Based on a survey of more than 600 global industrial cybersecurity leaders, the Honeywell 2026 OT Cybersecurity Benchmark Report found 88 percent of respondents described their OT cybersecurity programs as mature, while 21 percent reported having a complete inventory of their OT assets.
On top of that, 16 percent of respondents said their organizations continuously monitor more than three-quarters of their building automation systems, and only 20 percent said the same for connected IoT devices such as cameras and thermostats.
On average, survey respondents said for their most significant incidents, they reported 16.2 hours of downtime. Additionally, 21 percent of respondents estimated downtime costs above $100,000 an hour. If you take the averages of those two, that means there is a cost of $1.62 million per incident.
Incident Costs Huge
Furthermore, 4 percent of respondents estimated costs above $500,000 per hour. If you take that number and multiply it by 16.2 hours of downtime and you get $8.1 million for an incident.
Add on top of that, 91 percent of energy and utilities respondents experienced a significant OT cybersecurity incident in the past 12 months. Moreover, 28 percent of incident-affected oil and gas respondents report effects across multiple regions.
Looking into the future, 99 percent of respondents expect AI to affect OT security within the next two to three years, while just 23 percent reported using autonomous or agentic operation for threat detection.
To date, organizations have taken steps to broaden OT security coverage, according to the report. For example, 64 percent of respondents said their organizations include safety systems; 57 percent include physical security systems; and 56 percent include facility infrastructure, a category that can include chillers, switchgear and fire panels. Yet many organizations still leave connected systems outside the security program. That creates gaps in visibility and protection across the wider operational environment.
Execution capacity forms the foundation, determining whether organizations can mobilize ownership, expertise, response support and governed automation when disruption occurs.
Source: Honeywell
As a result, the stakes are often physical: 64 percent of respondents said a significant incident could have a severe or high impact on physical equipment and worker or customer safety. In operational environments, safety is part of OT security maturity, not a separate concern.
AI and Cybersecurity
AI is also appearing the cybersecurity toolbox.
AI-enabled threat detection leads at 72 percent, followed by continuous monitoring at 68 percent and asset inventory at 59 percent. Full autonomy is more unusual. Most AI capabilities still assist human analysts, rather than acting independently. In total, 23 percent report autonomous or agentic operation for threat detection, and 23 percent also report it for continuous monitoring. Separately, 19 percent report autonomous or agentic operation for asset inventory.
These figures add another dimension to the OT security maturity question: how much authority AI systems are given, how their actions are governed and whether operators can trust them in live production environments.
“As cyber threats increasingly impact physical operations, resilience depends on extending cybersecurity across every connected system that supports uptime and business continuity,” said Jim Masso, president and chief executive of Honeywell Technologies Process Automation. “Organizations can no longer afford to have this visibility gap.”
Despite widespread confidence in cybersecurity programs, companies still show significant gaps in visibility across operational environments. Along those lines, 33 percent of organizations surveyed fully integrated OT into a centralized security operations center, while 20 percent continuously monitor connected IoT devices such as cameras and sensors.
The survey’s findings point toward organizations that have stronger visibility are four times better positioned to identify threats, respond to incidents and restore operations quicker. Respondents indicated cyber incidents are no longer viewed solely as technology events, but operational issues that can affect employee safety, customer service, and production continuity.
The report surveyed more than 600 cybersecurity risk, compliance and operations leaders across critical infrastructure sectors, including energy, oil and gas, healthcare, maritime and manufacturing, with participation across the Americas, EMEA and APAC.
Click here to register for the report.