“What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable. Most of the industry has not answered those questions yet,” Jason Christopher, SANS Principal Instructor and author of the report, wrote.
Scope of the problem: steep rise in OT/ICS incidents
New data from the SANS Institute shows a sharp increase in cyber incidents against operational technology (OT) and industrial control systems (ICS). Surveying nearly 700 IT and security professionals for its 2026 State of ICS/OT Security Survey Insights, SANS found that 34% of responding organizations recorded at least one OT/ICS incident in the past year — up from 22% the previous year. That represents the largest single-year leap recorded by the survey.
Incident types and worsening impacts
The effects of those incidents also escalated. Respondents reporting that an incident affected safety rose from 8% to 13%. Reports of intellectual property theft surged from 6% to 31%. The two most frequently cited incident types in 2026 were shared IT/OT credential and identity compromise (31%) and ransomware (31%). The report singled out recent cyber-attacks on supermarket OT equipment across Europe as an example of operational disruption and financial damage caused by such incidents.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPoor visibility and delayed detection drive downtime
Limited visibility into OT environments appears to be a central contributor. Only 13% of respondents claimed full IT/OT visibility across the cyber kill chain. Budget constraints were the single most commonly cited barrier to improved detection, named by 43% of respondents. Early detection remains crucial: 72% of respondents said incidents led to facility or system downtime. In one extreme case reported, a shutdown lasted a year.
Dependencies: vendors, staffing, and resilience gaps
Supply-chain and human dependencies amplify risk. If a primary automation vendor disappeared, 58% of organizations said they would shut down or be unable to operate within a year. Yet only 20% reported having a fully functional third-party risk management program. Staff loss is likewise a concern: 68% said the loss of one or two key individuals would delay or severely risk ICS/OT security and incident response. Preparedness for manual operation is limited — only 15% said they are fully capable of sustaining critical operations in manual mode for more than 48 hours, while 40% don’t know whether they could. The longest outage the survey recorded lasted a year.
Resilience investments, testing, and SANS’ three-point plan
Organizations are moving to shore up weaknesses, but gaps persist. One-third (33%) are deploying AI or automation tools; the most common investment was real-time threat and anomaly detection (42%). Testing and integration of business continuity and disaster recovery (BC/DR) plans made a measurable difference: among organizations that test BC/DR at least annually and include ICS/OT, 46% can bring their most critical facility or system back online within the first day, compared with 27% of all respondents. Still, only 16% said they have fully integrated cyber resilience into those programs.
SANS recommended a three-point plan to build OT resilience: test resilience plans at least annually with the operators who would run manual mode; integrate ICS/OT cyber resilience into existing BC/DR programs; and map people- and vendor-related dependencies.
What this means for technologists, procurement leaders, and plant operators
- Technologists and security teams: Limited detection and the prevalence of credential compromise and ransomware mean detection investments — especially for real-time anomaly and threat detection — and regular, operator-led resilience drills will determine whether an incident becomes a short interruption or a long shutdown.
- Procurement and vendor managers: With 58% saying they would be unable to operate within a year if a primary automation vendor disappeared and only 20% running a fully functional third-party risk program, procurement teams must map vendor dependencies and build contingency plans into contracts and BC/DR exercises.
- Plant operators and business continuity planners: Organizations that tested BC/DR annually and included ICS/OT recovered faster; yet only 16% have fully integrated cyber resilience. The ability to run critical assets manually and to codify tacit operational knowledge are immediate, practical shortfalls to address.
Jason Christopher framed the challenge succinctly: industrial security has improved, but preparedness for the moment after an alarm — rehearsal, explicit knowledge, and vendor fallbacks — remains uneven. SANS’ numbers map a clear direction for action: improve visibility, prioritize early detection, test manual operations with the people who must execute them, and catalog vendor and personnel dependencies before the next incident forces those questions into the open.
https://www.infosecurity-magazine.com/news/ot-incidents-third-industrial/
