OT Incidents Surge, Impacting Safety and IP as Visibility Lags
A new SANS Institute report reveals a significant jump in cyber incidents targeting operational technology (OT) and industrial control systems (ICS), with a third of organizations experiencing attacks and a notable increase in safety-related impacts.
A significant surge in cyber incidents targeting operational technology (OT) and industrial control systems (ICS) has been documented, with a new report from the SANS Institute indicating that one-third of industrial organizations experienced such attacks in the past year. This marks the largest single-year increase in recorded incidents, escalating from 22% to 34% of surveyed organizations.
The consequences of these attacks have also become more severe. The proportion of respondents reporting that an incident affected safety increased from 8% to 13%, while the theft of intellectual property (IP) saw a dramatic surge, rising from 6% to 31%. The most frequently cited types of incidents were shared IT/OT credential and identity compromise, and ransomware, both affecting 31% of respondents.
A key contributing factor to this rise in incidents and their severity appears to be a persistent lack of visibility into OT and ICS environments. Only 13% of respondents claimed to have full visibility across the cyber kill chain, with budget constraints being the most common barrier to improvement. This limited visibility hinders early detection, which is crucial for minimizing impact.
Early detection is critical, as nearly three-quarters (72%) of respondents reported that incidents led to facility or system downtime. The ability to sustain operations manually is also a concern; only 15% of organizations are fully capable of maintaining critical operations in manual mode for more than 48 hours, and a significant portion (40%) are unsure of their capabilities. The longest reported shutdown lasted a full year.
Supply chain risks are particularly pronounced, with 58% of organizations stating they would shut down or be unable to operate within a year if their primary automation vendor disappeared. Despite this, only a fifth (20%) have a fully functional third-party risk management program in place.
Human factors also present a significant risk, as 68% of organizations indicated that the loss of one or two key individuals would severely impact or delay ICS/OT security and incident response. To address potential staff shortages and enhance security, one-third of organizations are deploying AI or automation tools, with real-time threat and anomaly detection being the most common investment.
The report emphasizes the importance of proactive planning and resilience. Organizations that regularly test their business continuity and disaster recovery plans, and integrate ICS/OT into them, are more likely to restore critical operations quickly. However, only 16% of respondents have fully integrated cyber resilience into these programs.
SANS Institute recommends a three-point plan to build resilience: annually test resilience plans with actual operators, integrate ICS/OT cyber resilience into existing business continuity and disaster recovery programs, and map dependencies related to personnel and vendors. The report's author, Jason Christopher, stressed that the most resilient organizations are those that understand their ICS/OT systems best, highlighting that many organizations still need to answer fundamental questions about manual operations, undocumented knowledge, and vendor fallback scenarios.