Incident Response, Anomaly Detection Rank High on Planned ICS Security Spending

The SANS 2024 State of ICS/OT Cybersecurity report surveys 530 critical infrastructure professionals and finds strong current adoption of access controls (81%), backup and recovery (74.4%), EDR (73%), IT–OT segmentation (66%), and secure remote access with MFA (65%), reflecting a push to harden both the boundary and the “gooey center” of ICS. Over the next 18 months, organizations plan to prioritize ICS-specific metrics/dashboards, network security monitoring and anomaly detection, control system upgrades, ICS-focused training, and incident response tabletop exercises. While least deployed today, SBOM, industrial cloud security, and SOAR show rising planned investment, signaling broader adoption in upcoming ICS security programs.