 20% of respondents reported having a fully functional supply chain cyber risk management programme. This suggests that vendor and supplier dependencies remain insufficiently addressed in many industrial security strategies.
The exposure is closely connected to the shortage of key personnel. If an organisation depends on a small number of employees and a single technology supplier, the loss of either can undermine its ability to respond to an incident or restore operations.
AI adoption and threat intelligence gain ground
The survey also examined the use of AI and automation in industrial cybersecurity. Around 33% of respondents said they were deploying AI or automation tools to augment security staff. Among these organisations, real-time threat and anomaly detection was the most common application, reported by 42%.
The figures suggest that industrial security teams are beginning to use AI to address operational challenges, particularly the need to identify suspicious behaviour across complex environments. However, adoption remains focused on supporting personnel rather than replacing the expertise required to understand industrial processes and respond safely.
Threat intelligence adoption has also reached a new high. Some 74% of respondents said they use ICS/OT-specific threat intelligence, compared with 67% in the previous year. This growing use indicates that organisations increasingly recognise the value of understanding threats and attacker techniques that are specific to industrial environments.
Threat intelligence can help security teams identify relevant indicators, understand emerging attack methods and improve detection priorities. Its value, however, depends on whether intelligence is translated into practical controls, response procedures and operational decisions.
Resilience requires rehearsal, not just technology
The SANS report concludes that the strongest resilience outcomes are associated with established organisational practices: regular testing, accurate documentation, cross-training and integration with business continuity disciplines.
It recommends that organisations test their response plans at least annually with the operators who would be responsible for manual operations; integrate ICS/OT security into existing business continuity and disaster recovery exercises; and map dependencies on critical personnel and technology vendors.
These steps are not substitutes for modern detection and protection technologies. Rather, they address the operational weaknesses that technology alone cannot resolve. A security platform may identify an intrusion, but it cannot guarantee that a facility can continue operating safely, that undocumented expertise will be available or that a supplier can provide emergency support.
Christopher said organisations do not need an entirely new framework to act on the findings. Those that understand their own systems best are more likely to get through a difficult incident.
For industrial organisations, the message is clear: cybersecurity maturity must be measured not only by how quickly an attack is detected, but also by whether critical operations can withstand disruption and recover safely. As incidents become more frequent and their consequences more severe, operational resilience is becoming a defining measure of industrial security.
