OT Security Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity | Last updated: September 4, 2026 | License: CC BY 4.0
Twelve. That is how many entries in CISA’s Known Exploited Vulnerabilities catalog — the only federal vulnerability list carrying a binding remediation deadline — cover industrial control, process-automation or physical-infrastructure devices. The catalog held 1,694 entries on September 2, 2026. Operational technology accounts for 0.71% of it.
Quick Answer
Axis Intelligence Research finds that 12 of the 1,694 vulnerabilities in the CISA Known Exploited Vulnerabilities catalog (0.71%) affect industrial control or physical-infrastructure products, and only 6 (0.35%) affect true process-automation software and controllers. Those OT entries reached the catalog a median of 3 years after their CVE was assigned, against a median of 1 year for the catalog overall. Meanwhile 2,118 ransomware complaints — 58.7% of every ransomware complaint the FBI received in 2025 — came from critical infrastructure organizations.
Key Findings
- Axis Intelligence Research finds that operational technology occupies 0.71% of the CISA Known Exploited Vulnerabilities catalog: 12 entries out of 1,694 as of the September 2, 2026 catalog release, of which only 6 are process-automation or controller products.
- Axis Intelligence Research finds a 3-year median lag between CVE assignment and KEV addition for those OT entries, three times the 1-year median for the catalog as a whole — computed from every dated entry in the published catalog.
- Axis Intelligence Research finds that critical infrastructure organizations filed 2,118 of the 3,611 ransomware complaints the FBI Internet Crime Complaint Center received in 2025, or 58.7%, computed by summing the sector values published in the IC3 2025 Annual Report.
- Critical infrastructure victims recovered $146,561,094 of $261,451,001 in reported losses through the FBI’s Financial Fraud Kill Chain in 2025 — a 56% freeze rate across 655 incidents, per the FBI IC3 2025 Annual Report.
- Axis Intelligence Research finds that 4 of the 6 fully OT-dependent critical infrastructure sectors — chemical, critical manufacturing, food and agriculture, and water and wastewater — operate under no binding federal cybersecurity requirement, the condition that produces the widest scores in the Critical Infrastructure Resilience Gap Index.
The Critical Infrastructure Resilience Gap Index (CIRGI™)
Proprietary metric. First published by Axis Intelligence Research, September 2026. Baseline reading.
CIRGI™ scores each of the 14 critical infrastructure sectors for which the FBI publishes 2025 fund-recovery data on a 0–100 scale, where a higher score means a wider gap between the operational consequence a sector faces and the recovery and regulatory machinery available to it. No federal agency and no vendor publishes a figure of this shape: the FBI publishes recovery rates without regulatory context, and CISA publishes sector designations without recovery data. CIRGI™ joins them.
Formula
CIRGI = 100 × [ 0.45 × (1 − R) + 0.30 × D + 0.25 × (1 − M) ]
R — Fund recovery rate (weight 0.45). The sector’s Financial Fraud Kill Chain success rate, read directly from the FBI IC3 2025 Annual Report. A sector that gets its money back has a working escalation path into federal channels; one that does not is discovering the incident too late for the freeze to work.
D — OT dependence coefficient (weight 0.30). 1.0 where core service delivery runs on industrial control systems; 0.5 where control systems support but do not deliver the service; 0 where delivery is entirely IT. Assigned by Axis Intelligence Research against CISA’s sector definitions; the full assignment is in the table below.
M — Federal mandate coefficient (weight 0.25). 1.0 where an enforceable, sector-wide federal cybersecurity requirement exists; 0.5 where a requirement covers part of the sector; 0 where compliance is voluntary. Each assignment names its regulatory instrument.
