Critical Infrastructure Under Fire: OT and ICS Cyber Incidents Surge to Record Levels

The landscape of industrial cybersecurity has reached a precarious turning point. According to the 2026 State of ICS/OT Security Survey Insights report published by the SANS Institute, a staggering one-third of organizations operating Operational Technology (OT) or Industrial Control Systems (ICS) reported experiencing at least one significant cyber incident over the past year. This finding represents the most dramatic year-over-year increase in security breaches since the SANS Institute began tracking the sector, with the frequency of incidents jumping from 22% in the previous survey to 34% in 2026.

The report, which synthesized the perspectives of nearly 700 IT and security professionals, paints a sobering picture of an industry struggling to keep pace with an evolving and increasingly aggressive threat landscape. As the digital and physical worlds converge within factory floors, power grids, and manufacturing plants, the consequences of these breaches have evolved from mere IT inconveniences into threats to human safety and intellectual property.

A Heightened Impact on Safety and IP

Beyond the raw volume of attacks, the severity of the incidents reported has escalated significantly. Perhaps most concerning to industry leaders is the rise in safety-related impacts. The proportion of respondents indicating that a cyber incident had directly affected the safety of their operations climbed from 8% to 13% over the last year. This statistic underscores the real-world danger posed by modern cyber-attacks: they are no longer confined to the virtual realm, as they now possess the potential to interfere with the physical machinery that powers critical infrastructure.

Furthermore, the surge in intellectual property (IP) theft serves as a stark warning to manufacturers and high-tech firms. The survey revealed that the share of organizations reporting the theft of IP as a result of a cyber incident has skyrocketed, jumping from just 6% to 31% in a single year. This indicates that attackers are increasingly sophisticated, targeting not just the availability of systems but the proprietary data that drives an organization’s competitive advantage.

When dissecting the nature of these breaches, the SANS Institute identified two primary vectors that dominated the threat landscape in 2026. Both shared IT/OT credential and identity compromise and the prevalence of ransomware were cited by 31% of respondents as the most frequent types of incidents. The reliance on shared credentials between IT and OT networks continues to provide attackers with an easy lateral movement path, turning a single compromised workstation into a gateway to critical industrial processes.

The Visibility Gap and the Cost of Defense

A fundamental challenge identified in the report is a profound lack of visibility into the OT environment. Without a clear picture of what is happening across the cyber kill chain, security teams are often left fighting fires in the dark. Alarmingly, only 13% of the surveyed organizations claimed to possess full IT/OT visibility, a deficiency that significantly hinders the ability to detect threats before they escalate into full-scale operational crises.

When asked why these visibility gaps persist, 43% of respondents pointed to budget constraints as the primary barrier to improving detection capabilities. This creates a dangerous cycle: as organizations lack the necessary resources to monitor their environments effectively, their vulnerability to costly downtime increases. Early detection is paramount, yet the data shows that the industry is failing to catch these threats early enough to prevent disruption. Nearly three-quarters—72%—of the surveyed organizations reported that cyber incidents resulted in facility or system downtime, highlighting the high cost of delayed detection.

The operational fragility of these organizations is further evidenced by their limited ability to sustain critical processes during a security event. Only 15% of respondents indicated that they were fully capable of shifting to manual operations for a period longer than 48 hours. Even more concerning is the 40% of organizations that admitted they simply do not know if their staff could maintain operations in a manual, offline mode at all. In the most extreme instances reported by the survey, some organizations faced shutdowns that lasted as long as a year, illustrating the catastrophic potential of a successful attack on industrial systems.

Supply Chain Vulnerabilities and Human Capital

The survey also cast a spotlight on the precarious nature of the modern industrial supply chain. Modern infrastructure is heavily dependent on specialized automation vendors, and many organizations lack a contingency plan for a loss of service from these third parties. If their primary automation vendor were to disappear, 58% of respondents said they would be forced to shut down or would be unable to operate within a year. Despite this extreme level of dependency, only 20% of the organizations polled have a fully functional, mature third-party risk management program in place. This indicates a significant blind spot in how firms assess the cyber posture of the vendors they rely on to keep their plants running.

Human capital also presents a critical point of failure. The research found that 68% of organizations believe the loss of just one or two key staff members would cause severe delays or place their entire ICS/OT security and incident response capabilities at risk. This "key person dependency" is a major structural vulnerability in an era where cybersecurity talent is already in short supply.

In an attempt to mitigate these personnel shortages, a third of organizations are now deploying artificial intelligence or automated tools. Among these, real-time threat and anomaly detection has emerged as the most common investment, with 42% of organizations prioritizing these technologies to compensate for the lack of human oversight.

Building Resilience: The Path Forward

The SANS Institute report offers a clear message regarding the path toward greater resilience: preparation is everything. The data provides empirical evidence that testing pays off. Nearly half (46%) of the organizations that proactively test their business continuity and disaster recovery plans—and explicitly integrate ICS/OT systems into those tests—are able to bring their most critical systems back online within the first day of an incident. In contrast, among organizations that do not perform such rigorous, integrated testing, only 27% can achieve the same level of recovery speed.

Despite this success, the broader adoption of these practices remains low, with only 16% of respondents having fully integrated cyber resilience into their broader disaster recovery programs. Recent high-profile events, such as the cyber-attacks on supermarket refrigeration equipment across Europe, have served as a wake-up call, demonstrating that OT disruption is not a theoretical risk but an active threat to business continuity and physical assets.

Jason Christopher, a SANS Principal Instructor and the lead author of the report, noted that the most resilient organizations are those that have cultivated a deep, technical understanding of their own systems. He emphasized that industrial security has matured significantly over the last decade, yet the pace of the threat landscape continues to outstrip institutional progress.

"What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable," Christopher said. "Most of the industry has not answered those questions yet."

As the sector moves forward, the message from the SANS Institute is clear: building resilience is no longer just a technical exercise. It requires a fundamental shift in how organizations document their processes, train their personnel for manual failovers, and assess the risks posed by the vendors upon whom their entire infrastructure depends. Without a comprehensive and well-rehearsed plan, the industry remains vulnerable to the increasingly sophisticated threats that define the current era of industrial cybersecurity.