Could Your Plant Recover in a Day? What the 2026 SANS Report Shows
What the 2026 SANS report reveals about visibility, people and recovery in OT
When an attack or failure stops production, OT incident recovery decides how much it costs. Yet new research shows most industrial organizations aren’t confident they could restore their most critical systems quickly.
Earlier this year, we wrote about why OT systems weren’t built for today’s threats. As OT environments become more connected, teams struggle to answer basic questions about what’s running, what changed and what’s at risk. This month, SANS released its 2026 State of ICS/OT Security report, based on a survey of nearly 700 IT and security professionals [1][2]. Three findings stand out for anyone responsible for keeping production running.
3 Findings from the 2026 SANS ICS/OT Security Report
1. Most teams can’t see their whole OT environment
Only 13% of respondents said they have full IT/OT visibility across the cyber kill chain, and 43% named budget as the most common barrier to better detection [2]. Recovery starts with knowing what you have. If you can’t say which devices are running which versions, you can’t confidently restore them.
2. Too much depends on too few people
68% of organizations said losing one or two key people would delay or severely risk their ICS/OT security and incident response [2]. In many plants, the engineer who knows where the right PLC program lives is the recovery plan. When that person is out, recovery slows down.
3. Most plants can’t recover their most critical system in a day
Only 27% of all respondents said they believe they could bring their most critical facility back online within a day. Organizations that plan for recovery are far more confident. Among those that test their continuity and disaster recovery plans at least once a year with ICS/OT included, 46% said they believe they could restore their most critical facility within a day [3].
Why OT Incident Recovery Matters More Than Ever
The pressure on industrial teams keeps growing. Dragos counted 1,140 ransomware incidents affecting industrial organizations in the second quarter of 2026, a 12% increase over the first quarter. Manufacturing was the most affected sector, with 747 incidents [4]. Many of these attacks start on the IT side, but the cost is measured in stopped production. We looked at several of this year’s biggest shutdowns in When Production Stops: Lessons from 2026’s Manufacturing Cyberattacks.
There’s also a confidence gap. In the SANS survey, every industrial security leader who answered said their plants would keep running through a full IT compromise, while engineers closer to the equipment were less sure [3].
How the Fastest-Recovering Plants Prepare
The plants that recover fastest aren’t necessarily the ones with the most tools. They treat OT incident recovery as part of everyday operations:
- They know what’s running on every PLC, HMI and robot, and what changed.
- They keep current backups of every device, whatever the vendor.
- They keep program history and change records in the system, not in one person’s head.
- They test recovery regularly, with OT included.
One SANS instructor’s advice was direct: test industrial incident response and the engineering recovery of critical assets like PLCs, RTUs and HMIs, and share the lessons between IT and OT teams [3].
Frequently Asked Questions
What is OT incident recovery?
OT incident recovery is the process of restoring operational technology, such as PLCs, HMIs, SCADA systems and robots, to a known good state after a cyberattack, failure or unauthorized change, so production can safely resume.
How long does it take to recover from an OT incident?
It varies widely. In the 2026 SANS survey, only 27% of organizations said they believe they could bring their most critical facility back online within a day. Organizations that regularly test recovery plans with OT included were much more confident [3].
How can manufacturers recover from OT incidents faster?
Start with visibility into every device and version, keep current backups of PLC and HMI programs across all vendors, track every change, reduce reliance on a few key people, and test recovery at least once a year with OT teams involved.
Sources
[1] SANS Institute, “SANS 2026 State of ICS/OT Security Survey Insights: Industrial Cybersecurity at a Crossroads,” November 10, 2026. https://www.sans.org/white-papers/sans-2026-state-of-icsot-security-survey-insights-industrial-cybersecurity-crossroads
[2] Phil Muncaster, “OT Incidents Hit a Third of Industrial Organizations, SANS Finds,” Infosecurity Magazine, November 11, 2026. https://www.infosecurity-magazine.com/news/ot-incidents-third-industrial/
[3] Mirko Zorz, “CISOs say OT will survive a cyberattack, but their engineers aren’t so sure,” Help Net Security, November 12, 2026. https://www.helpnetsecurity.com/2026/11/12/sans-industrial-cybersecurity-survey/
[4] Dragos, “Industrial Ransomware Analysis for Q2 2026.” https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q2-2026
Ready to Speed Up Your Recovery?
Octoplant, from our partner AMDT, gives your team a clear view of every PLC, HMI and robot on the floor, keeps current backups across every vendor, and tracks every change, so you can get back to a known good state fast when something goes wrong.