CIRGI™ 2026 baseline reading (2025 data)
| Sector | R (recovery) | D (OT) | M (mandate) | Mandate instrument | CIRGI™ |
|---|---|---|---|---|---|
| Critical Manufacturing | 0.36 | 1.0 | 0 | None | 83.8 |
| Food and Agriculture | 0.48 | 1.0 | 0 | None | 78.4 |
| Emergency Services | 0.33 | 0.5 | 0 | None | 70.2 |
| Water and Wastewater Systems | 0.92 | 1.0 | 0 | AWIA §2013 (assessment only) | 58.6 |
| Chemical | 0.95 | 1.0 | 0 | CFATS — lapsed July 28, 2023 | 57.2 |
| Information Technology | 0.31 | 0 | 0 | None | 56.0 |
| Commercial Facilities | 0.67 | 0.5 | 0 | None | 54.9 |
| Transportation Systems | 0.51 | 1.0 | 1.0 | TSA security directives | 52.0 |
| Communications | 0.47 | 0.5 | 0.5 | CALEA / FCC obligations | 51.4 |
| Government Facilities | 0.55 | 0.5 | 0.5 | FISMA (federal only) | 47.8 |
| Energy | 0.65 | 1.0 | 1.0 | NERC CIP (FPA §215) | 45.8 |
| Healthcare and Public Health | 0.60 | 0.5 | 1.0 | HIPAA Security Rule | 33.0 |
| Financial Services | 0.53 | 0 | 1.0 | GLBA Safeguards Rule | 21.1 |
| Defense Industrial Base | 1.00 | 0.5 | 1.0 | DFARS 252.204-7012 | 15.0 |
Source: recovery rates from FBI IC3 2025 Annual Report; coefficients and index by Axis Intelligence Research. Mean 51.8, range 15.0–83.8. Arithmetic verified in exact rational form; Critical Manufacturing resolves to 419/5, Water to 293/5, Defense Industrial Base to exactly 15.
Worked example — Water and Wastewater Systems: 0.45 × (1 − 0.92) = 0.036 · 0.30 × 1.0 = 0.300 · 0.25 × (1 − 0) = 0.250 · sum 0.586 × 100 = 58.6
Marcus Chen on the ranking: the result that will annoy people is Energy at 45.8, well below water and chemical. That is the index working as intended rather than failing. NERC CIP is an enforceable standard with audits and civil penalties behind it, and the electric subsector’s 65% recovery rate reflects an escalation path that functions. Chemical scores 57.2 despite a 95% recovery rate, because the number of incidents reaching that recovery path is small and the regulatory floor underneath the sector expired three years ago. A high recovery rate on a handful of reported incidents is not the same thing as a defended sector.
Cite CIRGI™: Axis Intelligence Research, Critical Infrastructure Resilience Gap Index (CIRGI™), 2026 baseline reading, September 4, 2026, axis-intelligence.com/ot-security-statistics/. Published under CC BY 4.0.
How Much of the CISA KEV Catalog Covers Industrial Control Systems?
Under Binding Operational Directive 22-01, federal civilian agencies must remediate every vulnerability in the Known Exploited Vulnerabilities catalog inside a stated deadline. The catalog has become the default patching queue far beyond federal agencies — utilities, hospitals and manufacturers build remediation cadence around it because it is the shortest defensible list of flaws confirmed exploited in the wild.
Axis Intelligence Research parsed the full catalog as published on September 2, 2026 (catalog version 2026.09.02, 1,694 entries) and classified every entry by whether its product delivers or controls a physical process.
KEV coverage of operational technology
| Category | Entries | Share of catalog | Source |
|---|---|---|---|
| Total KEV entries | 1,694 | 100% | CISA KEV catalog, v2026.09.02 |
| Industrial control and process automation | 6 | 0.35% | Axis classification |
| Physical-security and infrastructure-adjacent devices | 6 | 0.35% | Axis classification |
| Combined OT and physical infrastructure | 12 | 0.71% | Axis classification |
| Entries flagged for known ransomware campaign use | 352 | 20.78% | CISA KEV catalog field |
| OT entries flagged for known ransomware campaign use | 0 | 0% | Axis classification |
Source: CISA Known Exploited Vulnerabilities catalog, retrieved September 3, 2026; classification by Axis Intelligence Research.
The six process-automation entries are a Rockwell controller flaw, a Unitronics Vision PLC and HMI flaw, Delta Electronics DOPSoft, Crestron building control, Schneider Electric U.motion Builder, and a Siemens SIMATIC communications processor. The other six cover Hikvision and Dahua camera firmware, a Nice Linear eMerge access controller, and Sunhillo SureLine, which handles air-traffic surveillance data.
