What owners say, what assessments find: the SANS 2025 OT survey read for a GMP site

Every January, the OT lead of a packaging site fills in the group’s cybersecurity questionnaire. Incident response plan for OT: yes. Multi-factor authentication on remote access: yes. Asset inventory maintained: yes. Forty questions, forty green cells, sent on a Friday afternoon.

In March an auditor from the quality department, reviewing the agreement with the blister machine builder, asks a simple question: how exactly does the supplier connect when the machine needs support? Someone opens the cabinet. Inside, behind the cable duct, sits a cellular router that appears on no inventory and never goes near the VPN described in the questionnaire. Nobody lied in January. The VPN does have multi-factor authentication. It just isn’t the only way in.

The SANS State of ICS/OT Security survey is that questionnaire at the scale of an industry. What it says matters less than two other things: how far a self-assessment can be trusted, and what a regulated plant should do with it on Monday morning.

What the survey is, and how to read it

SANS, the US training and research organisation, has run its ICS/OT survey every year since 2017. The 2025 edition draws on answers from 330 industry professionals and was presented in a webcast on 19 November 2025. The full report sits behind a registration form, so every survey figure below comes from SANS’s own public pages and blog series on it.

Dragos, which says it sponsors the research, published its own reading on 24 November 2025. Where a number appears only in Dragos’s summary, I say so. Two cautions before the numbers. The respondents are security professionals who chose to answer, which tilts the sample towards organisations that already take the subject seriously. And every answer is self-reported: it describes what people believe is in place.

A GMP reader knows that distinction from supplier qualification. A questionnaire tells you what the supplier believes about itself; an audit tells you what is there. EU GMP Annex 11 §3.2 puts it in one line: “The need for an audit should be based on a risk assessment.” Here the audit exists too. Dragos publishes what its teams find in incident response and assessments, discussed in what OT assessments keep finding.

1. One organisation in five had an incident, and half came from outside

According to SANS, 21.5 per cent of organisations experienced an OT cybersecurity incident in 2025, and about 40 per cent of those incidents disrupted operations. Half of the incidents began with unauthorised external access, and 38 per cent involved ransomware, which often comes in through the same remote paths that bridge IT and OT.

On this point the questionnaire and the audit agree. Dragos reports that 73 per cent of all the incident response cases it has handled involved compromised VPN or jump-host credentials. Owners say the door is remote access, and the people called in after the fact say the same.

One in five may look modest beside the thousands of industrial ransomware victims counted elsewhere, a gap discussed in the famous attacks are not the number. The two figures measure different things. A survey counts the incidents respondents know about, and a site without monitoring knows about fewer.

2. Detection got faster; recovery did not

The encouraging figure first. SANS reports that nearly half of incidents are now detected within 24 hours, and that more than 65 per cent of respondents take containment action within the following day. Then the long tail: 22 per cent needed two to seven days to remediate fully, 19 per cent more than a month, and 3 per cent more than a year.

SANS explains it the way any automation engineer would. Restoring a PLC is not restoring a workstation, and reloading an image does not confirm the control logic, the alarm limits or the interlocks. SANS also notes that cybersecurity is still poorly built into business continuity and disaster recovery planning across much of the industry, so recovery decisions get improvised under pressure, usually by whoever is on shift.

A pharmaceutical plant carries a heavier version of that tail, because the line does not restart when the controller boots. It restarts when someone can show that the restored system is the validated one and that the batches made around the event can be dispositioned. GMP also hands the site a tool most other industries lack. Annex 11 §7.2 requires that “the ability to restore the data should be checked during validation and monitored periodically”, and §16 asks that business continuity arrangements be “adequately documented and tested”. Few sites have applied those two sentences to PLC programs and HMI projects, timed, on spare hardware. The ones that have already hold the evidence SANS says most respondents miss.

3. Visibility stops where the product is made

SANS reports that only about one organisation in eight has full visibility across the ICS Cyber Kill Chain, from the first IT foothold down to the controllers, and that more than 40 per cent describe their visibility as partial and fragmented. Monitoring is strongest at Purdue Level 3, the site operations layer, and drops sharply at Level 2 (supervisory control, HMIs) and Level 1 (controllers). Dragos’s summary puts full visibility at Level 2 at 10 per cent.

The field data sits close to the self-portrait. Dragos found adequate OT network monitoring in 46 per cent of its assessments, and in 56 per cent of its penetration tests its testers used ordinary administration tools without triggering an alert. Somewhat under half have something; very few see down to the controller.

For a GMP site, Levels 2 and 1 are where the critical process parameters live: the granulator’s spray rate, the sterilisation hold time, the reject logic on the packaging line. SANS suggests watching at Level 1 for unexpected project downloads, mode changes and logic differences outside maintenance windows. A regulated plant already has the reference to compare against, because change control dates every approved logic change and the validated program version is on file. A download at two in the morning with no change record behind it needs no machine learning to spot, only someone who compares. Annex 11 §11 lists security among the topics of the periodic evaluation, which is the natural place to do it.

