One in three organizations operating industrial control systems or operational technology experienced at least one cyber incident in the past year, according to new research from SANS Institute. The cybersecurity training and research organization surveyed nearly 700 IT and security professionals for its 2026 State of ICS/OT Security Survey Insights report. The findings reveal the largest single-year jump in incidents ever recorded, climbing from 22% of organizations affected last year to 34% in 2026.
The consequences of these attacks grew more serious across multiple dimensions. The proportion of respondents reporting that an incident compromised safety rose from 8% to 13% during the period, while the share experiencing intellectual property theft surged from 6% to 31%. Credential and identity breaches affecting shared IT/OT systems tied with ransomware as the most frequently reported incident types this year, each cited by 31% of affected organizations. Nearly three-quarters of respondents—72%—said these incidents caused facility or system downtime, with the longest reported shutdown lasting an entire year. Only 15% of organizations said they could fully sustain critical operations in manual mode for more than 48 hours, while two-fifths don't know whether they could.
The report identifies poor visibility into systems as a driving factor behind both the rise in incidents and the severity of their consequences. Just 13% of respondents claimed to have complete IT/OT visibility across the cyber kill chain, with budget constraints cited by 43% as the most common obstacle to better detection capabilities. Supply chain vulnerabilities present what may be the greatest risk: 58% of respondents said they would shut down or become unable to operate within a year if their primary automation vendor disappeared, yet only one-fifth have a fully functional third-party risk management program in place. Staffing represents another critical weakness, with 68% of organizations acknowledging that losing one or two key individuals would delay or severely jeopardize ICS/OT security and incident response.
Organizations that regularly test their business continuity and disaster recovery plans see tangibly better outcomes when incidents occur. Nearly half—46%—of organizations that test these plans at least annually and incorporate ICS/OT into them can restore their most critical facility or system within the first day, compared to just 27% of all respondents. Yet only 16% have fully woven cyber resilience into those programs, according to the report. Poor visibility hampers early detection, which is essential to limiting damage. One-third of organizations are deploying AI or automation tools to address potential staff shortages, with real-time threat and anomaly detection representing the most common investment at 42%.
SANS Institute recommended a three-point plan to strengthen resilience: test resilience plans at least annually with the operators who would actually run manual mode, integrate ICS/OT cyber resilience into existing business continuity and disaster recovery programs, and map dependencies related to personnel and vendors. Jason Christopher, SANS Principal Instructor and author of the report, argued that the most resilient organizations are those with the deepest knowledge of their ICS/OT systems. "Industrial security has come a long way over the past decade, and the data this year shows how much is still left to do," he added. "What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable." The question of operational continuity during extended vendor unavailability or key personnel loss remains unanswered for most of the industry, creating vulnerabilities that attackers can exploit with increasingly severe consequences. For executives balancing capital allocation across competing priorities, the gap between testing frequency and integration depth suggests that resilience investments may be scattered rather than strategic, leaving critical infrastructure exposed even when budgets are committed.