The addition lag
The catalog’s value is speed — it is supposed to tell defenders what is being exploited now. For OT products it has not worked that way.
| Population | Median years, CVE year to KEV addition | Mean years | Entries |
|---|---|---|---|
| OT and physical-infrastructure entries | 3.0 | 3.58 | 12 |
| Process-automation entries only | 3.5 | 3.17 | 6 |
| Entire KEV catalog | 1.0 | 2.49 | 1,694 |
Source: Axis Intelligence Research calculation from CISA KEV catalog, v2026.09.02.
The extremes carry the point. CVE-2017-7921, a Hikvision authentication bypass, entered the catalog on March 5, 2026 — nine years after assignment. The Rockwell entry added the same day covers a 2021 CVE. The Siemens SIMATIC entry covers a 2016 CVE added in 2022.
Marcus Chen’s read: this is not CISA failing at its job. KEV records confirmed in-the-wild exploitation, and exploitation of a PLC is confirmed far less often than exploitation of a mail server, because the PLC sits behind a network the operator may not be logging and inside an incident nobody is required to disclose. The lag is a measurement artifact of OT’s visibility problem, not evidence that controllers are safe. What matters operationally is the conclusion an asset owner should draw: a patching program scoped to KEV covers the IT estate and gives the control network almost nothing. Zero of the twelve OT entries carry the ransomware flag that 20.78% of the catalog carries — so the ransomware-prioritisation shortcut most teams use to triage KEV filters OT out entirely.
CISA does publish a separate ICS advisory stream covering hundreds of vendors and products. Those advisories are informational. KEV is where the deadline lives. The gap between the two is the gap in this section.
How Many Critical Infrastructure Ransomware Attacks Were Reported in 2025?
The FBI IC3 2025 Annual Report logged 1,008,597 complaints and $20.877 billion in reported losses. Ransomware accounted for 3,611 of those complaints and $32,320,105 in adjusted losses.
The report plots critical infrastructure separately, as one chart of ransomware and data-breach complaints across the 16 designated sectors. It publishes the values without machine-readable sector labels. Axis Intelligence Research summed the published series.
| Measure | 2025 value | Method |
|---|---|---|
| Critical infrastructure ransomware complaints | 2,118 | Sum of 14 published values |
| Critical infrastructure data breach complaints | 1,119 | Sum of 16 published values |
| Combined critical infrastructure cyber-threat complaints | 3,237 | Sum of both series |
| Critical infrastructure share of all IC3 ransomware complaints | 58.7% | 2,118 ÷ 3,611 |
| Largest single-sector ransomware value | 460 | Highest value in series |
| Largest single-sector data breach value | 182 | Highest value in series |
Source: FBI IC3 2025 Annual Report; sums and share calculated by Axis Intelligence Research.
IC3 names Critical Manufacturing, Healthcare and Public Health, and Government Facilities as the sectors most affected by the top ten reported variants. Axis Intelligence Research does not attribute the individual chart values to named sectors beyond that, because the published chart does not label them and inferring the mapping would be guesswork wearing a table’s clothing.
Three details from the same report set the context. The top ten variants — Akira, Qilin, INC/Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SAFEPAY and Medusa — accounted for 56.8% of reported ransomware incidents and 49.8% of reported ransomware losses. IC3 identified 63 new variants during the year, averaging 5.25 per month. And the bureau states plainly that its ransomware loss figure excludes lost business, wages, files and equipment, and excludes entities that report to field offices rather than through the portal.
That last caveat is why the $32.3 million ransomware loss line should never be quoted as the cost of ransomware to critical infrastructure. It is the cost of the ransom transactions victims chose to report to one portal. Our ransomware statistics dataset tracks the incident-cost figures separately, and the two series are not interchangeable.
Which Critical Infrastructure Sectors Recover Their Money?
The Financial Fraud Kill Chain is the FBI’s mechanism for freezing fraudulent transfers before funds move beyond reach. It is also the only federal dataset that publishes a per-sector outcome measure for critical infrastructure — which makes it the single most underused number in this field.
