The Global State of Operational Security 2026

48% of business and technology leaders say AI has improved operational efficiency.

71% of organizations consider AI a baseline cybersecurity procurement requirement.

38% of business and technology leaders say keeping up with evolving regulations, mandates, and frameworks is a top compliance barrier.

82% of organizations that have fully integrated IT/OT governance have a proactive or structured compliance approach.

37% of business and technology leaders at organizations managing CPS say operational risk and cyber threats are a top driver of investment.

16% of business and technology leaders identify limited asset visibility as an operational barrier threatening the viability of compliance programs.

39% of business and technology leaders cite CIOs and COOs as the roles most often accountable for operational security.

70% of organizations are using AI in operational environments.

43% of business and technology leaders at organizations managing CPS identify operational downtime as a top impact from operational incidents.

35% of business and technology leaders at organizations managing CPS identify financial loss as a top impact from operational incidents.

Nearly 10% of business and technology leaders report operational downtimes lasting eight to thirty days after a CPS cyber incident.

49% of business and technology leaders report having only partial or no monitoring of third-party connections.

Only 16% of organizations report fully integrating IT and operational security.

75% of organizations managing CPS report having a proactive and structured approach to compliance management.

28% of business and technology leaders say CIOs are the owners of the operational security budget.

37% of business and technology leaders identify AI-powered cyberattacks as a greater risk to operational integrity, compared with 27% for ransomware, 23% for supply chain compromises, and 21% for legacy OT assets.

The average financial loss from an incident impacting operations is $1.04 million.

58% of CPS operators report experiencing a cyberattack that impacted operational environments in the last 12 months.

Organizations with at least 10,000 employees see average operational incident losses of $2.25 million.

75% of business and technology leaders report suffering at least one operational incident related to third-party access.

29% of business and technology leaders identify ongoing IT/OT alignment challenges as an operational barrier threatening the viability of compliance programs.

34% of business and technology leaders say implementing the policies and controls needed to achieve compliance is a top compliance barrier.

The average length of operational downtime from a CPS cyber incident is three days.