Report by Dragos
2026 OT Cybersecurity Year in Review
Key Findings
The average dwell time for ransomware in OT environments is 42 days.
25% of ICS-CERT and NVD vulnerabilities have incorrect CVSS scores.
Ransomware attacks against industrial organizations increased 64% year-over-year.
Organizations with comprehensive OT visibility detect and contain OT ransomware incidents in an average of 5 days, compared to the industry-wide average of 42 days.
KAMACITE conducted sustained reconnaissance of U.S. industrial devices from March through July 2025.
Manufacturing accounts for more than two-thirds of all ransomware victims.
26% percent of advisories in 2025 contained no patch or mitigation from vendors.
The number of ransomware groups targeting industrial organizations increased 49% year-over-year to 119 groups, collectively impacting 3,300 organizations globally.
In June 2025, BAUXITE deployed two custom wiper malware variants against Israeli targets.