Discrepancies in ICS Cyberattack Resilience Confidence and Preparedness Revealed by SANS 2026 Survey
The SANS 2026 ICS/OT survey highlights a significant gap between industrial cybersecurity leaders' confidence in operational continuity during cyberattacks and their engineers' more cautious assessments. While all CISOs surveyed believe their plants will continue running through IT compromises using islanded ICS/OT or manual controls, only 15% of frontline operators are confident in sustaining safe manual operations beyond 48 hours. Incident frequency has sharply increased with 34% experiencing ICS/OT incidents in the past year, resulting in downtime in 72% of events, while detection speed has declined. Confidence in resilience planning is undermined by limited technical validation exercises, with only 14% conducting routine ICS-specific threat hunting or red/purple teaming. Moreover, personnel and vendor dependencies pose operational risks, and budget limitations restrict the deployment of dedicated ICS/OT detection platforms, which, despite detecting 38% of incidents, are underutilized. The report urges enhanced collaboration between IT and OT teams and regular resilience testing to improve cyber incident response and recovery.
Linha do tempo
-
Discrepancies in ICS Cyberattack Resilience Confidence and Preparedness Revealed by SANS 2026 Survey
ler a análise desta fonte ocultar
The SANS 2026 ICS/OT survey highlights a significant gap between industrial cybersecurity leaders' confidence in operational continuity during cyberattacks and their engineers' more cautious assessments. While all CISOs surveyed believe their plants will continue running through IT compromises using islanded ICS/OT or manual controls, only 15% of frontline operators are confident in sustaining safe manual operations beyond 48 hours. Incident frequency has sharply increased with 34% experiencing ICS/OT incidents in the past year, resulting in downtime in 72% of events, while detection speed has declined. Confidence in resilience planning is undermined by limited technical validation exercises, with only 14% conducting routine ICS-specific threat hunting or red/purple teaming. Moreover, personnel and vendor dependencies pose operational risks, and budget limitations restrict the deployment of dedicated ICS/OT detection platforms, which, despite detecting 38% of incidents, are underutilized. The report urges enhanced collaboration between IT and OT teams and regular resilience testing to improve cyber incident response and recovery.