SANS 2026 ICS/OT survey: incidents rise to 34% of industrial organizations as CISO confidence outpaces operator readiness
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 12/11/2026 12:04; os links antigos trazem para cá.
The SANS Institute 2026 ICS/OT survey finds that 34% of industrial organizations had a cyber incident affecting OT/ICS environments in the past year, up from 22% the year before (infosecurity-magazine.com, helpnetsecurity.com). Impact is getting worse: safety disruptions and IP theft have increased (infosecurity-magazine.com), and downtime occurred in 72% of events, while detection speed has declined (helpnetsecurity.com). Shared credential compromise and ransomware are the leading incident types (infosecurity-magazine.com). The survey also shows a gap between leadership and the plant floor. All CISOs surveyed believe their plants would keep running through an IT compromise using islanded ICS/OT or manual controls, but only 15% of frontline operators are confident they could sustain safe manual operations beyond 48 hours (helpnetsecurity.com). Coverage was published on 2026-11-11 and 2026-11-12.
Detalhes técnicos
- Contributing factors: poor visibility into OT systems and staffing shortages (infosecurity-magazine.com). Personnel and vendor dependencies add operational risk (helpnetsecurity.com).
- Validation gap: only 14% of organizations conduct routine ICS-specific threat hunting or red/purple teaming, which undermines confidence in resilience plans (helpnetsecurity.com).
- Detection tooling: dedicated ICS/OT detection platforms detected 38% of incidents but remain underutilized, as budget limits restrict their deployment (helpnetsecurity.com).
Remediação
- Test regularly, including technical validation exercises such as ICS-specific threat hunting and red/purple teaming (infosecurity-magazine.com, helpnetsecurity.com).
- Build integrated resilience planning and map dependencies, including personnel and vendors (infosecurity-magazine.com, helpnetsecurity.com).
- Improve OT visibility and strengthen collaboration between IT and OT teams (infosecurity-magazine.com, helpnetsecurity.com).
- Validate manual and islanded operating assumptions with engineers, not only with leadership (helpnetsecurity.com).
Linha do tempo
-
Discrepancies in ICS Cyberattack Resilience Confidence and Preparedness Revealed by SANS 2026 Survey
ler a análise desta fonte ocultar
The SANS 2026 ICS/OT survey highlights a significant gap between industrial cybersecurity leaders' confidence in operational continuity during cyberattacks and their engineers' more cautious assessments. While all CISOs surveyed believe their plants will continue running through IT compromises using islanded ICS/OT or manual controls, only 15% of frontline operators are confident in sustaining safe manual operations beyond 48 hours. Incident frequency has sharply increased with 34% experiencing ICS/OT incidents in the past year, resulting in downtime in 72% of events, while detection speed has declined. Confidence in resilience planning is undermined by limited technical validation exercises, with only 14% conducting routine ICS-specific threat hunting or red/purple teaming. Moreover, personnel and vendor dependencies pose operational risks, and budget limitations restrict the deployment of dedicated ICS/OT detection platforms, which, despite detecting 38% of incidents, are underutilized. The report urges enhanced collaboration between IT and OT teams and regular resilience testing to improve cyber incident response and recovery.
-
OT Incidents Reach a Third of Industrial Organizations, SANS Reports
ler a análise desta fonte ocultar
A recent survey by SANS Institute shows a significant increase in cyber incidents affecting OT and ICS environments, rising from 22% to 34% in a year. The impact of these incidents has become more severe, with increases in safety disruptions and IP theft. Shared credential compromise and ransomware are the leading incident types. Poor visibility into OT systems and staffing shortages are key contributing factors. The report emphasizes the importance of regular testing, integrated resilience planning, and dependency mapping to enhance security posture.