Nozomi Networks

5.0% of surveyed OT and ICS cybersecurity professionals report production deployment of agentic AI.

Only 7.6% of surveyed OT and ICS cybersecurity professionals are very confident in controls that protect AI tools and models because those controls have been tested.

Only 7.9% of surveyed OT and ICS cybersecurity professionals have deployed AI for multiple OT cybersecurity functions.

In the second half of 2025, 40% of all ransomware attacks targeted US-based companies.

Scattered Spider accounted for 42.9% of all actor-related alerts in the second half of 2025.

Only 2% of organizations in industrial and critical infrastructure environments use enterprise-grade authentication such as 802.1X.

Manufacturing was at the highest risk of attacks in the 2nd half of 2024.

Only 6% of over 500,000 wireless networks worldwide are adequately protected against wireless deauthentication attacks.

Among 619 newly published vulnerabilities in the 2nd half of 2024, 71% were classified as critical.

21% of surveyed OT and ICS cybersecurity professionals report that agentic AI has reached an active pilot, proof of concept, or production environment.

63.9% of surveyed OT and ICS cybersecurity professionals consider attacks targeting AI systems or operational data either a top-tier operational risk (20.5%) or an emerging priority (43.4%).

Only 11.9% of surveyed OT and ICS cybersecurity professionals have formally mapped and reviewed which AI-driven decisions could directly affect physical processes, safety systems, or operational continuity.

24.5% of surveyed OT and ICS cybersecurity professionals report using AI for SOC augmentation.

22.2% of surveyed OT and ICS cybersecurity professionals report using AI for incident response and triage.

43.4% of surveyed OT and ICS cybersecurity professionals consider attacks targeting AI systems or operational data an emerging priority they are beginning to address.

87.7% of surveyed OT and ICS cybersecurity professionals are using, evaluating, piloting, or planning AI for OT cybersecurity.

49% of surveyed OT and ICS cybersecurity professionals who believe AI's benefits outweigh the risks recognize material risks around reliability, data integrity, model manipulation, and the need for human oversight.

33.8% of surveyed OT and ICS cybersecurity professionals report using AI for threat detection and alerting.

16.2% of surveyed OT and ICS cybersecurity professionals are conducting a pilot or proof of concept for agentic AI.

31.5% of surveyed OT and ICS cybersecurity professionals report using AI for network monitoring and anomaly detection.

20.5% of surveyed OT and ICS cybersecurity professionals consider attacks targeting AI systems or operational data a top-tier operational risk.

69.9% of surveyed OT and ICS cybersecurity professionals believe AI's benefits in industrial cybersecurity outweigh the risks.

In the second half of 2025, ransomware attacks against Canada and the UK accounted for a combined 30% of attacks.

68% of observed wireless networks in industrial and critical infrastructure environments operate without Management Frame Protection (MFP) despite using modern encryption.

Approximately 98% of observed wireless networks rely exclusively on Pre-Shared Key (PSK)–based authentication.

70% of global ransomware activity targets English-speaking countries.

Nearly half (48.4%) of observed cyber threat alerts occurred in the Impact phase of the cyber kill chain in the 2nd half of last year.

20 vulnerabilities had high Exploit Prediction Scoring System (EPSS) scores, indicating a high likelihood of future exploitation.

25% of all observed alerts involved Command and Control (C&C) techniques in the 2nd half of last year.

Manufacturing was followed by Energy, Communications, Transportation and Commercial Facilities in terms of ICS security advisories released by CISA.

In the 2nd half of 2024, critical infrastructure organisations in the United States saw the highest number of attacks.

Critical manufacturing accounted for 75% of all Common Vulnerabilities and Exposures (CVEs) reported by CISA in the past six months.