[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fE7z75e0J9zcR74MHAQWnAinaa1vb5MMmZIMV4Yd0EzU":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"08002a49-8d97-4f33-8424-31a70a2ef275","CISOs say OT will survive a cyberattack, but their engineers aren’t so sure","cisos-say-ot-will-survive-a-cyberattack-but-their-engineers-aren-t-so-sure-f52c32","Ask industrial security chiefs whether their plants would keep running through a full IT compromise, and every one who answered the SANS 2026 ICS\u002FOT survey says yes. Thirty-eight percent expect to run indefinitely on islanded ICS\u002FOT systems, and 62% expect to get by temporarily on manual controls. None foresee degradation or a halt. The 696 practitioners SANS surveyed, the people who would run those manual controls, are less sure. Only 15% said their critical processes … More → The post CISOs say OT will survive a cyberattack, but their engineers aren’t so sure appeared first on Help Net Security.","A SANS 2026 ICS\u002FOT survey reveals a significant disconnect between industrial security chiefs and their engineers regarding operational technology (OT) resilience during cyberattacks. While 100% of surveyed CISOs believe their plants would continue running, engineers are far less optimistic, with only 15% confident critical processes could sustain safe production manually for over 48 hours. The survey also noted a 1.7x increase in ICS\u002FOT cyber incidents compared to the previous year, with slower detection times and a lack of routine technical testing by leadership.","CISOs are confident OT systems can survive cyberattacks, but engineers are less sure, according to a SANS survey.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fsans-industrial-cybersecurity-survey\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002F10094946\u002Findustrial_network-1500.webp","2026-11-12T05:30:13+00:00","2026-11-12T06:00:09.127858+00:00",7,[17,20,22,24],{"name":18,"type":19},"ICS\u002FOT","technology",{"name":21,"type":19},"SCADA",{"name":23,"type":19},"DCS",{"name":25,"type":26},"SANS","vendor","d6f63bb8-0801-486a-be7f-171400700454",{"id":27,"icon":29,"name":30,"slug":31},null,"IoT\u002FOT","iot-ot",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[25],{"controls":48,"vendors":135},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"pentera","Pentera","\u002Fvendor-logos\u002Fpentera.png","pentera-platform","Pentera Platform","https:\u002F\u002Fpentera.io\u002Fpentera-platform\u002F","Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-flex","AttackIQ Flex","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fflex\u002F","Agentless, on-demand testing of security controls without deploying the full platform.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"slug":79,"name":80,"problem":81,"products":82},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"slug":108,"name":109,"problem":110,"products":111},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":37,"product_name":132,"url":133,"description":134},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":146},"ot-resilience-gap-cisos-overconfident-engineers-know-better","OT Resilience Gap: CISOs Overconfident, Engineers Know Better","The SANS 2026 ICS\u002FOT survey exposes a dangerous disconnect between executive perception and operational reality in industrial cybersecurity: while CISOs universally believe their plants could survive a cyberattack, only 15% of engineers share that confidence for sustained manual operations beyond 48 hours. This gap suggests that leadership assumptions about OT resilience are not being validated through hands-on technical testing or realistic tabletop exercises. Meanwhile, a 1.7x year-over-year rise in ICS\u002FOT incidents combined with slower detection times means threats are growing faster than defensive capabilities. When leaders don't engage with the technical realities their engineers face, critical gaps in business continuity planning go unaddressed until a real incident exposes them catastrophically.",[141,142,143,144,145],"NIS2 Article 21(2)(c)","NIS2 Article 21(2)(f)","NIST CSF 2.0 GV.RM-06: Risk Management Strategy","NIST SP 800-53 CP-4: Contingency Plan Testing","NIST CSF 2.0 DE.CM-01: Monitoring",{"NIS2 Article 21(2)(c)":147,"NIS2 Article 21(2)(f)":148,"NIST CSF 2.0 DE.CM-01: Monitoring":149,"NIST SP 800-53 CP-4: Contingency Plan Testing":150,"NIST CSF 2.0 GV.RM-06: Risk Management Strategy":151},"This point requires organizations to maintain business continuity and crisis management plans, directly addressing the finding that plants cannot sustain safe manual operations for 48+ hours during a cyberattack.","This point requires assessing the effectiveness of cybersecurity measures, which the survey shows is failing because leadership is not conducting routine technical testing to validate OT resilience claims.","This category requires continuous monitoring of systems to detect adverse events, directly relevant to the survey's finding of slower ICS\u002FOT detection times and inadequate monitoring practices.","This control requires organizations to test contingency plans through exercises and drills, the absence of which allowed leadership to hold unfounded assumptions about OT continuity capabilities.","This category calls for risk assumptions to be validated and communicated across the organization, which would have surfaced the disconnect between CISO confidence and engineer-assessed operational reality."]