More than half of organizations have experienced significant incidents related to Operational Technology security.
In a concerning development, a significant number of global organizations have found themselves vulnerable to attacks on their Industrial Control Systems (ICS) and Operational Technology (OT) environments. According to a report by the SANS Institute, more than half of these organizations have experienced an OT incident in the past 12 months.
The report, titled 2025 ICS/OT Cybersecurity Budget: Spending Trends, Challenges, and the Future, was produced in collaboration with OPSWAT. The poll, which gathered responses from over 180 professionals in energy, IT, government, and other critical infrastructure sectors, aimed to better understand these organizations' OT exposure.
The SANS Institute's principal instructor, Dean Parsons, argues that while cybersecurity budgets have increased, much of the investment remains focused only on traditional business support systems. This leaves ICS/OT environments under-protected, a situation that could prove critical given the converged nature of historically siloed IT and OT functions.
IT compromise was cited as the most common OT attack vector, indicating the urgent need for organizations to prioritize the security of their ICS environments. Removable media and transient device security is a top priority, focusing on protecting engineering laptops and portable tools used for ICS maintenance, as well as ICS network operations.
Architectures supporting real-time network visibility and situational awareness are a top priority for investment. ICS/OT defensible network architecture is also a key focus, aiming to enforce robust segmentation and prevent IT compromises breaching over into ICS/OT networks. ICS-specific incident response is a top priority, covering both standard ICS assets and specialized engineering devices.
The report reveals that most organizations that have suffered an OT incident experienced data loss, unauthorized access, operational disruption, or other events. This underscores the importance of protecting ICS engineering systems for operational resilience and national security.
Interestingly, just 9% of professionals dedicate all of their time to OT security, indicating a potential shortfall in resources dedicated to protecting critical infrastructure. Despite this, over half (55%) of respondents reported budgets growing over the past two years.
However, it's concerning that only 27% of budget decisions are led by Chief Information Security Officers (CISOs). This suggests that decisions about ICS/OT security may not always be made with the necessary expertise.
The findings of the report highlight the urgent need for organizations to reevaluate their threats to their ICS environments. Failure to do so leaves critical infrastructure vulnerable to increasingly sophisticated attacks. As the convergence of IT and OT continues, it's clear that a comprehensive approach to cybersecurity is essential for the protection of our vital systems.
Read also:
- Understanding Hemorrhagic Gastroenteritis: Key Facts
- Trump's Policies: Tariffs, AI, Surveillance, and Possible Martial Law
- Expanded Community Health Involvement by CK Birla Hospitals, Jaipur, Maintained Through Consistent Outreach Programs Across Rajasthan
- Abdominal Fat Accumulation: Causes and Strategies for Reduction