In 2025 the IC3 Recovery Asset Team initiated 655 FFKC actions for critical infrastructure entities, covering $261,451,001 in reported losses, and froze $146,561,094 — a 56% success rate. Across all FFKC actions the rate was 58% ($679,013,183 frozen of $1,163,919,846 attempted across 3,900 incidents).
| Sector | FFKC freeze success rate, 2025 |
|---|---|
| Defense Industrial Base | 100% |
| Chemical | 95% |
| Water and Wastewater Systems | 92% |
| Commercial Facilities | 67% |
| Energy | 65% |
| Healthcare and Public Health | 60% |
| Government Facilities | 55% |
| Financial Services | 53% |
| Transportation Systems | 51% |
| Food and Agriculture | 48% |
| Communications | 47% |
| Critical Manufacturing | 36% |
| Emergency Services | 33% |
| Information Technology | 31% |
Source: FBI IC3 2025 Annual Report.
The spread runs from 100% to 31% — a 69-point range across sectors nominally covered by the same federal process. Critical Manufacturing sits at 36% while filing among the highest ransomware complaint volumes, which is the pairing that drives its CIRGI™ score to 83.8.
Marcus Chen: freeze rates are a detection-speed proxy, and they should be read that way. The FFKC works when a victim identifies a fraudulent transfer within roughly 72 hours and escalates. A 31% rate in information technology and a 33% rate in emergency services do not describe unlucky sectors. They describe sectors where the finance function found out late. Compare that to the same question three years ago and the useful shift is that we can now ask it per sector at all — this per-sector breakdown is a recent addition to the IC3 reporting, and it is more actionable than another aggregate loss total.
Did OT Attacks With Physical Consequences Decline in 2025?
Yes, on the only public dataset that counts them, and the decline should be read carefully. The Waterfall Security Solutions / ICS STRIVE 2026 OT Cyber Threat Report — which counts only verified incidents that produced a physical consequence in heavy industry and critical infrastructure — recorded 57 such incidents in 2025, down from 76 in 2024 and 68 in 2023. That is a 25% single-year decline in a series that had risen every year since 2019.
| Year | OT incidents with physical consequences | Change |
|---|---|---|
| 2023 | 68 | — |
| 2024 | 76 | +11.8% |
| 2025 | 57 | −25.0% |
Source: Waterfall Security Solutions / ICS STRIVE 2026 OT Cyber Threat Report. Year-over-year changes calculated by Axis Intelligence Research.
The report’s own authors attribute most of the decline to a temporary contraction in ransomware activity rather than to improved OT defence, and note that public incident reporting has become less detailed, making the causal chain from breach to physical impact harder to establish from the public record. Discrete manufacturing was the most affected vertical; the sectors that recorded physical consequences included oil and gas, water, power, metals and mining, and pharmaceutical manufacturing. The most expensive single physical consequence of 2025 was the Jaguar Land Rover disruption, at roughly $2.5 billion.
Set 57 against 2,118. One dataset counts consequences and finds 57; the other counts complaints and finds 2,118. Neither is wrong. They measure different things, and Axis Intelligence Research does not publish a ratio between them, because a physical-consequence census and a voluntary complaint portal have incompatible denominators. What the pair does establish is the shape of the problem: the overwhelming majority of incidents involving infrastructure operators stop at the IT boundary, and the small number that cross it are the ones that shut plants.
Which Sectors Have No Binding Federal Cybersecurity Requirement?
Seven of the 14 sectors scored in CIRGI™ operate with no enforceable, sector-wide federal cybersecurity requirement: chemical, commercial facilities, critical manufacturing, emergency services, food and agriculture, information technology, and water and wastewater. Four of those seven are fully OT-dependent.
Chemical
The Chemical Facility Anti-Terrorism Standards program lost its statutory authority on July 28, 2023, and CISA states that it cannot enforce compliance with 6 CFR Part 27. The lapse removed CISA’s authority to require chemicals-of-interest reporting, conduct inspections, or compel implementation of site security plans across the 3,200 facilities previously designated high-risk. CISA notes that more than 89 million people in the United States live or work within two miles of one. The program remains unauthorized as of this publication.
Water and wastewater
GAO-24-106744 found that improving cybersecurity across roughly 170,000 U.S. water systems is voluntary, that systems prioritise funding toward clean-water regulatory obligations, and that EPA had not completed a sector-wide risk assessment. Two of GAO’s four recommendations are now closed as implemented: EPA published a Water and Wastewater Systems Sector Risk Management Plan in January 2025. Two remain open. In its own January 2025 authority review, EPA identified a lack of cybersecurity risk assessment requirements for wastewater systems and small drinking water systems, and significant limits on its authority under federal drinking water and clean water law to close those gaps.
