OT Visibility Isn't OT Security Capability

Analyst Brief

Executive Summary

Industrial organizations have spent years and budget learning to see their OT environments, and the investment worked. Asset inventory and network visibility were the top OT security spend of 2025, self-reported full OT visibility nearly tripled in a year, and organizations with comprehensive visibility contain OT ransomware far faster than the industry average.

What visibility cannot do by itself is interpret. Nearly half of industrial incidents are now detected within 24 hours, yet 19% still take more than a month to remediate. The delay sits in the space between an alert firing and someone deciding what it means for production, safety and compliance.

That space is staffed thinly. Only 9% of ICS/OT security professionals work on OT security full time, and most split their attention with IT duties. Regulators have already moved past collection: CIP-015 requires entities to evaluate anomalous activity and determine further action, and CISA's CI Fortify initiative asks operators to keep running while isolated. The next capability to build is operational, not technological.

An OT alert fires at 2 a.m. Someone in the security operations center sees it, and the sensor that produced it represents real work: budget, engineering hours, months of coordination with operations to deploy it without disrupting production.

Now what happens?

For a growing number of industrial organizations, that second question is harder to answer than the first one ever was. Money has gone into seeing OT environments, and it has gone there deliberately. Asset inventory and network visibility tools were the top OT security investment of 2025, cited by 50% of respondents to the SANS 2025 State of ICS/OT Security survey, and they remain the top planned priority for 2026 and 2027 at 54%. Fortinet's 2026 State of Operational Technology and Cybersecurity report found that organizations claiming full visibility into their OT systems nearly tripled in a year, from 5% to 14%.

That investment pays off in the way that matters most. In its 2026 OT/ICS Cybersecurity Report and Year in Review, Dragos found that organizations with comprehensive OT visibility detected and contained OT ransomware incidents in an average of five days, against an industry-wide average ransomware dwell time of 42 days.

So the sensors work. The open question is what an organization can do in the hours after one of them speaks up. Call that operating capability: the ability to investigate an OT alert, judge what it means for production and safety, and reach a decision someone is accountable for.

What a sensor answers, and what it does not

Question	Answered by visibility	Answered by operating capability
What is on the network?	Yes	Assumed
Did something happen?	Yes	Assumed
What does it mean for production?	No	Yes
Is the response riskier than the threat?	No	Yes
Who makes the call, and when?	No	Yes

Detection Got Faster. Everything After It Did Not.

The shape of industrial incident data tells the story. Detection has improved markedly, and everything downstream of it has not.

Nearly half of incidents were detected within 24 hours, according to the SANS 2025 State of ICS/OT Security survey. That is real progress, and it reflects where the industry has focused. The same survey found that 22% of incidents took two to seven days to recover from, 19% took more than a month and 3% dragged on past a year.

Fast at the front. Slow everywhere after.

That gap is not a detection failure. It opens when an alert reaches people who can see it but cannot quickly determine what it means, who owns the decision, whether the affected asset sits in a maintenance window, and what acting might cost production or safety.

The plans meant to answer those questions are thinner than anyone would like. SANS found that 57% of respondents have a dedicated ICS/OT incident response plan, which leaves roughly four in 10 without one, and that 25% test their plan quarterly. Only 14% said they felt fully prepared for emerging threats.

The People Who Interpret OT Alerts Are Doing It Part Time

Visibility can be bought and installed. The capability to act on what it shows has to be staffed, and that is where most programs quietly run out of room.

Look at who does this work. The SANS 2025 ICS/OT cybersecurity budget survey, written by Dean Parsons, found that only 9% of ICS/OT security professionals spend all their time on ICS/OT security. On average, respondents give it 52% of their time, and half also carry IT cybersecurity duties. The people who understand an industrial environment well enough to interpret an OT alert are, in most organizations, doing that job alongside another one.

The wider talent picture compounds the problem. The 2026 Cybersecurity Workforce Research Report from SANS and GIAC, drawn from 947 responses worldwide, found that 81% of organizations report gaps in the cybersecurity skills they need, and that 60% consider those gaps a bigger problem than headcount. The consequences respondents named are the ones that bite here: 47% reported slower incident response and 42% reported reduced monitoring. That survey covers every industry rather than OT alone, which if anything understates the squeeze in environments where the pool of qualified defenders is smallest.

Ownership is shifting at the same time. Fortinet's 2026 report found that 60% of organizations place ultimate responsibility for OT cybersecurity with the CISO or CIO, and that for the fifth consecutive year more respondents intend to move OT security under the CISO within 12 months, now 81%. That consolidation makes sense on an org chart. It also means OT alerts increasingly arrive in an enterprise SOC queue, in front of analysts trained on enterprise systems, where the next step is often a phone call to whoever knows the plant.

What Does CIP-015 Require Beyond Monitoring?

Regulators have already moved past the question of whether operators can see their networks, and the electric sector offers the clearest example.

NERC Reliability Standard CIP-015-1, which the Federal Energy Regulatory Commission approved in Order No. 907 in June 2025, is usually described as an internal network security monitoring rule. That undersells what it asks for. Using a risk-based rationale, applicable entities must implement network data feeds covering the networks protected by their electronic security perimeters at high impact systems and medium impact systems with external routable connectivity. They must detect anomalous network activity in those feeds. Then they must evaluate that activity to determine further action, retain the data tied to it until that action is complete, and protect that data from unauthorized deletion or modification.

