A growing disconnect is emerging between the confidence of Chief Information Security Officers (CISOs) and the concerns of security engineers when it comes to protecting Operational Technology (OT) environments from cyber threats. While senior cybersecurity leaders believe their companies are reasonably well-prepared to withstand cyberattacks, the professionals responsible for managing and securing these systems appear to have a less optimistic outlook.
Research conducted by the SANS Institute highlights this difference in perception in its 2026 ICS/OT Cybersecurity Survey. According to the findings, many CISOs are confident that their organizations’ OT infrastructure can withstand cyberattacks. Furthermore, approximately 62% of respondents believe that their organizations could continue operating through manual controls even if their IT infrastructure were compromised. This confidence suggests that businesses are increasingly recognizing the importance of operational resilience and maintaining business continuity during cybersecurity incidents.
However, the perspective among security engineers responsible for protecting critical infrastructure tells a different story. Professionals working directly with industrial control systems, including Supervisory Control and Data Acquisition (SCADA) systems and Distributed Control Systems (DCS), have expressed concerns about their firms’ ability to defend against sophisticated cyberattacks. Their reservations raise important questions about whether the confidence expressed by senior management accurately reflects the security challenges faced on the ground.
The survey, which received responses from 696 participants, found that nearly 15% of respondents were uncertain whether their critical infrastructure, including manufacturing systems and operational controls, could withstand a cyberattack. This uncertainty is particularly concerning because disruptions to OT environments can have consequences far beyond conventional IT security incidents. An attack targeting industrial systems could interrupt production, affect supply chains, damage equipment and, in certain circumstances, create risks to employee safety.
The growing frequency of cyber incidents further reinforces these concerns. According to the survey, 34% of respondents reported that their OT environments had been targeted by cyberattacks during the preceding 12 months. This represents a 1.7-fold increase compared with the incidents reported in 2025, highlighting the expanding threat landscape facing industrial organizations.
More importantly, the consequences of these attacks have been significant. Over 72% of respondents whose organizations experienced such incidents acknowledged that the attacks resulted in operational downtime or disruptions. For manufacturing businesses and critical infrastructure operators, even a temporary interruption can translate into substantial financial losses, delayed deliveries, damaged customer relationships and reduced productivity. In severe cases, prolonged disruptions may also result in workforce-related consequences, including temporary furloughs or job losses.
The cyberattack on Jaguar Land Rover (JLR) serves as a notable example of how a cybersecurity incident can affect industrial operations and have wider economic consequences. It demonstrates that cyber risks are not confined to compromised data or inaccessible IT systems; they can directly affect manufacturing capabilities, employees, suppliers and the broader business ecosystem.
Ultimately, the SANS survey highlights the need to bridge the confidence gap between cybersecurity leadership and the engineers responsible for securing industrial environments. Businesses must look beyond high-level assessments of their security posture and pay closer attention to the practical challenges faced by operational security teams.
Regular security assessments, realistic incident-response exercises, stronger IT-OT security integration and tested manual fallback procedures will be essential to improving resilience. Most importantly, CISOs and business leaders must ensure that their confidence in cybersecurity preparedness is supported by the technical realities of their infrastructure. In an increasingly hostile threat environment, preparedness must be demonstrated through tested capabilities rather than assumed resilience.
