The SANS 2026 State of ICS/OT Security Report: Moving From Detection to Resilience

On July 26 and 27, operators at more than 30 community water systems in Minnesota were locked out of their own controllers after attackers changed passwords and IP addresses on internet-exposed devices. Within days, utilities in seven states had reported attacks to the FBI, and some were forced to issue boil-water notices and revert to manual operations. Governments are now planning for something worse. The Pentagon's FORTRESS initiative would require major U.S. military installations to sustain operations for at least 90 days without outside power, water, fuel, or communications. In October, the U.K. launched Be Ready, a three-year campaign asking households to prepare for at least three days of disruption to everyday services. France has approved a national tabletop exercise for 2027 that simulates a generalized blackout.

These programs reflect a growing recognition that amid geopolitical conflict, nations are positioned to inflict damage on critical infrastructure without launching a missile. Cyber warfare tactics targeting industrial environments pose a significant threat to society.

The SANS 2026 State of ICS/OT Security Report puts numbers to that concern. This year's report draws on responses from 696 ICS/OT security professionals across energy, manufacturing, government, and other critical infrastructure sectors, one of the highest participation rates in the survey's history. For the past decade, our industry has concentrated on protection and detection, and we've gotten much better at both. In 2026, the survey turned to a harder question: how do we keep the lights on during an active compromise? The data suggests some organizations are not prepared for that conversation yet.

With that in mind, the most telling figure in our report this year is that 40% of respondents cannot say whether they could sustain manual operations for more than 48 hours during an attack. The ability to run manually for limited periods is what allowed some of the targeted water utilities a path to continue providing service across their communities. The following six findings explain why that gap matters and what the organizations ahead of it are doing differently.

1. Incidents Rose, Detection Slowed, and Impacts Grew Heavier

One in three respondents (34%) reported an ICS/OT cyber incident in the past 12 months, up from 21.5% in 2025 and the largest single-year increase since SANS began tracking incident data. Ransomware accounted for 31% of those incidents, consistent with prior years, and this year it shared the top spot with shared IT/OT credential and identity compromise (31%). Supply chain compromise appeared in 21% of responses.

Alarmingly, detection times for ICS/OT incidents declined for the first time since SANS started collecting this data. Only 41% of incidents were detected within 24 hours, compared to more than 50% in last year’s report. The data does not point to a single cause, though the rise in incident volume may be a contributing factor. However, it is important to note that detection today still remains far faster than in 2019, when 50% of incidents were detected within the first week.

Impacts reached further into operations as well. Seventy-two percent of reported incidents involved facility or system downtime, safety impacts rose from 7% of respondents in 2025 to 13%, and theft of intellectual property increased from 6% to 31%. Ransomware incidents took the longest to recover from, with 31% requiring eight to 30 days to restore operations. These figures reinforce why this year's survey focused on resilience. As incidents become more frequent, the ability to maintain safe, reliable operations during an event is equally important to preventing one.

2. Detection Has Matured Into a Layered Discipline

Dedicated ICS/OT visibility and threat detection platforms are now the No. 1 way industrial incidents are discovered, catching 38% of those reported this year. A decade ago, purpose-built OT detection was still in its infancy. IT perimeter tools such as firewalls, IDS, IPS, and UTM alarms caught another 31%, followed by periodic log or change management review (22%), third-party notification (22%), and human operators (20%). The result is a layered defense in which technology and people each play a role.

Operators are an increasingly deliberate part of that picture. Among organizations where operators help detect anomalies, 58% have formally trained them, and another 30% plan to within the next 12 to 24 months. The people who run industrial processes every day are well positioned to notice when something isn't behaving as expected, and the most mature programs build them into detection and response exercises.

3. Threat Intelligence Use Reached an All-Time High

Seventy-four percent of respondents now use ICS/OT-specific threat intelligence, up from 67% last year and the highest level in the survey's history. Organizations are acting on it, too. Only 3% of respondents made no changes based on what they learned. The most common adjustments were updating detection logic or rules (48%), changing asset monitoring coverage (41%), prioritizing new tabletop or scenario planning (36%), and accelerating segmentation or architecture improvements (36%).

One area has room to grow. Just 26% have used threat intelligence to flag a specific vendor or software product for reassessment. With supply chain compromise appearing in one in five incidents this year, extending intelligence programs to vendor risk is a natural next step.

4. Few Organizations Have Full IT/OT Visibility. Those That Do Outperform Their Peers

Thirteen percent of respondents report full visibility alignment between IT and OT across the ICS Cyber Kill Chain, unchanged from last year, and another 46% report partial alignment. The organizations with full alignment show what that investment returns. In this year’s worst-case vendor scenario, 25% of them could sustain production indefinitely, compared with 10% of respondents overall. They still experienced incidents, but with a different mix. Exploitation of firewalls and edge devices accounted for 19% of their incidents, versus roughly 25% for everyone else, and unauthorized external access dropped steeply as well. End-to-end visibility gives defenders what they need to trace how an attacker moved from IT into OT.

