OT and ICS Security Statistics Guide: Industrial Incidents, Vulnerabilities and Exposure

Industrial cyber security decisions are often justified with numbers that nobody can trace, while the publishers that do collect operational technology (OT) and industrial control system (ICS) data measure very different things. This page brings together the latest OT and ICS statistics from primary publishers: the Dragos OT/ICS Cybersecurity Report (Year in Review), the SANS State of ICS/OT Security survey, Claroty Team82 and Nozomi Networks Labs research, ENISA's Threat Landscape and the CISA Known Exploited Vulnerabilities (KEV) catalogue. Every figure carries its publisher, report and edition in the same sentence or table row; vendor research is attributed to the vendor, and anything we could not trace to the publisher's own page is left out. It is for OT security leads, plant and engineering managers, risk teams and CISOs who need defensible numbers for investment cases and threat models. Last reviewed: October 2026.

Key takeaways

• Ransomware is the dominant industrial threat by volume. The Dragos 2026 OT/ICS Cybersecurity Report counts 119 ransomware groups targeting industrial organisations in 2025, up from 80, affecting about 3,300 industrial organisations, with manufacturing more than two thirds of victims.
• Remote access is the leading way in. The SANS 2025 State of ICS/OT Security Report finds unauthorised external access behind half of incidents, while only 13% of respondents have fully implemented advanced ICS-aware remote access controls.
• Exposure is widespread and exploitable. Claroty Team82 research finds 12% of almost one million OT devices analysed contain known exploited vulnerabilities, and 40% of organisations in its data have such assets insecurely connected to the internet.
• Detection is faster than recovery. SANS 2025 reports almost half of incidents detected within 24 hours, yet 19% took more than a month to remediate; Dragos 2026 puts average OT ransomware dwell time at 42 days.
• Patching alone will not close the gap. Dragos 2026 finds 26% of ICS advisories had no vendor patch or mitigation and 25% of ICS-CERT and NVD vulnerabilities carried incorrect CVSS scores.

Headline statistics

Statistics by theme

Threat activity and ransomware

• Ransomware volume: the Dragos 2026 OT/ICS Cybersecurity Report counts 119 ransomware groups targeting industrial organisations in 2025 against 80 in 2024, and about 3,300 industrial organisations affected worldwide. The same release describes a 64% year-on-year rise in attacks; the 49% figure refers to the number of groups.
• Sector concentration: Dragos 2026 reports manufacturing accounted for more than two thirds of industrial ransomware victims. The Jaguar Land Rover Cyberattack 2025 halted production for more than five weeks and is the clearest recent example of how an IT-side incident becomes a manufacturing outage.
• Threat groups: Dragos 2026 tracks 26 OT threat groups, 11 active in 2025, and named three new ones: AZURITE, PYROXENE and SYLVANITE. See the Volt Typhoon Threat Actor Profile for a state actor pre-positioning in critical infrastructure.
• Alert types: Nozomi Networks Labs' February 2026 OT/IoT Security Report, covering the second half of 2025, finds adversary-in-the-middle activity linked to more than a quarter of all alerts in its customer telemetry, with transportation and manufacturing the most affected sectors for the year.
• Botnets against IoT: Nozomi's February 2026 report records a spike on 2 September 2025 when a Mirai clone was upgraded, with attacks from 1,169 unique IP addresses in one day against its honeypots.
• EU context: the ENISA Threat Landscape 2025, covering 4,875 incidents from 1 July 2024 to 30 June 2025, finds hacktivism behind almost 80% of incidents and DDoS 77%, but only 2% of hacktivist incidents caused service disruption. Transport (7.5%) and manufacturing (2.9%) are among the most targeted EU sectors. ENISA does not publish a separate OT figure in its announcement.

Incidents, detection and recovery

• Regulation and impact: SANS 2025 reports that regulated sites had incident rates similar to unregulated ones but about 50% fewer financial and safety impacts.
• Precautionary shutdowns: operational impact often comes from the decision to stop production rather than attacker action on controllers. In the Colonial Pipeline Ransomware Attack 2021, attackers entered through an unused VPN account without MFA and the pipeline was shut down for about six days as a precaution, without the attackers reaching pipeline controls.

Vulnerabilities and advisories

• Unpatchable advisories: the Dragos 2026 Year in Review finds 26% of ICS advisories came with no vendor patch or mitigation, so compensating controls (segmentation, access restriction, monitoring) are the only option for a quarter of issues.
• Scoring errors: Dragos 2026 reports 25% of ICS-CERT and NVD vulnerabilities had incorrect CVSS scores, and rated only 2% of ICS-relevant vulnerabilities as needing action "Now".
• Severity in deployed estates: Nozomi's February 2026 report finds almost half of the vulnerabilities in observed environments rated high or critical, with Siemens, Rockwell Automation and Schneider Electric devices most commonly affected, reflecting their install base. The top weakness class was CWE-416 Use After Free at 13.8%.
• Known exploited ICS flaws: the CISA KEV catalogue (version 2026.10.21) includes ICS entries such as CVE-2023-6448, an insecure default password in Unitronics Vision PLCs and HMIs (added 11 December 2023), and CVE-2021-22681, insufficiently protected credentials in multiple Rockwell products (added 5 March 2026). Both are credential weaknesses rather than memory corruption.
• Advisory counts: CISA publishes ICS advisories individually and does not present an annual total on its advisories page; we could not retrieve a primary count, so none is given here.

