SANS State of OT Security 2025: What the Data Tells Us

The 2025 SANS State of ICS/OT Cybersecurity Survey finds meaningful improvements in detection and containment but critical gaps remain—only ~12.6% report full visibility across the ICS kill chain, visibility is especially poor at Purdue Levels 1–2 and remote sites, adoption of ICS-specific threat intelligence is low, and remediation timelines are often lengthy; the report recommends investing in OT-native asset visibility, extending detection across all Purdue levels, operationalizing ICS-specific threat intelligence, practicing realistic OT incident response, and treating compliance as a baseline for stronger resilience.