Claroty has published new research on operational security trends and challenges facing global organizations. The report, ‘The Global State of Operational Security 2026: Protecting Operations Evolves as a Core Business Capability’, is based on a global survey of 2,000 business and technology leaders whose organizations manage cyber-physical systems (CPS). The findings reveal that securing operational technology (OT) and CPS is essential to overall operational resilience, business continuity, digital transformation and AI adoption, maintaining compliance standards, and meeting cyber insurance mandates.
The survey showed that cyber incidents impacting CPS result in material effects on the health of a business. It’s a fact that’s driving today’s cyber security investment priorities: 37% of survey-takers said operational risk and cyber threats are a top driver of investment, followed by digital transformation/modernisation (36%), and the risk of business disruption or revenue loss (29%).
Other key findings include:
- The top impacts from operational incidents were: operational downtime (selected by 43% of respondents), safety incidents and hazards (40%), and financial loss (35%).
- The average financial loss from an incident impacting operations was $1.04 million, and losses hit larger companies hardest: organizations with at least 5,000 employees saw $1.6M in average losses, and those with at least 10,000 employees saw $2.25M in average losses.
- The average length of operational downtime from a CPS cyber incident was three days, and nearly 10% of respondents reported downtimes ranging from eight to 30 days.
- Third-party access also contributed to operational risk, with 75% saying they suffered at least one incident impacting operations related to third-party access, and 49% said they had only partial or no monitoring of third-party connections.
- Despite costly impacts, IT and operational security remain fragmented, with only 16% reporting that they’ve fully integrated the two.
Embracing AI adoption while managing AI threats
Respondents indicated they are ready to implement AI across operational environments to improve efficiency and support human-in-the-loop expertise. This is occurring as organizations prepare for a rapid increase in AI-driven attacks against CPS. Survey results include:
- 30% said effective use of AI, automation, and advanced analytics is a top success factor for digital transformation initiatives.
- 70% said AI is being used in operational environments, and 71% said AI is a baseline cyber security procurement requirement.
- Respondents said AI has improved operational efficiency (48%), decision-making (46%), and enabled new business models (37%).
- Respondents consider AI-powered cyber attacks (selected by 37%) as a greater risk to operational integrity than ransomware (27%), supply chain compromises (23%), and legacy OT assets (21%).
Navigating compliance through proactive resilience
The complexities of the regulatory environment and the level of expertise required to understand the convergence of IT and OT operations are creating challenges for organizations, but embracing a proactive approach to compliance helps position organizations for operational resilience. The survey findings show:
- The most common operational barriers threatening the viability of compliance programmes are: ongoing IT/OT alignment challenges (29%), legacy technical debt (26%), and limited asset visibility (16%).
- The top three compliance barriers facing organizations are: keeping up with evolving regulations, mandates, and frameworks (38%), managing compliance across multiple sites, regions, and business units (35%), and implementing the policies and controls needed to achieve compliance (34%).
- 82% of organizations that have fully integrated IT/OT governance have a proactive or structured compliance approach.
- 75% said they have a proactive and structured approach to compliance management.
“Businesses have quickly realised that prioritising operational resilience is key to ensuring robust protection across the world’s most critical infrastructure,” said Sean Tufts, Field CTO at Claroty. “Critical infrastructure organizations are experiencing a seismic shift in the threat landscape, given the proliferation of AI threats and the current geopolitical landscape. This is driving them to reposition from a standard asset-centric mindset to one centred on operational resilience that combines proactive risk reduction with robust recovery capabilities that protect core processes without halting operations.”
The survey shows that operational resilience must be treated as a cyber security imperative and core business priority, with assets protected, segmented, and governed to withstand and rapidly recover from a disruptive incident. Bridging IT/OT governance, mandating strict third-party access controls and monitoring, modernising business continuity plans, and securing AI adoption are the initiatives CIOs and COOs – those most often cited as accountable (39% of respondents) for operational security and its budget (28% said CIOs are owners) – must prioritise in order to maintain the safety and uptime of their operational environments.
Methodology
Claroty partnered with Sapio Research to survey 2,000 full-time company founders, C-level executives, vice presidents, directors, and other technology and business managers spanning 16 industries and more than 40 countries. All respondents are primary decision-makers, part of decision-making teams, or influence technology purchases and implementations.
