---
title: SANS Institute State of ICS/OT Security 2025
description: The latest SANS Institute State of ICS/OT Security 2025 report delivers practical insights for OT (operational technology) professionals.
canonical_url: https://www.acronis.com/en/resource-center/resource/sans-institute-state-of-ics-ot-security-2025/
locale: en
last_updated: 2026-10-11
---

November 19, 2025

[Analyst Reports](https://www.acronis.com/en/resource-center/category/analyst-reports/)
# SANS Institute State of ICS/OT Security 2025

[View this asset as a PDF](https://staticfiles.acronis.com/downloads/bf1bdafb7a7e56ff3fd39ddb926ee6f1 "View this asset as a PDF")

![Image 1: SANS Institute State of ICS/OT Security 2025](https://staticfiles.acronis.com/images/content/81c57cd166a62390813370b4601962ec.png)

## Discover why cyber resilience is critical in OT environments

Get the key findings and analysis from this essential benchmark for industrial cyber resilience. The latest SANS Institute State of ICS/OT Security 2025 report delivers practical insights for OT (operational technology) professionals.​

### Read the report to discover key facts, such as:

*   **Incident reality**: 21% of organizations suffered an OT cyber incident in the past year; 40% experienced operational disruption, and almost 20% took over a month to recover.

*   **Detection vs. recovery gap**: While half of organizations surveyed detected threats within 24 hours, remediation remained difficult, with more than 22% of incidents requiring 2–7 days for recovery and 3% needing a full year. 

*   **Resilience matters**: Mature, resilient organizations cut financial losses in half with rapid recovery and regular preparedness exercises.

The report also delivers actionable advice on how to develop cyber resilience, including:

*   Pushing monitoring deeper into process and remote environments.

*   Developing and testing real recovery plans, not just backups.

*   Engaging your entire workforce in cyber drills.

*   Using compliance as a jumping-off point for true resilience.

Download the SANS Institute’s report and explore data-driven strategies to protect critical operations in your OT environment. 

For deeper perspective, watch the [on-demand webcast “SANS 2025 ICS/OT Survey Webcast & Forum: The State of ICS/OT Cybersecurity”](https://acronis.events/event/sans-2025-icsot-survey-webcast-forum-the-state-of-icsot-cybersecurity-on-demand/) to gain additional insights into strengthening your industrial security posture. 

Cyber Protect

Secure your legacy OT infrastructure without disrupting operations.

[Talk to an OT expert](https://www.acronis.com/en/products/cyber-protect-ot/book-call/?utm_webteam=nrc-banner)  
[Try now](https://www.acronis.com/en/products/cyber-protect-ot/trial/?utm_webteam=nrc-banner)

[Operational Technology (OT)](https://www.acronis.com/en/resource-center/tag/operational-technology/)