A new survey by the SANS Institute reveals that 34% of industrial organisations experienced a cyber incident, with 72% of those facing operational disruptions. Detection times have lengthened, and impacts such as intellectual property theft and safety threats have increased. The report highlights severe risks around vendor reliance, lack of manual fallback capability, and key personnel shortages, urging organisations to integrate cyber resilience into continuity plans.
The survey gathered responses from nearly 700 industrial security professionals across every major critical infrastructure sector and has run annually since 2017. Christopher teaches SANS ICS456: Essentials for NERC Critical Infrastructure Protection, co-authors ICS418: ICS Security Essentials for Leaders, and is Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners.
Detection times slipped: 41% of incidents were found within 24 hours, down from last year. Dedicated ICS/OT visibility and threat detection platforms, a capability that barely existed 10 years ago, now lead all detection methods, finding 38% of reported incidents, ahead of IT perimeter tools and trained operators.
Impacts were also more severe than a year ago. The share of respondents who said an incident affected safety increased from 8% last year to 13% in 2026, and the share reporting theft of intellectual property rose more than fivefold, from 6% to 31%. In the longest case reported, the shutdown lasted a year. Shared IT/OT credential and identity compromise tied ransomware as the most common incident type this year, each at 31%.
Only 13% of respondents report full IT/OT visibility across the cyber kill chain, and budget is the most commonly cited barrier to expanding ICS/OT detection, named by 43% of respondents.
“Industrial security has come a long way over the past decade, and the data this year shows how much is still left to do,” said Christopher. “What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable. Most of the industry has not answered those questions yet.”
Manual operations are the fallback when a facility loses centralized SCADA or DCS control. Just 15% of respondents are fully capable of sustaining critical operations in manual mode for more than 48 hours, and 40% do not know whether they could. Organizations that test their plans at least annually and build ICS/OT into business continuity and disaster recovery programs restore faster: 46% can bring their most critical facility or system back online within the first day, compared with 27% of all respondents. Only 16% of respondents have fully integrated cyber resilience into those programs.
Additional key findings from the survey include:
- Vendor dependence is widespread: If their primary automation vendor disappeared, 58% of respondents would shut down or be unable to operate within a year, while 10% could operate indefinitely. Just 20% have a fully functional supply chain cyber risk management program.
- Key people are a single point of failure: 68% say losing one or two key individuals would delay or severely risk ICS/OT security and incident response.
- AI is aimed at defender pain points: 33% are deploying AI or automation tools to augment staff, and among them, real-time threat and anomaly detection is the most common use (42%).
- Threat intelligence use is at a high: 74% use ICS/OT-specific threat intelligence, up from 67% last year and an all-time high for the survey.
The report finds that the capabilities behind its strongest results are ordinary ones: testing, documentation, cross-training, and integration with disciplines industrial operators already trust. It closes with three steps: test plans at least annually with the operators who would run manual mode, fold ICS/OT into the continuity and disaster planning an organization already exercises, and map dependencies on key people and key vendors.
