SANS 2026 State of ICS/OT Security Survey Insights

As industrial environments become more connected and threats more advanced, the challenge of securing ICS and OT systems grows more urgent. How are asset owners responding—and where are the biggest gaps?

Claroty is proud to sponsor SANS 9th annual State of ICS/OT Security Survey. This trusted industry research captures how organizations across sectors are evolving their industrial cybersecurity strategies in response to regulatory pressures, emerging threats, and operational demands.

Building on key findings from 2025—like improvements in incident response and IT-OT alignment—this year’s survey dives deeper into visibility across the ICS cyber kill chain, the growing role of cyber-informed engineering (CIE), and the need for resilience-focused security controls.

Top Takeaways:

• 34% experienced a confirmed ICS/OT incident this year

• 40% cannot say if manual operations would hold past 48 hours

• 13% report full IT-OT visibility across the ICS Cyber Kill Chain

• 16% have fully integrated ICS/OT resilience into BC/DR

Whether you manage industrial assets, influence cyber strategy, or lead incident response, this session delivers the benchmarks and insights you need to make informed decisions in 2026 and beyond.

Other key insights:

• Detection times slowed for the first time on record: only 41% of incidents were caught within 24 hours, down from more than 50% in prior years.

• 74% of organizations now use ICS-specific threat intelligence, an all-time high, up from 67% in 2025.

• 43% of organizations cite budget as the top barrier to expanding ICS/OT detection, even though ICS-native platforms already catch more incidents (38%) than any other method.

• Only 20% of organizations run a fully functional supply chain cyber risk program, and 68% face severe operational risk or delays if they lose one or two key people.