Organizations may be far less prepared for (OT) cyberattacks than they believe, according to Honeywell Technologies’ 2026 Operational Technology (OT) Cybersecurity Benchmark Report.
The report, based on a survey of more than 600 cybersecurity, risk, compliance and operations leaders across critical infrastructure sectors, found a stark gap between confidence in cybersecurity programs and actual operational readiness. While 88% of respondents described their OT cybersecurity programs as mature, just 21% said they had a complete inventory of their OT assets.
The consequences of that visibility gap can be costly. Organizations reported an average of 16.2 hours of downtime from their most significant cybersecurity incidents, with losses reaching as much as $500,000 per hour.
“As cyber threats increasingly impact physical operations, resilience depends on extending cybersecurity across every connected system that supports uptime and business continuity,” said Jim Masso, President and CEO of Honeywell Technologies Process Automation. “Organizations can no longer afford to have this visibility gap.”
The report also highlights limited integration between OT environments and broader cybersecurity operations. Only 33% of organizations said they have fully integrated OT into a centralized security operations center, while just 20% continuously monitor connected IoT devices such as cameras and sensors.
The findings point to significant exposure across several industries.
Energy and utilities: 91% of respondents reported experiencing a significant OT cybersecurity incident in the past 12 months.
Maritime: 87% reported a significant OT cybersecurity incident during the same period.
Oil and gas: 54% reported experiencing a significant OT cybersecurity incident in the past 12 months.
Healthcare: Only 19% said facility and building systems are fully integrated into cybersecurity monitoring and protection.
Artificial intelligence is adding another layer of urgency. Nearly all respondents—99%—expect AI to affect OT security within the next two to three years. Yet only 23% said they currently use autonomous or agentic operations for threat detection.
The report says organizations with stronger visibility are four times better positioned to identify threats, respond to incidents and restore operations more quickly.
That shift reflects a broader change in how industrial organizations view cyber risk. Cyber incidents are increasingly being treated not simply as IT problems, but as operational threats capable of disrupting employee safety, customer service and production continuity.
The survey covered more than 600 leaders responsible for cybersecurity risk, compliance and operations across critical infrastructure sectors, including energy, oil and gas, healthcare, maritime and manufacturing. Respondents came from the Americas, EMEA and APAC.