Budget is the most commonly cited barrier to expanding ICS/OT detection (43%), followed by concerns about disrupting continuous operations (40%) and a lack of personnel to manage and tune alerts (40%). Ironically, the tool that finds the most incidents is the one most budgets still will not fund. Purpose-built ICS/OT tooling found more incidents than any other method this year, yet the average organization has detection coverage at only 61% of its sites. Benchmarks like these can also help teams decide where automation and AI tools will have the most impact as adversaries automate their own operations.

5. Many Organizations Can’t Confirm Manual Operations Would Hold

Manual operations are a key fallback when centralized control is unavailable, and this year’s survey asked how prepared organizations are to rely on them. Fifteen percent of respondents said they are fully capable of sustaining critical processes and safe production in manual mode, without centralized SCADA or DCS control, for more than 48 hours. Another 34% are partially capable, and 40% could not say either way, which means fewer than one in six organizations can confirm that manual operations would hold. Exercising manual operations is the most direct way to turn that uncertainty into a reliable answer.

The path to stronger recovery is well defined. Organizations that test their resilience plans at least annually and integrate ICS/OT cyber resilience into business continuity and disaster recovery (BC/DR) planning bring their most critical facility or system back online the same day 46% of the time, compared with 27% overall. Those practices remain uncommon. Only 16% of respondents have fully integrated cyber resilience into BC/DR, and fewer than a third (29%) test their resilience plans at least annually.

Industrial organizations also have a strong foundation to build on. Many critical infrastructure sectors already practice business continuity and disaster recovery for storms, earthquakes, and wildfires, and the leading organizations apply that same discipline to cyber incidents. Core practices are in place across much of the industry, including testing OT-specific recovery procedures (42%), defining ICS/OT recovery time and recovery point objectives (41%), and maintaining site-level resilience playbooks for cyber events (35%).

6. Few Could Operate Without Their Automation Vendor. Mapping Dependencies Improves the Odds

Resilience also depends on who and what an organization relies on. Sixty-eight percent of respondents said losing one or two key individuals would cause delays (43%) or severe operational risk (25%) for ICS/OT security and response, while 5% reported no such reliance. Organizations are addressing the skills gap primarily by upskilling staff with operations or engineering backgrounds (41%), cross-training employees from IT into ICS/OT (41%), and formalizing documentation (39%), all of which spread institutional knowledge more widely. A third (33%) also use AI or automation tools to support existing staff, most often for real-time threat and anomaly detection. Pairing those efforts with retention incentives, which 25% of organizations use today, helps keep that knowledge in place.

Vendor dependencies follow a similar pattern. In a worst-case scenario where an organization's primary OT automation vendor was no longer available, 10% of respondents said they could sustain production indefinitely, 58% would be down within a year, and nine out of 10 industrial operators have no indefinite answer for it.

Across this year's data, the more organizations know about their systems, the better positioned they are to handle bad days. Respondents with a fully functional supply chain cyber risk management program, which 20% have today, were nearly twice as likely to operate indefinitely (18% vs. 10%), and those with full IT/OT visibility reached 25%. Organizations with both full visibility and BC/DR integration were also the quickest to transition to an alternative vendor, with 56% able to migrate within one to three years. With the EU Cyber Resilience Act, NERC CIP, and SEC guidance all incorporating supply chain management elements, these programs are likely to become a bigger focus over the next 12 to 24 months.

Driving Progress Toward Cyber Resilience

The SANS 2026 State of ICS/OT Security Report set out to answer what do we do when things go wrong. As the report puts it, the honest answer is “less than we should, and now we can prove it.” Our industry has built real detection capability over the last decade, but budget and resilience planning haven’t kept pace. With incidents rising, the next step is ensuring operations can stay safe and reliable while an incident is still underway.

Here are practices to act on from the report:

• First, test resilience plans at least annually, with the operators who would actually run manual mode. Hands-on validation shows what a tabletop exercise may miss, such as whether a full bare-metal restore takes the two hours a plan assumes or closer to 20.
• Second, integrate ICS/OT cyber resilience into the BC/DR programs your organization already exercises.
• Third, map dependencies on key people and key vendors, and document how operations would continue without them. None of these requires a new framework, and each builds on the SANS Five ICS Cybersecurity Critical Controls that many industrial security programs already use.

To see where your organization stands, use the 2026 SANS ICS Cyber Resilience Scorecard. It includes 11 self-assessment questions organized by the Five ICS Cybersecurity Critical Controls, plus a bonus question on this year's supply chain scenario, each scored against the 2026 benchmarks. Every "unknown" answer points to a practical place to start, and the benchmarks give security leaders data to support the case for investment.

Read the full SANS 2026 State of ICS/OT Security Report to see the complete findings, and explore how SANS's ICS curriculum equips teams to act on them.

If you missed our webcast, check out the recording here.