4. Remote access: identity is solved, the session is not

Remote access is where the survey is most specific, and least flattering. SANS reports that 31 per cent of organisations keep no formal inventory of their remote access points. Among the controls that govern what happens during a session, full implementation is rare: session recording and replay 13 per cent, ICS protocol or device awareness 11 per cent, real-time session approval 8 per cent, and brokering through a mandatory jump host 23 per cent. Meanwhile 83 per cent use some cloud-connected capability, and only 13 per cent have fully brought cloud activity into their monitoring.

That is the cabinet router of the opening scene, in numbers. VPN and multi-factor authentication answer who connects. They say nothing about which machines the person may reach, what they may change, or who on site agreed to it.

GMP already asks those questions in its own words. Annex 11 §3.1 requires formal agreements with third parties who maintain a system, and names maintenance “via remote access” as an example. Annex 11 §12.1 asks for controls that restrict access “to authorised persons”, and 21 CFR 211.68(b) requires that changes to master production and control records be made “only by authorized personnel”. Read with an engineer’s eye, a session recording is the audit trail of a remote intervention, and a real-time approval is the work permit. Neither needs inventing. Both need attaching to the remote path.

5. Regulation did not cut incidents; it cut their cost

The regulation finding is easy to misread. SANS reports that organisations under mandatory controls see incidents at roughly the same rate as their peers, but about 50 per cent fewer financial losses and safety impacts when incidents happen. SANS is careful about why. The mandate itself protects nobody. What helps is that some organisations turn required artefacts into tools they actually use: architecture diagrams kept current because operators rely on them during troubleshooting, access models consulted when a vendor session behaves strangely at two in the morning.

A pharmaceutical site is one of the most regulated places in industry, but GMP is not a cybersecurity mandate and it would be wrong to count it as one. What it does is force the same artefacts: system descriptions, access lists, audit trails, change records, restore tests. Their value, if SANS is right, depends on whether anyone opens them during an incident. A system description filed at go-live is audit furniture. The same document, compared once a year with the firewall rules and pulled out during an exercise, is what shortens the next outage.

What the survey cannot tell you

Only 14 per cent of respondents felt fully prepared for emerging threats. That is a feeling, honestly reported, not a measurement. The survey cannot say whether your site is better or worse than its average; no benchmark of 330 self-selected practitioners can. Nor should a sponsor’s reading be taken as neutral, and Dragos’s summary leads, reasonably from its point of view, towards OT-specific monitoring platforms. The figures that hold up best are the ones where self-report and field work point the same way: remote access as the entry, visibility that fades towards the controller, recovery that takes far longer than detection.

Where to start

Six steps. None needs a new tool or a production stop.

1. Add an evidence column to the group questionnaire. For every “yes”, the record that proves it, with its date. A “yes” without a record becomes an action.
2. Inventory every remote access path, cabinet modems, OEM portals and cloud dashboards included, and match each one to a supplier agreement that says how sessions are opened, approved and logged.
3. On one critical line, compare the program in each controller with the validated version, and record the result in the periodic evaluation.
4. Time a restore of one PLC program and one HMI project on spare hardware, right through to the checks that would let QA release product.
5. Run an exercise that ends at batch disposition rather than at containment, with engineering and QA in the room. SANS reports that only a quarter of facilities exercise their OT plan quarterly, the frequency recommended by the SANS five critical controls.
6. Put one monitoring point at Level 2 on the line whose deviations you can least afford to leave unexplained.

Five common mistakes

• Reading a survey percentage as your benchmark. It describes 330 respondents, not your site. Your evidence column does that.
• Treating VPN plus MFA as remote access security. It proves identity. The session, the reachable machines and the approval are separate controls.
• Exercises that stop at containment. The month-long tail is in the restore and the return to a validated state, which most tabletops never reach.
• Compliance artefacts kept for the auditor. A diagram nobody uses in an incident gives none of the reduced impact SANS measured.
• Monitoring that stops at Level 3. It sees the attacker arrive and loses them where the product is made.

The questionnaire was not wrong in January. It answered the question it was asked; the audit asked for the evidence.

References

• Dragos, Phil Tonkin, SANS State of OT Security 2025: What the Data Tells Us, blog, 24 November 2025: dragos.com (the web item this article starts from).
• SANS Institute, State of ICS/OT Security 2025, report page: sans.org.
• SANS Institute, Why VPN and MFA Is Not Enough for OT, 5 January 2026: sans.org.
• Dragos, Launched: 9th Annual Dragos OT Cybersecurity Year in Review, 17 February 2026: dragos.com.
• European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (2011): health.ec.europa.eu.