CADChain Blog
2026-11-13 13:20 News

IP Theft in Industrial Cyber Incidents Jumps From 6% to 31%: SANS 2026 ICS/OT Survey Finds a Third of Firms Hit. What It Means for CAD Files | CADChain | CAD DRM & IP

The SANS Institute published its 2026 State of ICS/OT Security Survey on 10 November 2026, and one number stands out for anyone who owns engineering data: incidents involving intellectual property theft rose from 6% to 31% in a single year. Over the same period, the share of industrial organisations that reported at least one cyber incident affecting their operational technology rose to 34%, up from about 22% a year earlier.
The survey is the ninth annual edition of the SANS State of ICS/OT Security Survey. According to reporting by Information Security Buzz, 696 industrial security professionals answered it. Operational technology (OT) and industrial control systems (ICS) are the networks, controllers and workstations that run plants, machines, utilities and production lines. They used to be treated as a world apart from office IT. The 2026 results show that attackers no longer see them that way.
For deep-tech founders, engineering managers and IP lawyers, the IP theft figure matters most. Industrial networks hold far more than production settings. They hold PLC programs, robot paths, recipes, process parameters and, on engineering workstations, the CAD models and drawings that describe how a product is made. When an attacker reaches those systems, the question is no longer only how long the line stops. It is also what know-how left the building.
TL;DR: industrial incidents are rising, and more of them now involve IP theft

SANS's 2026 ICS/OT survey, released on 10 November 2026, reports that 34% of industrial organisations had at least one OT-related cyber incident in the past year, that 72% of incidents caused downtime and that incidents involving IP theft rose from 6% to 31%. Ransomware and compromised shared IT/OT credentials were the most cited incident types, and only 41% of incidents were detected within 24 hours. Lesson for engineering teams: design files, machine programs and process know-how on industrial networks need the same protection as the systems themselves, including file-level protection that still holds after a breach.

What did the SANS 2026 ICS/OT survey find?

The headline is growth. The share of respondents reporting at least one cyber incident affecting OT rose from about 22% to 34%, which Infosecurity Magazine described as the biggest single-year leap. In 72% of the reported incidents, facilities or systems went down. Incidents with an impact on safety rose from 8% to 13%.
The nature of the incidents is changing too. Ransomware and the compromise of shared IT/OT credentials or identities were each cited by 31% of respondents who reported an incident. Exploitation of firewalls and other edge devices followed at 24%, and supply chain compromise at 21%. These are the same routes we see in the news every week, from VPN appliances to managed service tools.
Detection is getting worse, not better. Only 41% of incidents were detected within 24 hours, which SANS describes as the first deterioration in detection times since it began collecting the data. Dedicated ICS/OT monitoring platforms found 38% of incidents, IT perimeter tools 31% and human operators 20%. Only 13% of respondents said they have full visibility across IT and OT.

Why does the jump in IP theft matter for engineering data?

A rise from 6% to 31% is very large, and it should be read with care. The public summaries do not say how SANS defined intellectual property theft, and they do not say whether 31% is a share of all respondents or of those who reported an incident. The full report sits behind a SANS login. What the figure does show clearly is that, in the eyes of the people who defend industrial networks, theft of know-how has moved from a side issue to one of the main outcomes of an attack.
That fits what we have reported this autumn. The UK's National Cyber Security Centre said in its Annual Review 2026 that cyber espionage is highly likely the most significant cyber threat to long-term UK growth, with knowledge-intensive sectors as targets. Ransomware gangs have started to advertise design drawings and PDM data stolen from manufacturers as the prize, not just encrypted servers. And state-linked groups have gone after naval shipbuilders and aircraft engine makers in Europe.
Industrial IP is also unusually easy to use once it is stolen. A competitor who gets a PLC program, a set of tuned process parameters or the native CAD assembly of a machine does not need to understand the underlying science. They can copy the result. Our guide to competitor espionage and CAD file theft tactics describes how that happens in practice.

Where does IP actually sit in an industrial environment?

Most companies can list their production systems. Far fewer can list where their know-how sits inside them. The table below maps the usual places, how they leak and what protects them.
Where the IP sitsWhat it containsHow it typically leaksWhat still protects it
Engineering workstationsNative CAD models, drawings, PLC and HMI projectsRansomware with data theft, stolen remote access, malicious project filesFile-level encryption, least privilege, access logs
PLC, robot and CNC programsLogic, motion paths, cycle times, tool dataUploads from controllers, copies on laptops and USB sticksVersion control, signed backups, controller passwords
Recipes and process parametersTemperatures, pressures, mixing ratios, tuningHistorian or MES access, screenshots, exportsNeed-to-know access, export alerts
Historian and quality dataYears of process and yield dataBulk queries via shared IT/OT accountsSeparate accounts, query monitoring
Machine builder and supplier filesManuals, wiring diagrams, 3D models of the machineVendor remote access, shared portals, emailTime-limited, view-only sharing with logs
Shared project platformsTender packages, drawings, change ordersBreach of the platform or a partner accountEncryption of the files themselves, revocable access
Engineering workstations deserve special attention. They sit on the OT network, they talk to controllers, and they hold the richest files. The same week as the survey, SecurityWeek's industrial Patch Tuesday roundup listed high-severity Siemens advisories for engineering software such as Simcenter Femap and SIMATIC WinCC Graphics Designer, and a Schneider Electric advisory for EcoStruxure Power Build Rapsody in which a malicious project file could lead to arbitrary code execution. Opening the wrong file on an engineering PC is still one of the shortest paths to the most valuable data.
Shared platforms are the other weak spot. In October attackers reached a data exchange server used by the Brenner Base Tunnel project and its contractors, and the fourth critical Windchill flaw of 2026 showed again how one PLM server can expose thousands of design files at once.
Keep design files protected even when the network is breached. CADChain encrypts CAD files at file level, lets you grant and revoke access per user, logs every access and records ownership on a blockchain, so stolen files stay locked and your ownership stays provable.

