Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—but the figure describes a rare response in a 2021 survey, not the typical cost of an industrial cyber incident. Just 1% of respondents whose organizations confirmed an ICS/OT cybersecurity incident said its total cost exceeded $100 million. Ponemon Institute’s modeled average was about $2.99 million per incident, and respondents reported an average of 316 days to detect, investigate, and remediate one.
What the 2021 survey says about ICS/OT incident costs
Ponemon Institute’s 2021 report, The Risks Created by the Cultural Divide Between IT & OT Teams, estimated an average total cost of $2,989,550 per ICS/OT cybersecurity incident. That estimate combined $963,168 in detection, investigation, and remediation labor with $2,026,382 in fixed costs, such as equipment replacement, downtime, legal costs, and regulatory fines. The labor calculation assumed a six-person team. These are report calculations, not audited costs or a guarantee of what a particular incident will cost.
SecurityWeek’s November 10, 2021 account of the survey reported that 1% of respondents at organizations confirming an incident said the total cost exceeded $100 million. Another 2% in that group reported costs from $10 million to $100 million. The denominator matters: these percentages are not shares of all U.S. companies, nor are they estimates of the chance that any one organization will suffer such a loss.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The report surveyed 603 U.S. IT, IT security, and OT security practitioners at C-level, manager, and director levels who were familiar with their organizations’ cybersecurity initiatives and ICS/OT practices. Ponemon Institute’s definition of OT covers programmable systems or devices that interact with the physical environment, or manage devices that do. Examples include industrial control systems, building management, safety control systems, and physical access controls. ICS includes SCADA, distributed control systems, and components such as programmable logic controllers.
#1 Best Overall
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
How long did incidents take to resolve?
In the 2021 study, the average reported time across detection, investigation, and remediation was 316 days. SecurityWeek broke that total into 170 days to detect, 66 days to investigate, and 80 days to remediate. The figures describe survey responses from that period; they should not be read as current benchmarks or a timeline every organization should expect.
How common were incidents and ransomware in the survey?
In Ponemon Institute’s 2021 survey, 63% of respondents said their organization had experienced an ICS/OT cybersecurity incident in the prior two years. Separately, 29% said their organization had been hit by ransomware during the prior two years. SecurityWeek’s account said that more than half of the ransomware-affected group reported paying an average ransom above $500,000, and some reported payments above $2 million. These are respondent-reported historical findings, not tested outcomes or population-wide U.S. rates.
What problems did respondents associate with incidents?
SecurityWeek described commonly reported causes as negligent insiders, maintenance-related issues, and IT security incidents spilling into OT environments where network segmentation was poor. The survey also points to organizational and technical friction rather than a single universal cause. Ponemon Institute’s executive summary states: “A primary challenge to improving the security of organizations’ Industrial Control System (ICS) and Operational Technology (OT) environments, as revealed in this research, is the need to overcome the cultural and technical differences between OT and IT teams.”
Recommended Free Tools
In the 2021 report, half of respondents identified cultural differences between IT and OT as a challenge, 44% cited technical differences such as patch-management realities and industrial automation vendor requirements, and 43% cited unclear ownership of industrial cyber risk. The report also describes concerns about management understanding and resourcing, gaps in cross-functional expertise, and unclear reporting or accountability. These findings identify reported challenges; they do not prove that one organizational structure or control prevents incidents.
What security capabilities did organizations report?
Respondents described a mix of practices in the 2021 survey. The percentages below are shares of respondents reporting each capability, not measurements of control effectiveness.
| Reported capability | Respondents reporting it |
|---|---|
| Vulnerability assessments where appropriate | 57% |
| Management of USB devices and maintenance laptops in OT | 55% |
| OT-specific network detection | 52% |
| Physical locking or isolation of sensitive equipment where possible | 52% |
The report also discusses segmentation, asset and patch management, access management, and isolating safety systems. It did not compare products or establish that a particular tool or safeguard was more effective than another.
Rank #4
What the findings mean for industrial organizations
The report’s central organizational theme is coordination: only 35% of respondents said IT and OT teams had a unified security strategy, while 39% said the teams worked cohesively toward mature security. Just 21% described their ICS/OT program as fully mature. In addition, 45% said their organization was effective at maintaining an inventory of devices attached to OT networks, and 46% said it was effective at gathering ICS/OT threat intelligence.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Those responses suggest useful areas for an organization to examine—governance and ownership, communication between IT and OT, visibility into connected assets, threat intelligence, and security practices compatible with industrial operations. They are not a control ranking or proof that any one improvement will prevent an incident. The report was sponsored by Dragos, and its findings should be understood as a sponsor-supported 2021 survey rather than a current estimate of risk.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
