A third of industrial organizations reported an OT incident, SANS finds
Original title: OT Incidents Hit a Third of Industrial Organizations, SANS Finds
Among nearly 700 respondents, incidents rose from 22% to 34%, and reported IP theft jumped from 6% to 31%.
SANS Institute’s 2026 State of ICS/OT Security Survey Insights says 34% of organizations running OT or ICS recorded at least one cyber incident in the past year, up from 22%. Safety impact rose from 8% to 13%. Shared IT/OT credential compromise and ransomware were each cited by 31% of respondents. Only 13% claimed full IT/OT visibility, 72% said incidents caused downtime, and 58% said losing their primary automation vendor would stop operations within a year.
Unconfirmed: Figures are self-reported by survey respondents, not confirmed incident investigations.
- SANS polled nearly 700 IT and security professionals.
- Only 15% said they can run critical operations manually for more than 48 hours.
- One reported shutdown lasted a year.
- Just 20% have a fully functional third-party risk program.
- 46% that test BC/DR at least annually restored a critical system within a day, versus 27% overall.
- 1.Test OT resilience plans at least annually with the operators who would run manual mode.
- 2.Integrate ICS/OT cyber resilience into existing business-continuity and disaster-recovery programs.
- 3.Map dependence on key staff and automation vendors.
- Organizations
- SANS Institute
From the original article
3 min read at infosecurity-magazine.com
SANS Institute records largest single-year jump in ICS/OT cyber incidents
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.