Palo Alto survey: most critical infrastructure operators can't see all their OT assets

Palo Alto Networks surveyed more than 1,600 security leaders at critical infrastructure organizations across 11 countries and five sectors for its 2026 State of Critical Infrastructure Cybersecurity Report. The picture is of defenders already stretched by visibility gaps, aging equipment and fragmented tooling, now facing attackers who use frontier AI models to find and exploit weaknesses faster.

Visibility is the core problem: 68% of organizations lack complete, real-time visibility of all assets connected to their operational technology (OT) networks, and more than half of that gap is attributed to legacy OT systems. 42% name legacy OT equipment that can't be patched as their single biggest cybersecurity risk. Organizations run seven separate security tools on average, and most say the sprawl adds complexity and cost, while 74% have not fully integrated IT and OT security operations.

The pressure is already high. 60% suffered a significant security breach in the past year, and half reported physical safety concerns as a result. 95% are worried about attacks powered by frontier AI. According to the report, 29% of CVEs in 2026 were exploited within 24 hours, while the industry needs 55 days on average to deploy a patch.

Defenses lag behind. Only 53% enforce policy and access controls across connected assets and users, and only 40% have virtual patching or other immediate compensating controls in place. Yet 91% expect AI-driven security to help defend against AI-accelerated exploits, and 92% call alert prioritization important or critical. Palo Alto, which sells OT security products, argues the measure that matters is no longer time-to-patch but time-to-protection.