Smart Machines & Factories Editorial TeamThe SANS Institute published its ninth annual State of ICS/OT Security survey this week, and the headline number is stark: 34% of industrial organizations confirmed at least one ICS/OT cyber incident in 2026, up from 22% in 2025. That's the largest single-year jump the survey has recorded. Infosecurity Magazine independently covered the release the same week, confirming the figures from SANS' nearly 700 IT and security respondents across industrial sectors.
Downtime Up, Detection Slower
Of the organizations that reported an incident, 72% experienced facility or system downtime as a direct result, and safety impacts nearly doubled year over year. Detection, meanwhile, got worse: only 41% of incidents were caught within 24 hours, down from over 50% in prior years, the first time the survey has recorded detection times slowing rather than improving. Dedicated ICS/OT visibility and threat-detection platforms still led all detection methods, catching 38% of reported incidents ahead of IT perimeter tools and trained operators, but that lead isn't closing the overall gap.
SANS 2026 ICS/OT Survey — Key Numbers
- 34% of respondents hit a confirmed ICS/OT incident in 2026, vs. 22% in 2025;
- 72% of those incidents caused facility or system downtime;
- 41% of incidents detected within 24 hours — down from 50%+ in prior years;
- 13% report full IT/OT visibility across the entire cyber kill chain;
- 43% name budget as the main barrier to expanding ICS/OT detection;
- 31% / 31% — shared IT/OT credential compromise and ransomware, the two most-cited incident types;
- 74% now use ICS-specific threat intelligence, an all-time high (67% in 2025).
The 13% Visibility Number Is the Real Story
Incident counts rise and fall with reporting quality, but the 13% full-visibility figure is harder to argue away. It means the overwhelming majority of industrial organizations still can't see their own IT/OT kill chain end to end, and that gap is exactly what shows up as slower detection. Teams without a consolidated view of credentials, assets and traffic across both networks are, almost by definition, going to notice an incident later than teams that do. Budget is the barrier 43% point to, but in our experience a good share of the organizations that do reach full visibility got there by building a purpose-fit dashboard that pulls OT telemetry and IT security signals into one screen, rather than waiting for a platform vendor's roadmap to catch up.
What a Narrower Visibility Gap Looks Like in Practice
Report author Jason Christopher's framing, that "most of the industry has not answered" basic questions about manual-operation fallback and vendor dependency, applies just as directly to visibility tooling. Few plants have mapped exactly which systems feed which dashboard, and fewer still have tested whether that dashboard still works when a primary vendor's cloud service is unreachable. Closing that gap is less about buying another platform and more about integration work: pulling OT sensor data, IT security events and operator alerts into a single, maintainable web application that the security team actually trusts during an incident, instead of three disconnected tools.
YuSMP Group's web development team builds exactly that kind of consolidated IT/OT visibility dashboard, pulling data from existing SCADA, sensor and IT security sources into one interface a plant's security team can rely on during an actual incident, not just a demo.
Sources: SANS Institute press release, "34% of Industrial Organizations Suffered a Cyber Incident," November 10, 2026; Infosecurity Magazine, "OT Incidents Hit a Third of Industrial Organizations, SANS Finds," November 11, 2026.