A report from Fortinet shows that organizations are assessing their OT security more realistically. Nevertheless, cyber risks continue to increase, with phishing and ransomware as the biggest threats.
Fortinet states that organizations worldwide are taking OT cybersecurity more seriously. Responsibility for this security is shifting to the CISO, while organizations are assessing their own maturity levels more realistically than before. Yet cyberattacks remain a persistent challenge, despite improved measures.
Despite general improvements, fewer organizations are placing themselves at the highest maturity level, down from 49 percent to just 17 percent. However, the degree of maturity is rising at the lower levels. According to Fortinet, this change does not indicate a decline, but rather a more realistic view of the current security situation.
CISO responsible
The research shows that OT cybersecurity has definitively reached the boardroom. Currently, 60 percent of organizations indicate that the CISO is the one ultimately responsible. Within twelve months, 81 percent expect to formally place this responsibility with the CISO. This marks a significant shift in how organizations manage their security.
This development is linked to increasing digitalization and the growing threat of cyberattacks on critical infrastructure. Organizations recognize that OT security is no longer a purely technical challenge, but a strategic issue that must be addressed at the executive level.
Detection improves, but risks remain
Organizations are reporting cyber incidents more frequently than before. While 47 percent reported at least one intrusion last year, that has now risen to 71 percent. Additionally, the percentage of organizations that saw both IT and OT systems involved in breaches dropped from 60 percent to 24 percent. This points to more effective network segmentation and a better separation between IT and OT environments.
Nevertheless, cyberattacks remain a major threat. The classics, phishing and ransomware, are at the top again. Although ransomware decreased slightly compared to last year, the impact on production processes and business continuity remains significant.
Regulations and modernization remain challenges
89 percent of respondents expect stricter OT cybersecurity regulations within five years, compared to 66 percent a year earlier. This increase underlines that OT security is increasingly linked to critical infrastructure and operational continuity. Organizations must prepare for stricter requirements regarding incident reporting and data security.
The modernization of industrial systems also continues. Nearly half (40%) of organizations indicate that their control systems are less than five years old, which was twenty percent last year. While modernization offers opportunities for better performance and security, connectivity is increasing, meaning cybersecurity must be included from the design stage.
More visibility needed
Full visibility within OT environments remains a challenge for many organizations. Only 14 percent of companies indicate they have full visibility into OT assets and communication processes. At the same time, 23 percent of organizations have only partial insight into about half of their OT environment.
Organizations investing in network segmentation, secure remote access, and integrated incident response are preparing for stricter regulations and future threats. An integrated approach to OT and IT security is becoming increasingly important in this regard.