Collection and detection are the entry fee. Evaluation is the requirement.

The trajectory since then reinforces the point. FERC directed NERC to extend the requirements to access control systems sitting outside the electronic security perimeter, NERC delivered that revision in 2026, and FERC approved the expanded standard, CIP-015-2, in August 2026. Compliance obligations phase in from late 2028.

Federal guidance is pulling in the same direction. CISA's CI Fortify initiative, announced in May 2026, asks critical infrastructure operators to assume that third-party connections including telecommunications, internet, vendors and upstream dependencies will be unreliable in a conflict, and to plan for safe operations for weeks to months while isolated. Acting CISA Director Nick Andersen framed the goal this way: operators "must be able to isolate vital systems from harm, continue operating in that isolated state, and quickly recover any systems that an adversary may successfully compromise."

None of that is a visibility ask. All of it assumes you can already see, and asks what you can do next.

Two Questions Worth Asking Before the Next Alert

There is a useful exercise here, and it takes about 10 minutes in a room with security and operations leads.

Pick a realistic OT event. A vendor account authenticating to a jump host outside a maintenance window works well. Then ask two questions.

First, who investigates it at 2 a.m., and what can that person determine without calling anyone? Second, how long does it take to get from "this alert is real" to "here is the decision, and here is who made it"? Write the answer down in hours, not in intentions.

If the honest answer to the first question is a single name, and the honest answer to the second is measured in days, the gap is not in what the organization can see. Visibility answered its question. It was the right investment, it made detection faster, and the evidence says it shortens incidents substantially. What it cannot do on its own is investigate, weigh operational consequence, balance the risk of the response against the risk of the threat, and produce a decision somebody owns.

That work is an operating capability. For most industrial organizations, it is the next thing to build.

CyberFusion Center Perspective

What a CyberFusion Center Asks That a Tool Does Not

A monitoring platform answers one question well: did something happen that looks unusual? A CyberFusion Center starts a step later, with the question an operator actually needs answered. What does this activity mean for the process running right now, and what does acting on it cost?

Those questions cannot be resolved by the alert alone. They require asset context, maintenance status, process knowledge, a view of who holds decision authority, and the regulatory implications of both acting and waiting. Assembling that during an incident is what turns a fast detection into a slow recovery. Assembling it beforehand, as a standing capability rather than a scramble, is the difference the data in this article keeps pointing at.

How Mithryl Systems Approaches It

Mithryl Systems OT Managed Detection & Response is built to sit between the enterprise SOC and OT operations rather than replace either. It extends an existing security operations function with OT-native analysts, Augmented Intelligence that accelerates correlation and evidence assembly, and investigation workflows that carry operational context from the start.

The service works with the telemetry an organization already owns, including OT monitoring platforms, SIEM, identity systems and remote access. Analysts investigate and interpret; operations keeps authority over any action that could affect production or safety. Compliance evidence is captured as part of the investigation rather than reconstructed later, and every case feeds detection engineering and runbook improvement.

Frequently Asked Questions

What is the difference between OT visibility and OT security capability?

Visibility tells you what exists on the network and that something happened. Operating capability is what comes next: investigating the event, judging its effect on production and safety, and producing a decision someone owns. Most industrial investment to date has gone to the first.

Why do OT incidents take so long to resolve if detection is fast?

Detection is a technology problem, and tools have solved much of it. Resolution depends on operational context, decision authority and people who understand the process. SANS found nearly half of incidents detected within 24 hours, while 19% took more than a month to remediate.

How many organizations actually have full OT visibility?

Fortinet's 2026 report found 14% of organizations claim full visibility into their OT systems, up from 5% a year earlier. Another 23% see roughly half their environment. The figures are self-reported, so they describe claimed coverage rather than measured coverage.

Does NERC CIP-015 require more than network monitoring?

Yes. Applicable entities must collect network data using a risk-based rationale, detect anomalous activity, and then evaluate that activity to determine further action, retaining and protecting the associated data. FERC approved the expanded CIP-015-2 in August 2026, with compliance phasing in from late 2028.

Who should own OT cybersecurity, the CISO or the OT team?

Ownership is consolidating under enterprise security. Fortinet found 60% of organizations place ultimate responsibility with the CISO or CIO, and 81% intend to move OT security under the CISO within 12 months. That makes operational context inside the SOC the practical constraint, not the reporting line.

What is the first step toward closing the gap?

Pick a realistic OT event, then answer two questions honestly. Who investigates it at 2 a.m. and what can that person determine alone? How long does it take to reach a documented decision? If the first answer is one name and the second is measured in days, the gap is operational.

Is a dedicated OT SOC the answer?

Not necessarily. A separate OT SOC adds a team, a workflow and another boundary between security and operations. Extending the existing SOC with OT expertise and operational context addresses the same gap without duplicating the function.

Related Reading

• The CyberFusion Center as OT Visibility Architecture
• You Own the Detection Tools. Do You Own the Capability?
• OT Incident Response as Operational Discipline
• Same Alert, Different Impact

From visibility to decisions

Can your SOC turn an OT alert into an operational decision?

Walk through a real OT event with our team and see where your organization's time actually goes between detection and decision.

• Explore OT MDR
• Schedule an executive briefing