34% of Industrial Organizations Suffered a Cyber Incident, and 72% of Those Incidents Disrupted Operations, New SANS Institute Survey Finds

In the SANS 2026 State of ICS/OT Security Survey, the share of respondents reporting an incident rose from 22% last year, the largest single-year jump in the survey’s history, and detection slowed for the first time.

Bethesda, MD, Nov. 10, 2026 (GLOBE NEWSWIRE) -- Industrial control systems are being targeted more often, with recent attacks on power systems in Poland and water systems in the United States as examples. SANS Institute’s 2026 State of ICS/OT Security Survey Insights report, written by Jason Christopher, SANS Principal Instructor, looks past detection to resilience: whether a facility stays safe and running while an incident is still under way.

The survey gathered responses from nearly 700 industrial security professionals across every major critical infrastructure sector and has run annually since 2017. Christopher teaches SANS ICS456: Essentials for NERC Critical Infrastructure Protection, co-authors ICS418: ICS Security Essentials for Leaders, and is Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners.

Detection times slipped: 41% of incidents were found within 24 hours, down from last year. Dedicated ICS/OT visibility and threat detection platforms, a capability that barely existed 10 years ago, now lead all detection methods, finding 38% of reported incidents, ahead of IT perimeter tools and trained operators.

Impacts were also more severe than a year ago. The share of respondents who said an incident affected safety increased from 8% last year to 13% in 2026, and the share reporting theft of intellectual property rose more than fivefold, from 6% to 31%. In the longest case reported, the shutdown lasted a year. Shared IT/OT credential and identity compromise tied ransomware as the most common incident type this year, each at 31%.

Only 13% of respondents report full IT/OT visibility across the cyber kill chain, and budget is the most commonly cited barrier to expanding ICS/OT detection, named by 43% of respondents.

“Industrial security has come a long way over the past decade, and the data this year shows how much is still left to do,” said Christopher. “What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable. Most of the industry has not answered those questions yet.”

Manual operations are the fallback when a facility loses centralized SCADA or DCS control. Just 15% of respondents are fully capable of sustaining critical operations in manual mode for more than 48 hours, and 40% do not know whether they could. Organizations that test their plans at least annually and build ICS/OT into business continuity and disaster recovery programs restore faster: 46% can bring their most critical facility or system back online within the first day, compared with 27% of all respondents. Only 16% of respondents have fully integrated cyber resilience into those programs.

Additional key findings from the survey include:

• Vendor dependence is widespread: If their primary automation vendor disappeared, 58% of respondents would shut down or be unable to operate within a year, while 10% could operate indefinitely. Just 20% have a fully functional supply chain cyber risk management program.
• Key people are a single point of failure: 68% say losing one or two key individuals would delay or severely risk ICS/OT security and incident response.
• AI is aimed at defender pain points: 33% are deploying AI or automation tools to augment staff, and among them, real-time threat and anomaly detection is the most common use (42%).
• Threat intelligence use is at a high: 74% use ICS/OT-specific threat intelligence, up from 67% last year and an all-time high for the survey.

The report finds that the capabilities behind its strongest results are ordinary ones: testing, documentation, cross-training, and integration with disciplines industrial operators already trust. It closes with three steps: test plans at least annually with the operators who would run manual mode, fold ICS/OT into the continuity and disaster planning an organization already exercises, and map dependencies on key people and key vendors.

“Acting on this does not take a new framework,” Christopher added. “The organizations that understand their own systems best are the ones most likely to get through a hard day.”

The full SANS 2026 State of ICS/OT Security Survey Insights: Industrial Cybersecurity at a Crossroads report is free to download. The accompanying webcast discussing the findings will take place today, November 10, from 10:30-1:30 pm ET. Register and download the report here: https://www.sans.org/research/state-of-ics-ot-security

The survey was sponsored by Acronis, Claroty, Corsha, Dispel, Dragos, Fortinet, and OPSWAT.

About SANS

The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cybersecurity training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 85 courses at in-person and virtual cybersecurity events and OnDemand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 50 hands-on technical certifications in cybersecurity. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master’s and bachelor’s degrees, graduate certificates, and an undergraduate certificate in cybersecurity. SANS also delivers a wide variety of free resources to the InfoSec community, including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet’s early warning system, the Internet Storm Center. At the heart of SANS are the many security practitioners representing varied global organizations, from corporations to universities, working together to support and educate the global information security community.

Contact

Jenn Elston SANS Institute press@sans.org