If a cyber incident takes down plant controls, only 15% of industrial firms could run by hand past 48 hours

The SANS 2026 ICS/OT security survey, released November 10, 2026, finds that 34% of the industrial organizations it surveyed had a cyber incident. For operations chiefs, its sharpest number is about the fallback: just 15% say they could keep critical operations running by hand for more than 48 hours.

Key points

• In the survey of nearly 700 industrial security professionals, 34% reported a cyber incident, up from 22% a year earlier, which SANS calls the largest one-year rise in the survey's history.
• SANS reports that 72% of those incidents caused downtime at a facility or system, and the longest shutdown reported lasted a year.
• Only 15% of respondents are fully able to run critical operations in manual mode beyond 48 hours, and 40% do not know whether they could.
• If their main automation vendor disappeared, 58% say they would shut down or be unable to operate within a year.
• Organizations that test plans at least annually and fold ICS/OT into continuity programs restore their most critical site within a day 46% of the time, against 27% overall.

What does the SANS 2026 ICS/OT security survey measure?

It measures whether an industrial facility can stay safe and keep producing while an attack is still in progress, not only whether the attack is spotted. SANS Institute has run the survey every year since 2017; this edition's report, written by SANS Principal Instructor Jason Christopher, gathered answers from nearly 700 practitioners across the major critical infrastructure sectors.

In the US water sector, the regulator has found basic resilience planning missing. In a May 2024 enforcement alert, the U.S. Environmental Protection Agency said over 70% of the drinking water systems it had inspected since September 2023 were in violation of basic Safe Drinking Water Act risk and resilience requirements. The SANS release cites recent attacks on US water systems and on power systems in Poland as examples of control systems being targeted more often.

How badly do incidents hit operations?

Most of them stop something. According to SANS, 72% of reported incidents took a facility or system offline, the share of respondents reporting a safety impact rose to 13% from 8%, and reported theft of intellectual property climbed to 31% from 6%. Ransomware and compromised credentials shared between IT and OT tied as the most common incident type, at 31% each.

Finding incidents also got slower. SANS says 41% were detected within 24 hours, down from the year before, and dedicated ICS/OT monitoring platforms now catch more incidents (38%) than any other method. Only 13% of respondents report full visibility across IT and OT, and budget is the barrier cited most often, by 43%.

Can your plant run in manual mode after a cyber attack?

Only a small share are sure they can. Manual operation is what a site falls back on when it loses central SCADA or DCS control, and SANS finds 15% fully capable of sustaining it past 48 hours while 40% cannot say.

The gaps are in people and suppliers as much as in technology:

Dependency	What respondents said
Key staff	68% say losing one or two key people would delay or seriously endanger ICS/OT security and incident response
Primary automation vendor	58% would shut down or be unable to operate within a year if it disappeared; 10% could carry on indefinitely
Supply chain cyber risk	20% have a fully functional management program
Continuity planning	16% have fully built cyber resilience into business continuity and disaster recovery

"What happens after the alarm comes down to rehearsal: who runs the plant by hand, who holds the knowledge that is not written down, and what the fallback is if a vendor is unavailable. Most of the industry has not answered those questions yet."

— Jason Christopher, Principal Instructor, SANS Institute

What should operations leaders do with these findings?

Our analysis: the report's three closing steps sit squarely with operations, not only with security teams. SANS recommends rehearsing plans at least once a year with the operators who would actually run manual mode, putting ICS/OT inside the continuity and disaster planning a company already exercises, and mapping which key people and vendors the plant cannot run without. The payoff in the data is speed: in the survey, organizations doing the first two brought their most critical site back within a day 46% of the time, compared with 27% of all respondents.

Two of those steps are familiar ground for COOs. Knowing who holds undocumented know-how is the same work as protecting critical team knowledge, and planning for a lost automation supplier draws on how leaders already decide whether to fix, switch or insource a vendor.

"Acting on this does not take a new framework. The organizations that understand their own systems best are the ones most likely to get through a hard day."

— Jason Christopher, Principal Instructor, SANS Institute

Frequently asked questions

Who wrote the SANS 2026 ICS/OT report?

Jason Christopher, a SANS Principal Instructor who is also Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners.

Where can I get the full report?

SANS says the full report, titled "Industrial Cybersecurity at a Crossroads," is free to download from its ICS/OT security research page.

Who sponsored the survey?

Acronis, Claroty, Corsha, Dispel, Dragos, Fortinet and OPSWAT, according to the release.

How are industrial organizations using AI for OT security?

SANS reports that 33% are deploying AI or automation to support their staff. In that group, spotting threats and anomalies in real time is the most common use, named by 42%.

Is use of ICS-specific threat intelligence growing?

Yes. SANS says 74% now use threat intelligence specific to industrial systems, up from 67% last year and the highest in the survey's history.

Sources

• SANS Institute release on its 2026 State of ICS/OT Security Survey: press release from SANS Institute via GlobeNewswire, 10 November 2026.
• SANS 2026 State of ICS/OT Security: Key Findings: the survey's findings and report download, published by SANS Institute.
• Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities: U.S. Environmental Protection Agency, May 2024.