SANS State of ICS/OT Security Survey: Incidents Are Up, Impacts Are Heavier, and Detection Got Slower

This year SANS built the survey around a single theme, cyber resilience, which it defines as keeping operations safe and running while an incident is happening. The data comes from 696 respondents, with energy as the largest sector at 23%.

The report covers incidents, detection, visibility, workforce, manual operations, Business Continuity/Disaster Recovery (BC/DR) integration, and supply chain dependency.

There is a significant gap between leadership understanding of resilience and the perspective down on the operations line. Most organizations can’t say whether they would survive losing their control systems or their main automation vendor. The few that test their plans and fold them into BC/DR clearly do better.

The closing message is “an untested assumption is not a capability.”

Start Here

Getting to what matters and something you can do right now, SANS provided two really useful additions in the Appendix.

▪  A self-assessment scorecard mapped to the SANS Five ICS Critical Controls.

▪  A leadership section, An Industrial Cyber Leader’s Guide to ICS/OT Insights, with a summary of key findings on resilience, lack of testing, an IT-heavy or IT-exclusive view, and overall visibility.

Trends

Earlier editions surveyed the whole technology stack: what organizations deploy, at which Purdue levels, and so on. This year narrows to resilience and recovery, with questions on surviving the loss of the primary automation vendor, manual-mode sustainability, key-person dependency, and transient-data and forensics coverage.

▪  Incidents. 34% of respondents reported an ICS/OT incident, which is 1.7x the 2025 rate and the largest single-year jump in the survey’s history.

▪  Detection speed. This is the first year detection times got worse. 41% of incidents were detected within 24 hours, down from more than half in 2024 and 2025.

▪  Incident types. Ransomware is no longer alone at the top. Shared IT/OT credential and identity compromise tied it at 31%, and supply chain compromise reached 21%.

▪  Impacts got worse:

▫  Safety impacts went from 7% to 13%.

▫  IP theft went from 6% to 31%.

▫  72% of incidents involved downtime.

▪  Detection sources. ICS/OT-native platforms (38%) are now the top way incidents get detected, ahead of IT perimeter tools (31%). SANS calls this a milestone for a category that barely existed a decade ago.

▪  Threat intel. Use of threat intelligence reached an all-time high of 74%, up from 67%.

▪  Artificial Intelligence. AI is here! But don’t worry, it’s still being used in a limited, assistive fashion.

What’s Interesting

The leadership-versus-field gap is the most notable finding. Every leader who answered expects production to continue if enterprise IT is fully compromised. Among practitioners, only 15% say they could sustain manual operations past 48 hours, and 40% don’t know. Only 14% of leaders run routine technical validation such as safe red or purple teaming. Frontline operators are required in tabletop exercises in only 58% of programs, even though they are the people who would actually run manual mode. Leaders are more pessimistic than the field on only one point: 7% of leaders claim full kill-chain visibility, compared with 13% of practitioners.

The case for testing is the strongest evidence in the report. Organizations that test at least annually and fully integrate ICS/OT resilience into BC/DR bring critical systems back the same day 46% of the time, compared with 27% overall. The two practices are rare, though: 29% test annually and 16% fully integrate.

The supply chain scenario is new and striking. Only 10% could operate indefinitely if their primary automation vendor disappeared, and 58% would be down within a year. Most would need 1 to 5 years or more to migrate to another vendor.

Testing Your Assumptions

This is why we built SCYTHE. SCYTHE provides continuous adversary emulation with detection validation across IT, cloud, and OT/ICS. It has a production-safe OT/ICS offering that supports NERC CIP, IEC 62443, NIST CSF, and the TSA security directives.

How we help:

1.  Validation is your gap. 14% routine technical validation by leaders, 29% annual testing, and 40% who don’t know about manual mode all describe the problem SCYTHE fixes. The report explicitly names safe red/purple teaming as what’s missing and recommends a technically validated exercise rather than another tabletop (we support those too, though!).

2.  Slower detection and uncertain coverage. When 56% don’t know how anomalies would be detected and detection got slower, emulation that proves whether detections actually fire is the obvious response.

3.  The IT-to-OT pivot is where emulation is safest and most valuable. Credential and identity compromise (31%) and edge-device exploitation (24%) map to Stage 1 of the ICS kill chain, the IT side where attackers enter before moving into OT. That can be emulated without touching controllers.

4.  Turning threat intel into tests. 48% of threat-intel users update detection logic based on it, but nothing in the survey measures whether those updates work. SCYTHE automatically ingests your own threat intelligence with AI and generates sequenced, adversary-aligned tests without manual TTP mapping.

5.  Workforce and “human sensors.” Operators detected 20% of incidents, and 68% of organizations carry key-person risk. Purple-team exercises double as training and succession-building, and they are a way to get operators into realistic drills.