OT Cyber Tuesday (Ep. 10) - The State of ICS/OT Cybersecurity - The SANS Report

OT Cyber Tuesday (Ep. 10) - The State of ICS/OT Cybersecurity - The SANS Report

by Mike Holcomb

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Mike Holcomb 👥 27K 📅 December 17, 2025 ⏱ 61 min 👁 386 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

OTICScybersecuritySANS surveyincident response

Summary

In this episode of OT Cyber Tuesday, Mike Holcomb discusses the key findings from the SANS 2025 ICS/OT Cybersecurity Survey. He highlights that over 300 OT/ICS professionals participated, with energy and IT sectors being the most represented. The survey reveals that more than one in five organizations experienced a cybersecurity incident in the past year, with 40% causing operational disruptions. Detection is improving, with nearly half of incidents detected within 24 hours, but recovery lags, with nearly 20% taking over a month to remediate. Holcomb emphasizes that only a small fraction of OT environments perform network monitoring, leading to a significant visibility gap. He also addresses the growing integration of AI and cloud in OT, noting the lack of secure implementation practices. The video provides practical insights for OT security professionals, including the importance of preparation and incident response. Holcomb also mentions upcoming content on CompTIA Sec OT+ and encourages viewers to download the full report from SANS.

158 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable insights into the current state of OT/ICS cybersecurity, based on a large survey. Holcomb’s analysis is thoughtful, acknowledging the limitations of the survey and the broader visibility issue in OT environments. He effectively argues that the reported detection times may be skewed by the fact that only well-resourced environments perform monitoring. His argumentation is solid, drawing on his experience and referencing specific incidents like the Norway dam compromise. However, the video is primarily an opinion piece rather than a rigorous scientific analysis, and some claims lack direct evidence.

Scientific Rigor, Source Quality, Title Accuracy

The primary source is the SANS 2025 ICS/OT Cybersecurity Survey, which is a reputable industry report. Holcomb references the survey’s findings and provides his own commentary. He also mentions the CompTIA Sec OT+ certification and the Norway dam incident, but does not provide direct links. The title accurately reflects the content, which is a discussion of the SANS report. The video does not include a formal citation of sources, but the survey is publicly available. The host’s credibility is established through his experience in the field.

193 words

Title / Content Match

The title accurately reflects the content, which is a discussion of the SANS report on ICS/OT cybersecurity.

Quality & Reliability

7/10

The video is an expert commentary on the SANS 2025 ICS/OT Cybersecurity Survey. The host provides context and analysis based on his experience, but the primary data comes from the survey itself, which is not independently verified in the video. The host acknowledges limitations and provides balanced interpretation.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • SANS 2025 ICS/OT Cybersecurity Survey — The main source of data discussed in the video.
  • Mike Holcomb's Newsletter — Link to the host's newsletter for further resources.
  • Free OT/ICS Cybersecurity Videos — Link to free educational videos on OT/ICS cybersecurity.

Concurring Sources

  • SANS 2025 ICS/OT Cybersecurity Survey — The survey itself is the primary source and aligns with the video's discussion.

Dissenting Sources

  • No discordant sources identified — The video does not present conflicting sources; it is a commentary on a single survey.

Contribution & Novelties

The video provides a concise summary and expert analysis of the SANS 2025 ICS/OT Cybersecurity Survey, highlighting key trends and practical implications for OT security professionals. It offers a critical perspective on the survey’s findings, particularly regarding the visibility gap and the challenges of AI integration in OT environments.

Pour aller plus loin :

  • SANS ICS/OT Cybersecurity Survey — The full report provides detailed data and analysis.
  • NIST SP 800-82 Rev.2 — Guide to Industrial Control Systems (ICS) Security, a foundational reference.
  • MITRE ATT&CK for ICS — Knowledge base of adversary tactics and techniques specific to ICS.
  • Dragos — A leading OT security vendor, offering threat intelligence and monitoring solutions.
  • Nozomi Networks — Another major OT security provider, known for network visibility and monitoring.

124 words

Radar Profile

The radar profile shows a balanced performance across all dimensions, with slightly higher scores in information quantity and reliability, reflecting the video's solid foundation in a reputable survey. The technical level is moderate, suitable for a broad audience, while the overall quality is good but not exceptional.

Reliability 7/10

💬 Sur les 0 commentaires analysés, aucune tendance n'est disponible.