Industrial Cybersecurity Resilience Under Scrutiny in 2025

• •SANS survey reveals significant resilience gaps in ICS/OT cybersecurity.
• •Many organizations lack visibility and integration of resilience into recovery plans.
• •Focus has shifted from prevention to operational continuity during incidents.

The SANS 2026 ICS/OT Security Survey reveals significant gaps in cyber resilience among industrial organizations. Many respondents reported experiencing confirmed ICS/OT incidents in the past year, with a notable percentage unable to maintain manual operations beyond 48 hours during incidents. The survey highlights a lack of full IT-OT visibility and integration of resilience into business continuity and disaster recovery plans. The focus has shifted from merely preventing incidents to ensuring operations can continue safely during and after an attack. This year's survey included nearly 700 responses, marking one of the highest participation rates in its history. The findings indicate that many organizations still struggle with incident detection and recovery readiness, underscoring the need for improved governance and accountability in OT cybersecurity metrics. The report emphasizes the importance of validated asset visibility and tested controls to enhance resilience.