The SANS 2026 State of ICS/OT Security Survey, sponsored by OPSWAT, reveals a sharp rise in incidents affecting ICS (industrial control systems) and OT (operational technology). One in three respondents reported an ICS/OT incident this year, marking the survey’s largest single-year increase in reported incidents.
Earlier SANS reports highlighted gaps in workforce experience and in ICS/OT security investment. The 2026 findings bring response and recovery readiness into sharper focus.
Key findings
- Rising incident levels reaching 1.7 times the 2025 level, reinforcing the urgency of reviewing ICS/OT security readiness.
- Widespread operational disruption, since 72% of OT incidents caused downtime, highlighting the consequences for operational continuity.
- Limited manual operating capacity, with only 15% of respondents saying they could keep operations running manually for more than 48 hours.
- Growing safety impact: The reported impact on safety nearly doubled, reinforcing the importance of aligning cybersecurity responses with operational safety.
What to Expect in the SANS 2026 State of ICS/OT Security Survey
Learning from Past Industrial Cyber Incidents
The report reviews incident response data from previous surveys through the perspective of failed controls and external pressures. This retrospective approach provides context for examining where defenses have fallen short and how organizations can strengthen their response. The report also examines current threats, detection capabilities, and the role of threat intelligence and visibility across IT and OT systems.
Preparing for Disruption and Recovery
The downtime findings make this especially relevant. Security and operations teams need a shared understanding of which systems are critical, how an incident could affect them, and what steps are required to contain the threat and recover safely.
The limited capacity for extended manual operations also deserves attention. Organizations should assess how long essential processes can continue without their normal digital systems and test the procedures they would use during an outage.
Turning Findings into Security Priorities
For organizations reassessing their ICS/OT security programs, the findings highlight the limitations of relying on detection alone and the need to prioritize prevention. It also recommends three moves to help organizations stand out from this year’s data.
Get the Latest SANS Report
SANS Institute is a global leader in cybersecurity training and research. Its State of ICS/OT Security Survey helps industrial organizations understand current threats, assess security capabilities, and identify security challenges.
Download the full report to explore the findings and identify opportunities to strengthen your organization’s ICS/OT security, response, and recovery capabilities.
