SANS State of ICS/OT Security 2026

One in three industrial organizations suffered an ICS/OT cyber incident this year. That is the largest single-year jump in the survey’s history. Detection times slowed for the first time on record, and 72% of incidents brought facility or system downtime. Nearly 700 practitioners answered the question every operator faces: can you keep operations safe and running when an incident happens anyway?

Inside the report, you’ll learn:

Why shared IT/OT credential and identity compromise now ties ransomware as the No. 1 incident type, at 31% of reported incidents.

How organizations with full IT/OT visibility saw far less perimeter exploitation and unauthorized access, and why only 13% have it.

Why only 15% of organizations could sustain manual operations past 48 hours, and 40% can’t say either way.

Get the SANS Report

Why Secure Remote Access Is Central to OT Cyber Resilience in 2026

Key insights from the survey:

Attackers came through the front door. Firewall and edge device exploitation drove 24% of incidents, unauthorized external access 23%, and supply chain compromise 21%.

Vendor dependency is a single point of failure. Only 1 in 10 organizations could operate indefinitely if their primary automation vendor disappeared, and 58% would be down within a year.

Tested programs recover faster. Organizations that test resilience plans annually and integrate them into BC/DR recover same-day at 46%, compared to 27% overall.

Download the SANS Report