SANS Institute Finds OT incidents hit one-third of industrial organizations

The share of organizations running operational technology or industrial control systems that reported a cyber incident rose from 22 percent last year to 34 percent in 2026, the largest single-year increase in the survey’s history, according to SANS Institute data.

Safety impacts grew alongside the frequency. Incidents affected safety at 13 percent of organizations in 2026, up from 8 percent the previous year. 31 percent of organizations reported theft of intellectual property in 2026, up from 6 percent the previous year. Shared IT/OT credential and identity compromise and ransomware tied as the most frequent incident types, each cited by 31 percent of respondents.

Incidents caused facility or system downtime at 72 percent of organizations. Limited visibility into systems appears to help explain the increase in incidents and the severity of their effects. Many organizations cannot improve detection capabilities because of budget constraints.

According to 43 percent of respondents, cost is the top obstacle to expanding ICS/OT detection. Just 13 percent of respondents said they have full visibility across the IT/OT cyber kill chain (the stages of an attack, from reconnaissance to impact).

Incidents found within 24 hours accounted for 41 percent of cases, down from the prior year, indicating slower detection. ICS/OT visibility and threat detection platforms now lead detection methods, spotting 38 percent of reported incidents before IT perimeter tools or trained operators. These specialized platforms barely existed 10 years ago but have become the primary means of finding incidents within the past decade.

Fifty-eight percent of organizations said a shutdown would be forced or operation would become impossible within a year if they lost their primary automation vendor. Just 20 percent of organizations operate a fully functional third-party risk management program. Losing one or two key staff members would delay or seriously endanger ICS/OT security and incident response, according to 68 percent of organizations.

Thirty-three percent of organizations are deploying AI or automation tools to address possible staff shortages. Real-time threat and anomaly detection is the most common investment among those tools, cited by 42 percent.

Fully maintaining critical operations in manual mode beyond 48 hours is possible for only 15 percent of organizations. Forty percent of organizations said they are unsure whether critical operations could continue in manual mode past 48 hours. Survey respondents reported a shutdown that lasted one year, the longest in the data.

When a facility loses centralized SCADA (supervisory control and data acquisition) or DCS (distributed control system) control, manual operations serve as the fallback. Recent attacks hit power systems in Poland and water systems in the United States, according to survey material cited in the report. Nearly 700 industrial security professionals from every major critical infrastructure sector have taken part in this survey every year since 2017.

Recent attacks on supermarket operational technology in Europe show that financial damage and major operational disruption can result. Heavy reliance on a single automation vendor creates supply-chain risk because most organizations cannot operate long without it. The loss of a few key personnel threatens industrial security and incident response.

Among organizations that include ICS/OT in business continuity and disaster recovery plan tests at least annually, 46 percent restore their most critical site or system within the first day, compared with 27 percent across all organizations. Full integration of cyber resilience into business continuity and disaster recovery programs exists at only 16 percent of organizations.

Testing resilience plans that include ICS/OT at least annually helps organizations restore critical systems faster. SANS Institute says organizations should integrate ICS/OT cyber resilience into existing business continuity and disaster recovery programs. The most resilient organizations know their ICS/OT systems best, according to Jason Christopher, SANS Principal Instructor and author of the report.

Jason Christopher, SANS Principal Instructor and author of the report, said, “What happens after the alarm comes down to rehearsal.” Resilience plans should be tested no less than annually alongside the operators responsible for manual mode, SANS Institute recommends. SANS Institute also recommends mapping dependencies involving people and vendors.

As Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners, Jason Christopher teaches SANS ICS456: Essentials for NERC Critical Infrastructure Protection and co-authors ICS418: ICS Security Essentials for Leaders. “Industrial security has come a long way over the past decade,” Christopher said.