ICS/OT Security in 2025: Progress, Persistent Risks, and Strategic Priorities

Industrial control systems (ICS) and operational technology (OT) security has become an indispensable priority in protecting critical infrastructure. The SANS Institute’s 2025 State of ICS/OT Cybersecurity Survey report reveals the evolution of the sector over the past eight years, highlighting both promising developments and persistent weaknesses. This article will examine the report’s key findings to assess the current state of the sector and discuss the priorities organizations should address as they prepare for 2026.

Progress, but Not Yet Enough

The report paints a two-pronged picture of ICS/OT security. The optimistic side includes positive developments such as shorter detection times, the widespread adoption of incident response planning, and regulatory pressures driving long-term maturity. In particular, progress made in detecting security incidents in their early stages demonstrates that organizations are able to combat threats more proactively.

However, the other side of the coin is quite worrying. Despite shorter detection times, remediation processes are still slow. The time between detecting a vulnerability or incident and fully restoring the system remains a critical issue for many organizations. Advanced security practices such as threat hunting and red/purple team exercises are not yet widespread enough in the industry. Perhaps most worrying, remote access continues to expose organizations to disproportionate risks.

Gaps in the Purdue Model and Control Layers

Understanding ICS/OT security requires evaluating all layers of the Purdue Model, which presents a hierarchical structure extending from enterprise networks (Levels 4-5) to process control systems (Levels 2-3) and ultimately to physical processes (Levels 0-1). The report reveals that while most security controls are concentrated in the upper layers, coverage remains quite limited in the lower layers, particularly in remote site facilities, where the real consequences are most severe.

The percentage of organizations reporting full visibility across the ICS Cyber Kill Chain is quite low. Even more concerning is the fact that even fewer organizations believe they are well-positioned for future cyber threats. This highlights the industry's need for a risk-based and threat-focused approach.

The Balance Between Detection, Protection, and Response

When managing security programs, aiming for "100% coverage" across all categories may not be realistic. However, a conscious discussion and management of the trade-offs between detection, protection, and incident response capabilities is essential. Every organization has a different risk profile, operational priorities, and resource constraints; therefore, security strategies must be shaped according to these realities.

Evaluating various security controls—such as vulnerability management, detection capabilities, and threat hunting—across all layers of the Purdue Model provides a more holistic security posture. However, this evaluation should not be a purely technical exercise; an integrated approach should be adopted, incorporating operational realities, business continuity requirements, and security engineering.

The Difference Between Mature and Struggling Organizations

The report shows a clear distinction between organizations that have built truly mature programs and those still grappling with fundamental coverage issues. The common characteristics of the most prepared organizations are noteworthy:

Integrating IT and OT Monitoring Mature organizations have created an integrated visibility and response capability, rather than managing traditional information technologies and operational technologies in separate silos.

Inclusion of Field Technicians In preparedness and incident response planning, not only security teams but also technicians working in the field play an active role. This ensures that theoretical plans meet practical realities.

Aligning Resilience and Safety Engineering The most successful organizations align resilience planning with security engineering, ensuring systems are not only protected against attacks but also can be quickly and safely recovered in the event of an incident.

Active Participation in Information Sharing Actively contributing to the sharing of intra-sector threat intelligence strengthens the collective defense capabilities of these organizations.

Cultural Integration Perhaps the most important difference is the integration of cybersecurity into daily OT decision-making processes. In these organizations, security is not seen as the responsibility of a separate department, but has become a natural part of the operational culture.

Action Plan for 2026 and Beyond

The SANS report identifies four key priorities for the industry. These recommendations offer a concrete roadmap to close existing gaps and build a more resilient stance against future threats.

1. Expand the ICS/OT Security Coverage

Adopting a risk-based and threat-focused approach is not merely a theoretical suggestion, but a practical strategy that yields proven results. This approach has proven effective in improving incident response times and reducing the impact on reliability, security, and finances.

However, expanding coverage doesn't just mean buying more tools. It requires increasing visibility across all layers of the Purdue Model, especially in sub-layers where critical outcomes occur and in remote field facilities. Remote access points should be prioritized as high-risk areas requiring special attention.

2. Don't just identify the problem, build resilience.

While short containment times are a significant indicator of success, they are not sufficient. Organizations must invest in faster and more secure recovery capabilities. This includes comprehensive backup strategies, effective failover mechanisms, and cybersecurity-focused engineering principles.

Resilience means more than just protecting a system from attacks; it means ensuring that operations can continue with minimum disruption and maximum security, or be quickly restored, when an incident occurs. This is particularly critical in OT environments, as disruptions can lead not only to financial losses but also to security and environmental risks.

3. Expand Participation

Preparation cannot be the sole responsibility of security teams. All stakeholders, including field technicians, engineers, and managers, need to take active roles in threat-aware exercises.

This approach offers several key advantages. First, diverse perspectives ensure that security plans are more comprehensive and realistic. Second, knowing what all teams will do in the event of an incident significantly shortens response time. Third, it contributes to establishing a security culture throughout the organization.

4. See the regulations as an opportunity.

Compliance requirements should be seen as the floor, not the ceiling. Regulatory pressures can be used as a springboard for stronger detection, intervention, and cultural integration.

Many organizations approach regulations with only minimal compliance in mind. Mature organizations, however, use regulatory requirements as a catalyst to develop safety programs and provide organizational support. Regulations can offer powerful arguments for securing budget approval, raising awareness, and setting priorities.

Remote Access: Ongoing Critical Risk

One of the issues particularly highlighted in the report is that remote access continues to expose organizations to disproportionate risks. As remote access requirements increased in the post-COVID-19 pandemic, these access points became attractive targets for attackers.

To ensure remote access security, multiple layers of control should be implemented, including multi-factor authentication, network segmentation, privileged access management, and continuous monitoring. Furthermore, carefully managing access for third-party vendors and service providers is critical.

Limited Prevalence of Advanced Applications

The limited prevalence of advanced security practices such as threat hunting and red/purple team exercises indicates that the industry is evolving towards more mature security capabilities. While these practices are critical for proactive threat detection and testing of defense capabilities, they remain challenging goals for many organizations due to resource requirements and the need for technical expertise.

However, the adoption of these practices allows organizations to actively seek out unknown threats and test the effectiveness of their defenses against real-world attacks, rather than simply reacting to known threats. As we enter 2026, the increased adoption of these capabilities by more organizations will be crucial for the overall resilience of the sector.

Conclusion: From Enhanced Development to True Resilience

This survey series, conducted since 2017, shows that the industry has made tangible progress. However, additional data reveals that gaps persist in the layers of the Purdue Model where the results are most critical.

Looking ahead to 2026, the challenge is clear: closing these gaps before attackers exploit them and transforming today's incremental improvements into tomorrow's resilience. This isn't just about buying more technology; it's about embedding a security culture at every level of operations, breaking down silos between IT and OT, and building true cyberresilience beyond compliance.

Critical infrastructure operators, system integrators, and technology providers all have roles to play in this transformation. Success depends on each stakeholder taking responsibility and sharing knowledge and experience for collective defense.

Note: This analysis is based on the SANS Institute's 2025 State of ICS/OT Cybersecurity Survey report. The full report can be found at the report linked below. https://www.sans.org/mlp/state-of-ics-ot-security-2025

First published: LinkedIn, 2026-01-27 22:13. Original article: https://www.linkedin.com/pulse/2025-icsot-g%C3%BCvenli%C4%9Fi-gelinen-nokta-mevcut-riskler-ve-ileriye-%C3%B6zhan-9dwff