CISOs say OT will survive a cyberattack, but their engineers aren’t so sure
Ask industrial security chiefs whether their plants would keep running through a full IT compromise, and every one who answered the SANS 2026 ICS/OT survey says yes. Thirty-eight percent expect to run indefinitely on islanded ICS/OT systems, and 62% expect to get by temporarily on manual controls. None foresee degradation or a halt.
The 696 practitioners SANS surveyed, the people who would run those manual controls, are less sure. Only 15% said their critical processes could sustain safe production in manual mode, without centralized SCADA or DCS control, for more than 48 hours. Another 34% said they were partially capable, and 40% did not know.
ICS cyber incident timeline (Source: SANS)
More incidents, slower detection
Thirty-four percent of respondents had an ICS/OT cyber incident in the past 12 months, 1.7 times the 2025 rate and the largest single-year jump SANS has recorded. Seventy-two percent of those incidents brought facility or system downtime. Defenders also got slower for the first time since SANS began tracking detection: 41% of incidents were caught within 24 hours, down from more than half in 2024 and 2025.
Few leaders run technical tests
Few of the surveyed leaders back their confidence with testing. Only 14% of them reported routine technical validation, such as ICS-specific threat hunting or safe red and purple teaming, while 43% described that work as ad hoc or missing major elements. SANS flags the leadership sample as smaller than the main survey, so treat these figures as a signal worth checking against your own program.
The exercise rosters point the same way. Leaders said enterprise IT security is required in 83% of their ICS/OT tabletop exercises and the ICS/OT security team in 71%. Plant managers and frontline engineers and operators, the staff who would keep the process going by hand, are required in 58%.
“An untested assumption is not a capability,” wrote Jason Christopher, the report’s author.
What testing buys
Organizations that test resilience plans at least annually and fully fold ICS/OT cyber resilience into business continuity and disaster recovery (BC/DR) programs expect to recover faster. Of that group, 46% said they could bring their most critical facility back online within a day, against 27% of all respondents. Both figures are self-assessments, and the gap between them is still wide. Few organizations qualify: 16% have fully integrated BC/DR, and 29% test annually.
People are a dependency too. Sixty-eight percent said losing one or two veteran employees would delay response or create severe operational risk, and 5% reported no such reliance. Vendors are another. If their primary automation vendor disappeared tomorrow, 10% of respondents could operate indefinitely and 58% would be down within a year.
Budgets are holding back the tool that finds the most incidents. Dedicated ICS/OT detection platforms caught 38% of this year’s incidents, more than any other method, yet 43% of respondents cited budget as the main barrier to expanding them.
“Test industrial incident response, and engineering recovery of critical engineering assets (PLCs, RTUs, HMIs, etc.), and apply those lessons learned collaboratively between IT and OT teams,” said Dean Parsons, a principal SANS instructor and CEO of ICS Defense Force.