Exposure and connectivity

Defensive maturity

• Remote access controls: only 13% of SANS 2025 respondents have fully implemented advanced ICS-aware remote access controls, though unauthorised external access started half of incidents. See the OT Remote Access Guide.
• Visibility: 12.6% of SANS 2025 respondents report full visibility across the ICS Cyber Kill Chain, and Dragos 2026 links comprehensive OT visibility with containment in about 5 days. See the OT Asset Visibility Guide.
• Wireless authentication: Nozomi's February 2026 data shows enterprise-grade 802.1X authentication on only 0.3% of detected Wi-Fi networks in its customer environments.

What the numbers mean for defenders

• Small versus large operators: a single-site water utility or manufacturer gains most from removing internet exposure, changing default credentials and replacing always-on vendor VPNs. Large multi-site operators need a central asset inventory, OT monitoring across sites and IEC 62443 zones and conduits applied consistently. See the IEC 62443 Guide and the Water and Wastewater Cybersecurity Guide.
• Where identity fits: shared engineering logins, vendor accounts, default PLC passwords and service accounts on historians are the credentials behind the "valid accounts" and "external remote services" routes. See the OT and ICS Identity and Access Guide.
• Plan for recovery, not just detection: with 19% of incidents taking more than a month to remediate (SANS 2025), test restoration of engineering workstations, PLC logic and HMI configurations. See the OT Incident Response Guide.

How to turn these figures into a programme:

1. Measure exposure first: check for internet-reachable OT assets and map every remote access path, including vendor connections.
2. Fix the cheap, high-yield items: default credentials, unused accounts and direct exposure, verified with a follow-up scan.
3. Pilot monitoring on one site: deploy passive OT monitoring in listen-only mode, tune alerts for a month and confirm no process impact before scaling.
4. Segment by zone: introduce conduits and firewall rules in alert-only mode first, with a documented rollback to the previous rule set if a process is affected.
5. Exercise: run a ransomware tabletop covering the precautionary shutdown decision, then refresh the figures when each publisher releases its next edition.

Metrics that show OT security is improving:

• Internet-exposed OT assets: count, target zero, checked monthly.
• Remote access through a brokered, MFA-protected path: share of all remote sessions.
• Asset inventory coverage: share of OT assets with known firmware and owner.
• KEV-affected OT assets: count remediated or compensated within agreed time.
• Time to detect in exercises: hours from simulated intrusion to OT alert.
• Restoration time: hours to restore a PLC project and HMI from known-good backup in the last test.

Common failure patterns when using OT statistics

• Treating vendor telemetry as the whole sector: Claroty and Nozomi figures describe their customers' estates, which are already monitored. Unmonitored sites are likely worse, not better.
• Counting every IT ransomware event as an OT attack: many industrial outages, like Colonial Pipeline, came from precautionary shutdowns after IT compromise. Record which systems were actually affected.
• Prioritising by CVSS alone: Dragos 2026 finds a quarter of scores wrong. Use exploitation evidence (KEV), exposure and process impact.
• Waiting for patches: a quarter of advisories have none. Without compensating controls those assets stay exposed indefinitely.
• Mixing survey and telemetry rates: "one in five organisations had an incident" (SANS survey) and "12% of devices have KEVs" (Claroty telemetry) measure different things and should never be combined into one risk score.

Methodology notes and caveats

• Vendor figures are the vendor's: Dragos, Claroty and Nozomi sell OT security products and services; their samples reflect their customers and detection methods.
• Survey limits: SANS respondents are security-engaged practitioners; organisations without OT security staff are under-represented.
• Two figures in one release: Dragos reports both a 49% rise in ransomware groups and a 64% rise in attacks; state which one you mean.
• Refresh cycle: Dragos publishes each February, Nozomi twice a year, SANS each autumn, Claroty several sector reports a year, and ENISA its Threat Landscape each autumn.

Practitioner checklist

• Quote each OT figure with publisher, report name and period, and label vendor research as such.
• Scan for internet-exposed OT assets and remove direct exposure.
• Route all remote and vendor access through a brokered, recorded, MFA-protected path.
• Change default credentials on PLCs and HMIs at commissioning and track KEV-listed ICS flaws.
• Prioritise vulnerabilities by exploitation, exposure and process impact, not CVSS alone.
• Apply compensating controls where no patch exists, using IEC 62443 zones and conduits.
• Deploy passive OT monitoring and measure time to detect in exercises.
• Test restoration of PLC logic, HMI and engineering workstation backups.
• Recheck these figures when each publisher releases its next edition.

Standards and references

• CISA: Known Exploited Vulnerabilities Catalog
• ENISA: Threat Landscape 2025 announcement
• MITRE ATT&CK: External Remote Services (ICS)
• MITRE ATT&CK: Internet Accessible Device (ICS)
• SANS Institute: 2025 State of ICS/OT Security Report
• Dragos: 2026 OT/ICS Cybersecurity Report (Year in Review)
• Claroty Team82: State of CPS Security 2025, OT Exposures
• Nozomi Networks Labs: OT/IoT Security Report, February 2026

Related NHI Mgmt Group resources: OT Security Guide · NIST SP 800-82 OT Security Guide · Top 10 OT Security Risks · Ransomware Statistics Guide · Vulnerability and Exploitation Statistics Guide