Essential Insights
-
ICS/OT incidents surged: 34% of 696 respondents reported an incident in the past year—the sharpest rise in the survey’s history. Ransomware and shared IT/OT credential compromise each accounted for 31% of incidents; supply-chain compromise accounted for 21%.
-
Attacks are harder to detect and more disruptive: Detection slowed for the first time, with only 41% of incidents found within 24 hours. 72% caused downtime; safety impacts nearly doubled to 13%, and reported intellectual-property theft rose fivefold to 31%.
-
Operational resilience remains weak: Just 15% could sustain safe manual operations for more than 48 hours, 16% had fully integrated cyber resilience into continuity and recovery plans, and 40% did not know whether they could operate without centralized control systems.
- Preparation improves recovery—but vendor dependence is a major risk: Annual testing and BC/DR integration were associated with more same-day recoveries. Yet only 10% could sustain production indefinitely if their primary OT vendor disappeared, while 58% expected to stop operating within a year.
Underlying Problem
The SANS Institute’s 2026 State of ICS/OT Security Survey found that 34% of 696 industrial security professionals had experienced a cyber incident affecting industrial control systems or operational technology in the previous year. This was the survey’s largest annual increase. Ransomware and compromised credentials shared across IT and OT each accounted for 31% of reported incidents; supply-chain attacks accounted for 21%. The findings suggest industrial systems are facing more frequent and damaging attacks, while detection is becoming slower.
The consequences extended beyond cybersecurity: 72% of incidents caused facility or system downtime, and reported safety impacts and intellectual-property theft rose sharply. Yet many organizations said they lacked tested plans to maintain safe operations or recover. For example, only 15% could sustain critical processes in manual mode for more than 48 hours, and just 16% had fully integrated cyber resilience into business continuity and disaster recovery. Industrial Cyber reported these findings from the SANS survey, which also found that regular resilience testing and stronger IT/OT visibility were associated with faster recovery and greater ability to withstand disruption.
Risk Summary
The SANS 2026 survey points to a risk that can reach any business—not only factories or utilities. If attackers compromise operational technology, such as building controls, production equipment, or logistics systems, they can disrupt the processes a company depends on. Meanwhile, slower detection gives an intrusion more time to spread, damage equipment, or interrupt service. The consequences can be severe: lost revenue, delayed orders, safety hazards, regulatory scrutiny, and lasting harm to customer trust. Even businesses without industrial systems may suffer when suppliers, facilities, or essential services are affected. Therefore, every organization has reason to understand its connected operations, limit access, and prepare to respond quickly.
Fix & Mitigation
When OT incidents are detected later and cause more severe operational disruption, timely, safety-conscious remediation can limit damage and prevent compromise from spreading.
Mitigation Priorities
- Establish operational risk: Identify and prioritize critical OT assets, dependencies, safety functions, and known vulnerabilities; assess how exploitation could affect availability, integrity, and physical processes.
- Contain exposure: Segment IT and OT networks, restrict unnecessary communications, and secure remote access with multifactor authentication, time-limited approvals, and session monitoring.
- Harden systems: Disable unused services and accounts, apply secure configurations, and use application allowlisting where feasible. Replace default credentials and protect engineering workstations and control-system interfaces.
- Remediate vulnerabilities safely: Prioritize fixes by exploitability and operational consequence. Test patches in a representative environment, coordinate with vendors and plant operators, and schedule deployment to minimize safety and availability risks. Where patching is not feasible, apply compensating controls.
- Improve detection: Monitor OT network traffic and critical system activity for anomalous behavior; ensure alerts reach personnel able to investigate and act. Validate logging coverage and synchronize system clocks where possible.
- Prepare and respond: Maintain OT-specific incident procedures, defined escalation paths, and tested isolation options. Exercise scenarios involving ransomware, loss of visibility, and disrupted control processes.
- Restore and learn: Keep protected, tested backups of system configurations and essential data. After an incident or exercise, verify recovery procedures, address root causes, and update controls and response plans.
Advance Your Cyber Knowledge
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