The compliance picture that sits behind those findings has not moved: the EPA’s May 2024 enforcement alert reported that over 70% of water systems inspected failed to meet requirements under the Safe Drinking Water Act.
Critical manufacturing
The highest CIRGI™ score in the index belongs to a sector with full ICS dependence, the lowest-but-two fund recovery rate, and no federal cyber requirement at all. Critical manufacturing is designated critical infrastructure by CISA’s sector framework and regulated for cybersecurity by nobody.
Marcus Chen: the honest way to read the mandate column is that regulation follows visible consequence, and OT consequence has historically been invisible. Electric got NERC CIP because the grid’s failure modes are public and instantaneous. A plant that goes dark for eleven days appears in a quarterly filing as a supply chain disruption, and nothing in the disclosure chain forces the word “intrusion” to appear next to it. The mandate gap and the KEV gap have the same root cause, which is why they belong in one index rather than two articles.
Methodology
Collection. All figures trace to documents fetched during production on September 3, 2026. The KEV analysis uses the machine-readable catalog published by CISA at catalog version 2026.09.02, dated September 2, 2026, parsed in full (1,694 records). IC3 figures are read from the FBI IC3 2025 Annual Report PDF. GAO recommendation statuses are read from the live GAO product page on the retrieval date and will change as recommendations close.
KEV classification rubric. An entry is classified “industrial control and process automation” where the affected product is a programmable logic controller, human-machine interface, engineering workstation software, building-automation controller, or industrial communications processor. It is classified “physical-security and infrastructure-adjacent” where the product is a surveillance camera, access controller, or system handling infrastructure telemetry. Network devices, NAS appliances and business analytics software are excluded even where the vendor also sells industrial products — Hitachi Vantara’s Pentaho entries and Zyxel’s router and firewall entries are excluded on that basis. The full classified list ships in the CSV so the boundary can be audited and disagreed with.
Lag calculation. Lag is the KEV addition year minus the CVE assignment year, computed for every entry with a parseable CVE identifier. It is a year-granularity measure, not a day count, because CVE identifiers encode assignment year rather than assignment date.
CIRGI™ construction. R comes from primary data. D and M are Axis classifications applied against a published rubric with the regulatory instrument named for every sector. Weights were set before the scores were computed: recovery outcome carries the largest weight because it is the only observed outcome measure in the set, OT dependence next because it determines whether a breach can become a physical event, and mandate coverage last because it is a structural condition rather than an event. All 14 scores were computed twice, in floating point and in exact rational arithmetic using Python’s fractions.Fraction, and agree to the published precision.
Scope. IC3 data reflects voluntary reporting to one federal portal and undercounts by an unknown margin; the bureau says so in the report. The physical-consequence series counts publicly documented incidents only. CIRGI™ scores 14 sectors rather than all 16 because the FBI publishes recovery data for 14. The index is not comparable to any third-party index, and its D and M coefficients are judgments made explicit rather than measurements. Reporting requirements under the Cyber Incident Reporting for Critical Infrastructure Act are not yet in full effect; when they are, the complaint-based series in this dataset will step up for reporting reasons rather than threat reasons, and Axis Intelligence Research will annotate the break rather than smooth it.
What we would not publish. A ratio between physical-consequence incident counts and IC3 complaint counts. A per-sector attribution of the IC3 ransomware chart values beyond the sector IC3 names. A dollar estimate of OT breach cost derived by multiplying an IT breach average across infrastructure complaint counts — the methodologies do not align, and the resulting number would be quoted for years.
About This Dataset
Dataset: OT Security Statistics 2026 — KEV coverage, sector recovery rates and CIRGI™ components
Creator and publisher: Axis Intelligence Research
Temporal coverage: 2016–2026 (KEV entries); 2023–2025 (incident series)
Spatial coverage: United States, with global OT incident counts noted as global
Format: CSV, UTF-8, one observation per row, full provenance columns
License: CC BY 4.0 — reuse with attribution to Axis Intelligence Research
Cite This Research
APA: Axis Intelligence Research & Chen, M. (2026, September 4). OT security statistics 2026: Sector recovery rates, KEV coverage and the mandate gap. Axis Intelligence. https://axis-intelligence.com/ot-security-statistics/
MLA: Axis Intelligence Research and Marcus Chen. “OT Security Statistics 2026: Sector Recovery Rates, KEV Coverage and the Mandate Gap.” Axis Intelligence, 4 Sept. 2026, axis-intelligence.com/ot-security-statistics/.
