Skip to main content

2025 ICS/OT Cybersecurity Budget: Spending Trends, Challenges, and the Future

Industrial Control Systems (ICS) and Operational Technology (OT) environments power critical infrastructure around the globe, from energy grids to transportation networks. This white paper explores the findings of the 2025 SANS Survey on ICS/OT Security Budgets.

Download file

SANS_2025_ICS_OT_Cybersecurity_Budget_Spending_Trends_Challenges_Future (PDF, 3.84MB)

3 Mar 2025
ByDean Parsons
Share
All papers are copyrighted

No re-posting of papers is permitted

Related Content

Sanitized in the Source: Removing Embedded Objects from PLC Projects with CDR

Research Paper

This research seeks to outline a methodology to sanitize supported PLC project files for security while also confirming their operational reliability.

  • 16 Apr 2026

ICS Asset Inventory: Passive, or Active? Siemens S7-1200 PLCs

Research Paper

This research builds on previous research to determine what information can and cannot be gleaned solely from passive traffic analysis, specifically for a Siemens S7-1200 PLC.

  • 12 Mar 2026

Protecting OT’s Inherent Front-End Vulnerabilities: Legacy SQL Dependencies in Building Automation Systems Through the Lens of the SANS ICS Five Critical Controls

Research Paper

This research presents a practical method for building a Software Bill of Materials (SBOM) for BAS front ends, augmenting it with Shodan exposure analysis, classifying it in a risk heat map, and mitigating using the SANS ICS Five Controls, with an emphasis on Risk-Based Vulnerability Management and Defensible Architecture.

  • 9 Feb 2026

Defensible IEC 61850 Substation Network Security Monitoring with Zeek

Research Paper

This study introduces a Zeek-based monitoring framework that leverages transport layer and layer two invariants, such as MAC and VLAN integrity, multicast group membership, traffic rates, and MMS connection behavior, to detect the most consequential precursors to substation misoperation.

  • 26 Jan 2026

Code Modularity as a Heuristic for Malware Design

Research Paper

Malware targeting industrial control systems (ICS) and critical infrastructure often exhibits a modular architecture, using a central loader to execute interchangeable payload modules.

  • 7 Nov 2025

Structural Vulnerability: Autodesk Revit Server WAN Exposure Versus Cost of Autodesk Construction Cloud

Research Paper

Autodesk Revit Server, a critical collaboration tool in the architecture, engineering, and construction (AEC) industry, was designed to operate within trusted networks.

  • 7 Nov 2025

Privacy Protections: Are Stronger Laws Changing What We Reveal?

Research Paper

As U.S. states enact privacy laws aimed at giving consumers more control over their personal data, little is known about whether privacy legislation influences individuals’ willingness to disclose their identity on public platforms.

  • 26 Sep 2025

Forensic Investigation of Bluetooth-Based Credit Card Skimmers

Research Paper

Hidden Bluetooth Low Energy (BLE) credit skimmers are a growing threat to credit card fraud. Criminals can set up practical and inexpensive systems built on top of modules, such as the HM-19, to collect and transmit stolen data covertly across wireless channels.

  • 3 Sep 2025

OT Network Visibility and Detective Controls in a NERC CIP World

Research Paper

As cyber threats grow and regulations evolve, critical infrastructure must balance compliance and innovation.

  • 20 Aug 2025
  • Tim Conway

NERC CIP-015: Monitoring Deep Inside Critical Networks to Keep Adversaries Outside

Research Paper

The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Standards (hereinafter referred to as the Standards) require preventive controls to establish Electronic Security Perimeters (ESPs) containing Bulk Electric System (BES) Cyber Systems and to control communications in and out of those ESPs.

  • 14 Aug 2025
  • Tim Conway, Robert M. Lee

SANS 2025 Security Awareness Report

Research Paper

Now in its 10th year, the SANS Security Awareness Report remains the definitive, practitioner-built resource for understanding and managing the human side of cybersecurity.

  • 12 Aug 2025
  • Lance Spitzner

Prioritized Industrial Cyber Defense in Oil and Gas

Research Paper

SANS Institute developed a white paper exclusively for ONE-ISAC members to address the urgent cybersecurity challenges facing the oil and gas sector.

  • 13 Jun 2025
  • Dean Parsons

Be a DLP Hero: How to Quickly Deliver Value from Your DLP Program and Set It Up for Future Success

Research Paper

Download this paper and learn how to launch or strengthen your data loss prevention (DLP) program.

  • 3 Jun 2025
  • Kevin Garvey

Resiliency and Business Continuity in the Cloud Era

Research Paper

In this white paper, Dave Shackleford unpacks today’s evolving cloud threat landscape.

  • 21 May 2025
  • Dave Shackleford

SANS 2025 CTI Survey Webcast & Forum: Navigating Uncertainty in Today’s Threat Landscape

Research Paper

This paper explores results from the SANS 2025 CTI Survey, with insights into how cybersecurity...

  • 20 May 2025
  • Rebekah Brown, Andreas Sfakianakis

Collaborative Mobile App Security Development and Analysis

Research Paper

In this tactical, insight-rich review, Jeroen Beckers shares how to overcome mobile app security challenges and modernize your testing with Corellium’s virtual device platform—built for real-world conditions and faster results.

  • 19 May 2025
  • Jeroen Beckers

A Pebble In the Ocean: Maximizing Log Fidelity In Container Environments

Research Paper

Log fidelity is crucial for Incident Response Teams to investigate and contain cyber incidents but can be difficult to optimize in containerized environments.

  • 17 Apr 2025

Webs of Deception: Using the SANS ICS Kill Chain to Flip the Advantage to the Defender

Research Paper

Using the SANS ICS Cyber Kill Chain, the research implemented a representative ICS network to evaluate the effectiveness of security controls for use by small ICS defenders.

  • 14 Apr 2025

ASPM: Understanding the New Application Security Landscape

Research Paper

Malicious actors continue to prey on the challenges of rapid software development cycles and cloud computing adoption. This paper examines where an application security posture management (ASPM) solution comes in.

  • 18 Mar 2025
  • Chris Edmundson, SANS Institute

ARMO’s Behavioral Cloud Application Detection and Response (CADR) Platform

Research Paper

This paper explores how ARMO Platform is attempting to solve the challenge with the industry’s first behavioral cloud application detection and response (CADR) product.

  • 18 Mar 2025
  • Moses Frost