The SANS 2026 State of ICS/OT Security Survey, drawing nearly 700 responses from energy, manufacturing, IT, and government security practitioners worldwide, found 34 percent of organizations experienced a confirmed ICS/OT incident, the largest single-year jump in survey history, and 72 percent of confirmed attacks caused facility or system downtime.
Reporting Friday from Industrial Cyber and TechItUpME noted that ransomware and compromised shared IT/OT credentials tied as the top initial attack vectors; for the first time on record, only 41 percent of incidents were caught within 24 hours, down from more than 50 percent in prior years; physical safety impacts nearly doubled from 7 percent in 2025 to 13 percent in 2026; 31 percent of respondents reported intellectual property theft.
Help Net Security noted confidence gaps persist between chief information security officers and plant-floor engineers regarding attack survivability; executives express optimism about recovery readiness, while frontline engineers point to legacy equipment and unpatched controllers. Only 15 percent of industrial organizations confirmed they can run manual operations past 48 hours without centralized digital control, while 40 percent admit they do not know whether they could sustain output; just 13 percent report full IT-OT visibility across operations, and only 20 percent maintain functional supply-chain cyber risk programs; with 68 percent warning they would face severe operational delays if they lost one or two key technical personnel.
While 74 percent of respondents now deploy ICS-specific threat intelligence—up from 67 percent in 2025 and the highest level recorded—43 percent cite budget limits as their primary barrier to expanding native OT detection; only 16 percent have fully integrated ICS/OT resilience into formal business continuity and disaster recovery plans; organizations that test their incident response plans annually bring critical facilities back online the same day 46 percent of the time, compared with 27 percent overall.