Chicago: Axis Intelligence Research and Marcus Chen. “OT Security Statistics 2026: Sector Recovery Rates, KEV Coverage and the Mandate Gap.” Axis Intelligence Research, September 4, 2026. https://axis-intelligence.com/ot-security-statistics/.
Frequently Asked Questions
Does patching to the CISA KEV catalog protect an OT network?
Not meaningfully. Axis Intelligence Research finds that 12 of 1,694 KEV entries (0.71%) affect industrial control or physical-infrastructure products, and 6 (0.35%) affect controllers and process-automation software. A remediation program scoped to KEV addresses the IT estate. Teams that further triage KEV by the known-ransomware-campaign flag — a common shortcut, since that flag covers 20.78% of the catalog — will filter out every OT entry, because none of the 12 carries it.
Why do OT vulnerabilities take so long to reach the KEV catalog?
KEV requires confirmed exploitation in the wild, and OT exploitation is confirmed far less often than IT exploitation because control networks are less instrumented and OT incidents face weaker disclosure pressure. The measured result is a 3-year median lag from CVE assignment to KEV addition for OT entries against 1 year for the catalog overall. The lag reflects detection and disclosure, not controller safety.
Which critical infrastructure sectors have no binding federal cybersecurity requirement?
Seven of the 14 sectors with published 2025 recovery data: chemical, commercial facilities, critical manufacturing, emergency services, food and agriculture, information technology, and water and wastewater. Chemical is the notable case — CFATS lapsed on July 28, 2023 and CISA states it cannot enforce 6 CFR Part 27, leaving 3,200 previously designated high-risk facilities outside enforcement.
How much money does critical infrastructure actually recover after a cyber incident?
56% of reported losses in FFKC-eligible incidents. The FBI froze $146,561,094 of $261,451,001 across 655 critical infrastructure Financial Fraud Kill Chain actions in 2025. Per-sector outcomes range from 100% (defense industrial base) to 31% (information technology), and the rate functions largely as a detection-speed proxy — the freeze works when the victim escalates within roughly 72 hours.
Is water really the most exposed critical infrastructure sector?
Water scores 58.6 on CIRGI™ — fourth, not first. It carries maximum OT dependence and no binding federal requirement, but its 92% fund recovery rate is the third-highest of any sector, which narrows its gap. Critical manufacturing scores 83.8 on the same inputs because it pairs identical OT dependence and the same regulatory vacuum with a 36% recovery rate.
What counts as an OT attack with physical consequences?
An incident verified to have caused a physical effect on industrial operations — a halted process, a precautionary shutdown, damaged equipment, or a disrupted physical service. The Waterfall Security Solutions / ICS STRIVE series counts 57 such incidents worldwide in 2025, against 76 in 2024. That census excludes intrusions confined to IT networks, which is why its counts sit two orders of magnitude below complaint-based series.
Did OT attacks decline in 2025, and will the decline hold?
Verified physical-consequence incidents fell 25%, from 76 to 57. The report’s authors attribute the drop primarily to a temporary contraction in ransomware activity rather than to stronger OT defence, and flag that thinner public incident reporting is making causation harder to establish. Treat the 2025 figure as a reporting-influenced trough rather than an established trend.
What should an OT asset owner track instead of KEV?
Three things the data in this dataset supports. CISA’s ICS advisory stream, which covers hundreds of vendors that KEV never reaches. The IT/OT boundary, since most incidents that reached physical consequence in 2025 crossed it rather than starting inside the control network. And time-to-escalation into federal channels, because the sector recovery spread from 100% to 31% tracks how fast finance and security functions notice, not how well the perimeter held.
Related Axis Intelligence Research datasets: critical infrastructure cyber attack statistics by sector · ransomware statistics · credential attack statistics · KEV Tracker · zero-day tracker · cybercrime statistics · Open Source Vulnerability Statistics