OT Resilience Gap: CISOs Overconfident, Engineers Know Better
Written by AI from the linked story. Not reviewed by an editor. How this works
The SANS 2026 ICS/OT survey exposes a dangerous disconnect between executive perception and operational reality in industrial cybersecurity: while CISOs universally believe their plants could survive a cyberattack, only 15% of engineers share that confidence for sustained manual operations beyond 48 hours. This gap suggests that leadership assumptions about OT resilience are not being validated through hands-on technical testing or realistic tabletop exercises. Meanwhile, a 1.7x year-over-year rise in ICS/OT incidents combined with slower detection times means threats are growing faster than defensive capabilities. When leaders don't engage with the technical realities their engineers face, critical gaps in business continuity planning go unaddressed until a real incident exposes them catastrophically.
Tactical Insight
Immediate actions
- Conduct joint tabletop exercises that include both CISOs and plant engineers to surface realistic capability gaps in manual operations.
- Establish a baseline measurement of how long each critical OT process can sustain safe production manually without digital systems.
Long-term improvements
- Require routine technical resilience testing (red team, drills, failover tests) with results reviewed by both engineering and executive leadership.
- Develop and regularly update OT-specific business continuity and incident response plans co-authored by engineers, not just security leadership.
- Invest in OT-specific detection tooling and reduce mean time to detect by setting measurable SLAs tied to ICS/OT monitoring.
Detection & governance measures
- Implement formal feedback loops so engineering-level incident observations are escalated and factored into executive risk assessments.
- Track and report ICS/OT incident metrics (frequency, detection time, containment time) at the board level to close the perception gap.