SANS 2026 Survey Reveals Sharp Rise in ICS/OT Cyber Incidents, Slower Detection, and Increased Operational Impact
The SANS Institute's 2026 State of ICS/OT Security Survey indicates a significant increase in cyber incidents affecting Industrial Control Systems (ICS) and Operational Technology (OT), with 34% of respondents reporting incidents in the past year—the largest increase recorded since tracking began. Ransomware attacks and shared IT/OT credential compromises each accounted for 31% of incidents, while supply chain compromises made up 21%. Detection times have slowed for the first time, with only 41% of incidents detected within 24 hours, contributing to more severe impacts such as increased facility downtime (72%), doubling of safety incidents, and a fivefold rise in intellectual property theft. The survey highlights critical gaps in cyber resilience, including limited capabilities to sustain manual operations, poor integration of ICS/OT cyber resilience into business continuity and disaster recovery programs, and insufficient supply chain risk management. Organizations with better IT-OT visibility and integrated resilience plans recover faster and sustain operations longer, underscoring the need for enhanced cyber resilience strategies in industrial environments.
Detalhes técnicos
The survey involved 696 industrial security professionals, revealing ransomware and shared credential compromise are the top ICS/OT threats. Supply chain risks are notably increasing due to regulatory focus and geopolitical tensions. Manual operation sustainability beyond 48 hours is low (15%), with 40% of respondents unsure, posing operational risks if automated systems fail. Detection is most effective through ICS-specific tools (38%) and trained operators (20%), although budget constraints limit detection platform expansions.
Remediação
Emphasizing cyber resilience by integrating it with business continuity and disaster recovery programs, regular testing of resilience plans, enhanced IT-OT visibility, formal operator training, and developing strong supply chain cyber risk management can reduce downtime and facilitate faster recovery. Organizations are encouraged to build ICS/OT-specific skill sets internally due to workforce shortages and adopt AI/automation tools to alleviate operational burdens. Preparing for worst-case scenarios, such as vendor disappearance, requires robust planning as transition to alternative vendors may take years.
Linha do tempo
-
SANS 2026 Survey Reveals Sharp Rise in ICS/OT Cyber Incidents, Slower Detection, and Increased Operational Impact
ler a análise desta fonte ocultar
The SANS Institute's 2026 State of ICS/OT Security Survey indicates a significant increase in cyber incidents affecting Industrial Control Systems (ICS) and Operational Technology (OT), with 34% of respondents reporting incidents in the past year—the largest increase recorded since tracking began. Ransomware attacks and shared IT/OT credential compromises each accounted for 31% of incidents, while supply chain compromises made up 21%. Detection times have slowed for the first time, with only 41% of incidents detected within 24 hours, contributing to more severe impacts such as increased facility downtime (72%), doubling of safety incidents, and a fivefold rise in intellectual property theft. The survey highlights critical gaps in cyber resilience, including limited capabilities to sustain manual operations, poor integration of ICS/OT cyber resilience into business continuity and disaster recovery programs, and insufficient supply chain risk management. Organizations with better IT-OT visibility and integrated resilience plans recover faster and sustain operations longer, underscoring the need for enhanced cyber resilience strategies in industrial environments.
Technical Details
The survey involved 696 industrial security professionals, revealing ransomware and shared credential compromise are the top ICS/OT threats. Supply chain risks are notably increasing due to regulatory focus and geopolitical tensions. Manual operation sustainability beyond 48 hours is low (15%), with 40% of respondents unsure, posing operational risks if automated systems fail. Detection is most effective through ICS-specific tools (38%) and trained operators (20%), although budget constraints limit detection platform expansions.
Remediation
Emphasizing cyber resilience by integrating it with business continuity and disaster recovery programs, regular testing of resilience plans, enhanced IT-OT visibility, formal operator training, and developing strong supply chain cyber risk management can reduce downtime and facilitate faster recovery. Organizations are encouraged to build ICS/OT-specific skill sets internally due to workforce shortages and adopt AI/automation tools to alleviate operational burdens. Preparing for worst-case scenarios, such as vendor disappearance, requires robust planning as transition to alternative vendors may take years.