CISOs say OT will survive a cyberattack, but their engineers aren’t so sure
Ask industrial security chiefs whether their plants would keep running through a full IT compromise, and every one who answered the SANS 2026 ICS/OT survey says yes.
Ask industrial security chiefs whether their plants would keep running through a full IT compromise, and every one who answered the SANS 2026 ICS/OT survey says yes.
Thirty-eight percent expect to run indefinitely on islanded ICS/OT systems, and 62% expect to get by temporarily on manual controls, and the 696 practitioners SANS surveyed, the people who would run those manual controls, are less sure.
Only 14% of them reported routine technical validation, such as ICS-specific threat hunting or safe red and purple teaming, while 43% described that work as ad hoc or missing major elements.
Sixty-eight percent said losing one or two veteran employees would delay response or create severe operational risk, and 5% reported no such reliance.
Only 15% said their critical processes could sustain safe production in manual mode, without centralized SCADA or DCS control, for more than 48 hours.
Leaders said enterprise IT security is required in 83% of their ICS/OT tabletop exercises and the ICS/OT security team in 71%.
Of that group, 46% said they could bring their most critical facility back online within a day, against 27% of all respondents; if their primary automation vendor disappeared tomorrow, 10% of respondents could operate indefinitely and 58% would be down within a year.
SANS flags the leadership sample as smaller than the main survey, so treat these figures as a signal worth checking against your own program.
What happened
Ask industrial security chiefs whether their plants would keep running through a full IT compromise, and every one who answered the SANS 2026 ICS/OT survey says yes.
Thirty-eight percent expect to run indefinitely on islanded ICS/OT systems, and 62% expect to get by temporarily on manual controls, and the 696 practitioners SANS surveyed, the people who would run those manual controls, are less sure.
What changed
Only 14% of them reported routine technical validation, such as ICS-specific threat hunting or safe red and purple teaming, while 43% described that work as ad hoc or missing major elements.
Sixty-eight percent said losing one or two veteran employees would delay response or create severe operational risk, and 5% reported no such reliance.
Who is affected
Only 15% said their critical processes could sustain safe production in manual mode, without centralized SCADA or DCS control, for more than 48 hours.
Leaders said enterprise IT security is required in 83% of their ICS/OT tabletop exercises and the ICS/OT security team in 71%.
Why it matters
Of that group, 46% said they could bring their most critical facility back online within a day, against 27% of all respondents; if their primary automation vendor disappeared tomorrow, 10% of respondents could operate indefinitely and 58% would be down within a year.
Response
SANS flags the leadership sample as smaller than the main survey, so treat these figures as a signal worth checking against your own program.