IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

83% of critical infrastructure companies have experienced breaches in the last three years

Survey finds security practices are weak if not non-existent in critical firms

Nuclear power plant behind power lines

Eighty-three percent of firms in the energy and other critical infrastructure industries have had at least one operational technology (OT) cyber security breach in the prior 36 months.

Many organizations underestimate the risk of a cyber attack, with 73% of CIOs and CISOs "highly confident" their organizations will not suffer an OT breach in the next year, according to a new survey by IT security firm Skybox Security. This is compared to only 37% of plant managers, who have more first-hand experiences with the repercussion of attacks. Skybox Security said this underlined the CISO disconnect between perception and reality.

The study questioned OT security decision makers in the US, UK, Germany, and Australia. Many respondents were from companies with $1 billion or more in revenue within the manufacturing, energy, and utility industries. 

The new research, “Operational Technology Cybersecurity Risk Significantly Underestimated,” found that 40% of all respondents said OT is an afterthought to other digital initiatives, highlighting that cyber security is often at risk from apathy.

The increasingly complex nature of networks in modern critical infrastructure companies was top of mind for respondents. Seventy-eight percent said complexity due to multivendor technologies is a challenge in securing their OT environment. 

Related Resource

The truth about cyber security training

Stop ticking boxes. Start delivering real change.

Pair of feet in socks with a chair and plant in the backgroundFree download

In addition, 39% of all respondents said a top barrier to improving security programs is decisions are made in individual business units with no central oversight. Almost half of CISOs and CIOs said disjointed architecture across IT and OT pose the greatest security risk in their OT environment.

There were also major concerns about third-party risks. Forty percent of all respondents said supply chain/third-party access to the network is one of the top-three highest security risks. Yet, less than half said their organization has a third-party access policy that applied to OT.

Skybox Security Research Lab threat intelligence lead, Sivan Nir, argued that new OT vulnerabilities were up 46% compared to the first half of 2020. “Despite the rise in vulnerabilities and recent attacks, many security teams do not make OT security a corporate priority,” he said.

“Why? One of the surprising findings is that some security team personnel deny they are vulnerable yet admit to being breached. The belief that their infrastructure is safe — despite evidence to the contrary — has led to inadequate OT security measures."

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

What is zero trust?
network security

What is zero trust?

14 Jul 2022
Retbleed hardware-level flaw brings overhead woe to Intel and AMD
Hardware

Retbleed hardware-level flaw brings overhead woe to Intel and AMD

13 Jul 2022
An analysis of the European cyber threat landscape
Whitepaper

An analysis of the European cyber threat landscape

8 Jul 2022
Solve cyber resilience challenges with storage solutions
Whitepaper

Solve cyber resilience challenges with storage solutions

4 Jul 2022

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022