Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

SANS State of ICS/OT Security: Key Findings

SANS Research: ICS/OT Security

Based on the SANS 2025 ICS/OT Security Survey, this page tracks incident trends, detection gaps, and remote access risk in industrial environments.

Read the report
Abstract Orange Stuff
Jump to:

How Secure Are ICS/OT Environments Today?

This year's State of ICS/OT Security report traces how the industry's practices have evolved, where organizations stand today, and what's likely to shape their programs next. It's built as a practical reference for anyone leading cybersecurity efforts across critical infrastructure, connecting historical trends to the decisions industrial security leaders face now.

Top Takeaways

22%

organizations reported an ICS/OT incident in 2025

50%

of ICS/OT incidents began with unauthorized access

13%

of organizations report full visibility across the ICS Cyber Kill Chain

14%

of respondents felt fully prepared for emerging threats

Survey Methodology and Respondent Profile

The SANS 2025 State of ICS/OT Security Survey draws on responses from 330 practitioners across the energy, information technology, government, and other industrial sectors. Respondents span the United States, Europe, Canada, and Asia, with the largest share working as ICS/OT cybersecurity analysts and managers. The survey examines incident trends, detection and remote access capabilities, and investment priorities across industrial environments.

330 Global Respondents

Respondents included ICS/OT cybersecurity analysts, managers, security administrators, and architects, with the largest representation from the energy sector (20%) and operations based in the United States, Europe, Canada, and Asia.

Vendor Neutrality

As with all SANS research, this survey's sponsors funded the study but had no role in designing the survey questions, collecting respondent data, or shaping the findings presented in this report.

Meet the Author

Jason Christopher
Jason Christopher

Jason Christopher

Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners

Jason D. Christopher, Energy Impact Partners SVP, teaches ICS456 and co-authors ICS418, turning regulation into safe, reliable OT-supporting programs and metrics to align practitioners and leaders on clear, defensible action.

Read more about Jason Christopher

Thank You to Our Sponsors

More Key Findings From the SANS 2025 ICS/OT Security Survey

Threat intelligence & incident response

  • 67% of organizations leverage ICS-specific threat intelligence today, with another 16% planning to adopt it within the next year.
  • 57% of organizations have a dedicated ICS/OT incident response plan, and that coverage rises to 70% when the organization is both regulated and using threat intelligence.
  • Only 39% of organizations test their incident response plan annually, though a growing share (25%) now test quarterly.

Detection & visibility

  • Only 49% of organizations have ICS/OT-specific detection capabilities, and just 26% of those describe their detection as "highly effective."

Regulation drives maturity

  • Sites under mandatory compliance had similar incident rates as peers but experienced ~50% fewer financial losses and safety impacts.

Cloud & remote access

  • 83% of organizations now have some cloud-connected footprint in their ICS/OT or IT networks, yet only 13% report fully integrated cloud monitoring.
  • The top blocker to full remote access control implementation is lack of internal resources, cited by 60% of organizations.

Investment momentum is clear

  • Asset visibility, threat detection, and secure remote access dominate both 2025 deployments and 2026-2027 planned investments, showing where organizations see the greatest value.

SANS 2026 ICS/OT Report Findings Are Coming Soon

SANS is distilling the 2026 State of ICS/OT Security findings, following this year's survey on incident trends, detection gaps, and remote access risk. Watch the related webcast to hear the SANS ICS team unpack what's changing for industrial cybersecurity programs.

Register to Watch
Stylized Microphone Orange Background

More ICS/OT Cybersecurity Resources

The Five ICS Cybersecurity Critical Controls

This paper sets forth the five most relevant critical controls for an ICS/OT cybersecurity strategy that can flex to an organization's risk model, and provides guidance for implementing them.

Whitepaper
Written ByRobert M. Lee & Tim Conway
Robert M. LeeTim Conway
ICS Worker

Explore the SANS State of ICS/OT Security Report Archive

Review previous year’s data to see how the ICS/OT security is evolving year on year.

Frequently Asked Questions

According to the SANS 2025 State of ICS/OT Security Survey, 22% of organizations reported at least one cybersecurity incident in their ICS/OT environment in the past year, and 40% of those incidents caused operational disruption.

Unauthorized external access accounted for half of all ICS/OT incidents reported in 2025, followed by insider misuse or error (41%) and ransomware (38%), according to the SANS survey.

Only 14% of respondents to the SANS 2025 ICS/OT survey felt fully prepared for emerging threats, though organizations that included frontline technicians in preparedness exercises were about 1.7 times more likely to report strong readiness.

Yes. Sites subject to mandatory cybersecurity compliance had similar incident rates as unregulated peers but experienced roughly 50% fewer financial losses and safety impacts, per the SANS 2025 survey.

SANS Research: ICS/OT Security | SANS Institute