91% of Critical Infrastructure Hit by Cyberattacks

A Forrester study commissioned by Schneider Electric surveyed 250 global operational technology (OT) security decision-makers and found vulnerabilities in critical infrastructure cybersecurity. Despite existing security measures, 91% of organizations experienced OT breaches or failures in the past 18 months, resulting in service interruptions (51%), revenue loss (49%) and reputational damage (53%).

The research reveals security gaps: 70% of decision-makers doubt their protective capabilities, 60% question their attack detection abilities and 51% still rely on inadequate traditional IT security practices for OT environments. Only 40% maintain 24/7 OT threat monitoring.

“These figures show that while cybersecurity risk is well recognized, the pace of action to mitigate it must accelerate,” said Jay Abdallah, president, Cybersecurity Solutions, Schneider Electric.  “Securing the effective integration between IT and OT environments is critical - not only to strengthen an organization’s security posture, but also to drive industrial competitiveness by enabling smarter, more efficient operations.”

Organizations adopting secure by operations principles (embedding cybersecurity into operational environments with continuous post-deployment monitoring ) report 75% agreement on their effectiveness against future attacks, 53% faster recovery times and 51% reduced capital expenditure.

In a 2024 blog post, Brian Wrozek, an analyst for Forrester, offered this recommendation: “It is said that practice makes perfect. Don’t strive for perfection, but practice your incident response procedures enough to become proficient. A major cyber attack against critical infrastructure operations can have catastrophic physical consequences to the environment, human safety, and availability of public services. Responding to a cyber incident in OT environments requires a different approach. An effective response involves seamless coordination between cyber, physical, and operations teams that can only become a reality if you practice incident response regularly. Conduct an annual exercise at a minimum, but a quarterly cadence is ideal.”