Honeywell OT Benchmark: Leaders Overrate Maturity as Incidents Mount; AI Assists Analysts but Autonomy Stays Rare

Honeywell's 2026 OT Cybersecurity Benchmark Report, surveying 603 critical-infrastructure leaders, finds a stark readiness gap: 88% rate their programs mature and 72% use AI for threat detection, yet only 21% maintain a complete asset inventory and just 23%…

Honeywell's 2026 OT Cybersecurity Benchmark Report, based on a survey of 603 critical-infrastructure leaders conducted in May and June, reveals a disconnect between perceived and actual OT security readiness. While 88% of leaders rated their programs as mature, only 21% maintain a complete OT asset inventory, only 16% continuously monitor most building automation systems, and only 20% do so for devices such as cameras. Just 31% called themselves fully ready — a notably lower figure than the 88% who described their programs as mature, though the two reports frame these as separate survey measures rather than a contradiction. The gap has operational consequences: significant incidents averaged 16.2 hours of downtime, and better-inventoried teams recovered within six hours far more often (42% versus 25%). Compliance posture did not predict incidents, with organizations passing every audit reporting incidents at nearly the same rate as those with findings (74% versus 73%). Incident pressure is high overall — 91% of energy and utilities respondents reported a significant OT incident in the past 12 months. AI is increasingly embedded in OT security, with 72% using it for threat detection, but autonomous or agentic deployment remains rare at 23%. The findings come amid real-world pressure: by early August, attackers had remotely accessed internet-facing PLCs at water systems in at least seven U.S. states, with investigators examining possible Iran-backed involvement.

• Honeywell surveyed 603 critical-infrastructure leaders in May and June for its 2026 OT Cybersecurity Benchmark Report.
• 88% of leaders rate their OT security programs as mature, yet only 21% maintain a complete asset inventory and only 31% call themselves fully ready.
• Only 16% continuously monitor most building automation systems; 20% continuously monitor devices such as cameras.
• Significant OT incidents averaged 16.2 hours of downtime; 42% of teams with stronger inventories recovered within six hours versus 25% of those with weaker inventories.
• 91% of energy and utilities respondents reported a significant OT incident in the past 12 months.
• Compliance audits did not predict incidents: 74% of organizations that passed every audit still reported a significant incident, versus 73% of those with audit findings.
• 72% of respondents use AI for threat detection, but only 23% deploy autonomous or agentic AI.
• Context: By early August, attackers had remotely accessed internet-facing PLCs at water systems in at least seven U.S. states, with investigators examining possible Iran-backed hackers.