The 2026 State of ICS/OT Security Survey reveals a record increase in attacks, with 72% of cyber incidents disrupting critical business operations.
Industrial control systems (ICS) and operational technology (OT) environments are facing a sharp increase in cyber threats. According to the SANS Institute’s newly released 2026 State of ICS/OT Security Survey, 34% of industrial organizations reported a cyber incident over the past year, the largest single-year jump in the survey’s history.
The severity of these breaches has also escalated, with 13% of respondents reporting an impact on physical safety and 31% experiencing theft of intellectual property. Ransomware and shared IT/OT credential compromises tied as the most common attack vectors.
Key Findings from 2026 State of ICS/OT Security Survey
- Widespread Operational Disruption: Of the organizations targeted, 72% reported that the incidents directly disrupted business operations.
- Manual Operations Vulnerability: When centralized SCADA or DCS controls fail, only 15% of organizations are fully capable of sustaining critical operations in manual mode for more than 48 hours.
- Severe Vendor Dependence: 58% of respondents stated they would shut down or be unable to operate within a year if their primary automation vendor disappeared.
- AI for Threat Detection: To counter resource constraints, 33% of organizations are deploying AI or automation tools to augment security staff, primarily focusing on real-time threat and anomaly detection.
- Record Threat Intel Usage: 74% of respondents now use ICS/OT-specific threat intelligence, marking an all-time high for the survey.
“What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable,” said Jason Christopher, SANS Principal Instructor and author of the report. “The organizations that understand their own systems best are the ones most likely to get through a hard day.”
Data confirmed that organizations testing their continuity plans at least annually recover much faster, with 46% able to bring their most critical facility back online within the first day.
Disclaimer: This article is based on the official announcement by the SANS Institute and has been edited for length and readability. Data points and survey results are based on information provided by the organization.
