State of ICS/OT Security 2025

Based on the SANS 2026 ICS/OT Security Survey, this page tracks incident trends, resilience gaps, and recovery readiness across industrial environments.

How Resilient Are Industrial Operations Today?

This year's SANS State of ICS/OT Security report shifts the focus from prevention and detection to resilience: whether operations can stay safe and running once an incident has already started. It traces what organizations know their own systems, how quickly they detect and recover, and where the gaps between a written plan and a tested one still remain.

experienced a confirmed ICS/OT incident this year

cannot say if manual operations would hold past 48 hours

report full IT-OT visibility across the ICS Cyber Kill Chain

have fully integrated ICS/OT resilience into BC/DR

Survey Methodology and Respondent Profile

The SANS 2026 State of ICS/OT Security Survey draws nearly 700 responses, one of the highest participation rates in the survey's nine-year history. Respondents are IT and security professionals actively working in security roles, led by the energy sector, followed by critical manufacturing, information technology, and government. This year's survey focuses on cyber resilience: whether organizations can keep operating safely once an incident is already underway.

Neary 700 Global Respondents

The most common roles are ICS/OT systems engineers, ICS/OT cybersecurity analysts, engineering or I&E managers, and operations managers. Respondents reported operations in the United States, Europe, Latin America, and Canada.

As with all SANS research, this survey's sponsors funded the study but had no role in designing the survey questions, collecting respondent data, or shaping the findings presented in this report.

Know where your program stands. Decide what to strengthen .

Setting priorities in an industrial security program takes more than knowing the threats. It takes an honest view of where your program is today, including the questions you can’t yet answer.

The SANS ICS Cyber Resilience Scorecard lets you compare your answers with those of nearly 700 survey respondents. Twelve questions, eleven organized under the SANS Five ICS Cybersecurity Critical Controls and one on supply chain risk, show where you meet the benchmark, where gaps remain, and what you can’t yet answer. Your results include SANS course recommendations aligned to your gaps.

Free. No registration. Answers stay in your browser. Takes a few minutes to complete.

Jason D. Christopher, Energy Impact Partners SVP, teaches ICS456 and co-authors ICS418, turning regulation into safe, reliable OT-supporting programs and metrics to align practitioners and leaders on clear, defensible action.

Thank You to Our Sponsors

More Key Findings From the SANS 2026 ICS/OT Security Survey

72% of ICS/OT incidents in 2026 caused facility or system downtime, and safety impacts on respondents nearly doubled year over year.

Detection times slowed for the first time on record: only 41% of incidents were caught within 24 hours, down from more than 50% in prior years.

74% of organizations now use ICS-specific threat intelligence, an all-time high, up from 67% in 2025.

43% of organizations cite budget as the top barrier to expanding ICS/OT detection, even though ICS-native platforms already catch more incidents (38%) than any other method.

Only 20% of organizations run a fully functional supply chain cyber risk program, and 68% face severe operational risk or delays if they lose one or two key people.

Watch the Related Webcast: Industrial Cybersecurity at a Crossroads

Hear SANS ICS Security instructor Jason D. Christopher unpack the 2026 State of ICS/OT Security findings: the largest single-year jump in incidents on record, why detection slowed for the first time, and what separates organizations that recover quickly from those that don't.

More Free ICS/OT Cybersecurity Resources to Explore

The Five ICS Cybersecurity Critical Controls

This paper sets forth the five most relevant critical controls for an ICS/OT cybersecurity strategy that can flex to an organization's risk model, and provides guidance for implementing them.

Review year’s data to see how the ICS/OT security industry is evolving year on year.

Frequently Asked Questions

34% of organizations experienced a confirmed ICS/OT cyber incident in 2026, the largest single-year jump in the survey's nine-year history, and 72% of those incidents caused facility or system downtime.

Not confidently. Only 15% of organizations can sustain manual operations for more than 48 hours without centralized SCADA or DCS control, and 40% don't know whether they could.

They worsened for the first time since SANS began tracking them. Only 41% of incidents were detected within 24 hours in 2026, down from more than 50% in prior years.

Testing resilience plans annually and integrating them into business continuity and disaster recovery (BC/DR). Organizations that do both bring critical facilities back online same-day 46% of the time, versus 27% overall.