Honeywell Technologies has released its 2026 Operational Technology (OT) Cybersecurity Benchmark Report, highlighting a gap between how organizations assess the maturity of their cybersecurity programs and their actual operational readiness across critical infrastructure.
The report, based on a survey of more than 600 global industrial cybersecurity leaders, found that 88% described their OT cybersecurity programs as mature, while only 21% reported maintaining a complete inventory of their OT assets. Organizations also reported an average of 16.2 hours of downtime from their most significant cybersecurity incidents, with losses reaching up to $500,000 per hour.
The report also points to growing concerns around AI-enabled threats and the preparedness of industrial organizations to respond. While 99% of respondents expect AI to affect OT security within the next two to three years, only 23% said they currently use autonomous or agentic operation for threat detection.
โAs cyber threats increasingly impact physical operations, resilience depends on extending cybersecurity across every connected system that supports uptime and business continuity,โ said Jim Masso, President and CEO of Honeywell Technologies Process Automation. โOrganizations can no longer afford to have this visibility gap.โ The findings further show that only 33% of organizations have fully integrated OT into a centralized security operations center, while 20% continuously monitor connected IoT devices such as cameras and sensors.
Industry-specific findings also highlighted differences in reported exposure and monitoring capabilities. In Energy & Utilities, 91% of respondents said they had experienced a significant OT cybersecurity incident in the past 12 months. Among maritime respondents, 87% reported experiencing a significant OT cybersecurity incident during the same period.
In Oil & Gas, 54% of energy and utilities respondents reported a significant OT cybersecurity incident in the past 12 months. Within Healthcare, only 19% of respondents said facility and building systems were fully integrated into cybersecurity monitoring and protection. The survey found that organizations with stronger visibility were four times better positioned to identify threats, respond to incidents and restore operations quicker.
Respondents indicated that cyber incidents are no longer viewed solely as technology events, but as operational issues that can affect employee safety, customer service and production continuity. The survey covered cybersecurity risk, compliance and operations leaders across critical infrastructure sectors including energy, oil and gas, healthcare, maritime and manufacturing, with participation from the Americas, EMEA and APAC.
