OT Incidents Hit a Third of Industrial Organizations, SANS Finds

A third of organizations running OT or industrial control systems (ICS) recorded at least one cyber incident over the past year, according to new data from SANS Institute.

The cybersecurity training and research specialist polled nearly 700 IT and security professionals to compile its 2026 State of ICS/OT Security Survey Insights report.

It revealed the biggest ever single-year leap in incidents, from 22% last year to 34% of responding organizations in 2026.

The impact of incidents was also more severe. The share of respondents who said an incident affected safety increased from 8% to 13% in the period, and the share reporting theft of IP surged from 6% to 31%.

Shared IT/OT credential and identity compromise (31%) and ransomware (31%) were the most frequently cited incident types this year.

Read more on ICS threats: ICS Operators Warned of AI-Driven Attacks on Siemens PLCs

Poor visibility into systems appears to be a contributing factor to the rise in incidents and the severity of their impact.

Just 13% of respondents claimed to have full IT/OT visibility across the cyber kill chain, with budget (43%) cited as the most common barrier to improved detection.

Early detection is key to minimizing the impact of incidents. Nearly three-quarters (72%) of respondents said these led to facility or system downtime.

Only 15% of respondents said they are fully capable of sustaining critical operations in manual mode for more than 48 hours, while two-fifths (40%) don’t know if they could. In the longest case reported, a shutdown lasted a year.

Risk is arguably greatest in the supply chain. If their primary automation vendor disappeared, 58% of respondents said they would shut down or be unable to operate within a year. Yet only a fifth (20%) have a fully functional third-party risk management program.

A Plan to Build OT Resilience

Staff are another potential point of failure: 68% of organizations said that the loss of one or two key individuals would delay or severely risk ICS/OT security and incident response. A third (33%) are deploying AI or automation tools to overcome potential staff shortages, with real-time threat and anomaly detection (42%) the most common investment.

There are plenty of lessons to be learned from the report. Nearly half (46%) of organizations that test their business continuity and disaster recovery plans at least annually and build ICS/OT into them can bring their most critical facility or system back online within the first day, versus 27% of all respondents.

Yet only 16% of respondents have fully integrated cyber resilience into those programs.

The recent cyber-attacks on supermarket OT equipment across Europe highlight the potential for significant operational disruption and financial damage.

With this in mind, SANS Institute recommended a three-point plan to build resilience:

• Test resilience plans at least annually, with the operators who would end up actually run manual mode
• Integrate ICS/OT cyber resilience into existing BC/DR programs
• Map people and vendor-related dependencies

Jason Christopher, SANS Principal Instructor and author of the report, argued that the most resilient organizations are also the ones that known their ICS/OT systems best.

“Industrial security has come a long way over the past decade, and the data this year shows how much is still left to do,” he added.

“What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable. Most of the industry has not answered those questions yet.”