👉 See how CADChain protects CAD files

What else did the survey say about resilience?

Several findings show how hard it is to recover once OT is hit. Only 15% of respondents believed they could keep safe production running manually for more than 48 hours without SCADA or DCS systems, and 40% did not know. Organisations that test their continuity plans at least once a year and include ICS/OT in them did better: 46% of them expected to restore their most critical facility within a day, against 27% of all respondents.
Dependence on suppliers is high. If their primary automation vendor disappeared, 58% of respondents expected to shut down or be unable to operate within a year, and only 10% thought they could keep producing indefinitely. Only 20% said they have a fully functional programme for supply chain cyber risk. People are a single point of failure too: 68% said losing one or two experienced staff would delay or seriously disrupt their security and incident response.
There is also a gap between leaders and practitioners. According to Information Security Buzz, every executive who answered the question about a total IT compromise expected production to continue, yet only 14% of executives routinely validate their ICS/OT security capabilities in a technical way. Jason Christopher, the SANS principal instructor who wrote the report, put it plainly when talking about who would run the plant by hand: "Most of the industry has not answered those questions yet."

What does this mean for companies in the EU?

European rules already expect companies to plan for this. Under NIS2, many manufacturers of machinery, vehicles, electronics and other products are important entities. They must manage cyber risk across IT and OT, and report significant incidents to their national CSIRT or authority, with an early warning within 24 hours. With only 41% of incidents detected within a day, that clock can start before a company even knows what was taken.
The Cyber Resilience Act adds duties for anyone who sells products with digital elements, including machine builders and makers of industrial software. Since 11 September 2026 they must report actively exploited vulnerabilities and severe incidents, as we explained in Cyber Resilience Act reporting is live.
Trade secret law is the third layer. Under the EU Trade Secrets Directive, process know-how and design data only count as trade secrets if the holder took reasonable steps to keep them secret. Shared accounts between IT and OT, unmonitored engineering workstations and unlimited supplier access are hard to defend as reasonable steps after a theft. Our trade secrets guide for deep tech startups explains the test, and tamper-proof audit trails help you prove what you did and when.

What should engineering teams do now?

  1. Map your know-how, not just your assets. List where CAD models, drawings, PLC and robot programs, recipes and process data sit across IT and OT, including copies on laptops and supplier portals.
  2. Separate IT and OT identities. Shared credentials were one of the two most cited incident types. Give OT systems their own accounts, enforce MFA on remote access and remove accounts that cross both worlds without a reason.
  3. Treat engineering workstations as crown jewels. Patch engineering software promptly, limit who can open project files from outside, and keep these machines off email and general web browsing where you can.
  4. Control supplier and machine builder access. Use time-limited, logged access and share view-only CAD files with vendors instead of full native files when a view is enough. Our guide to CAD file security in supply chain collaboration covers the details.
  5. Watch for bulk exports. Alert on unusual downloads from vaults, historians and file shares. See how to audit CAD file access.
  6. Protect the files themselves. Encrypt native CAD files at file level so a copy taken from an engineering PC cannot be opened. Our guide to CAD encryption explains where each method stops.
  7. Rehearse the bad day. Test continuity plans with OT included, decide who runs the plant by hand and who reports to the CSIRT under NIS2 within 24 hours.
  8. Keep dated proof of ownership. Record when each important design and program existed and who had access, so you can show what was yours if it turns up elsewhere.

How does this fit the bigger picture?

Our sister sites covered other ways engineering data is exposed this week:
The common thread is that design data now moves through many systems, from industrial networks to cloud platforms and transfer servers. Our complete guide to CAD file security and our page on design protection for machinery manufacturers bring these layers together.

Conclusion

The SANS 2026 survey describes an industrial sector under more pressure than a year ago: more incidents, more downtime, slower detection and a sharp rise in incidents involving IP theft. The exact meaning of the 31% figure needs the full report, but the direction is clear.
For engineering companies, the lesson is that protecting the plant and protecting the know-how are now the same job. Patching, network separation and monitoring keep attackers out for longer. File-level protection and dated proof of ownership decide what they can do with your designs if they get in anyway.
Make stolen design files useless and your ownership provable. CADChain gives every CAD file a verifiable ownership record, file-level encryption, granular permissions you can revoke at any time and a full access log, across CAD systems and suppliers.

👉 Protect your CAD files with CADChain

FAQ: SANS 2026 ICS/OT survey and IP theft

What is the SANS 2026 State of ICS/OT Security Survey?

It is the ninth annual SANS Institute survey of industrial control system and operational technology security, published on 10 November 2026. According to Information Security Buzz, 696 industrial security professionals responded.

How many industrial organisations had an OT cyber incident?

34% of respondents reported at least one cyber incident affecting OT in the past year, up from about 22% the year before. In 72% of reported incidents, facilities or systems went down.

How much did IP theft increase?

SANS reports that incidents involving intellectual property theft rose from 6% to 31%. The public summaries do not define IP theft or say whether the 31% is a share of all respondents or of those who had an incident.

What were the most common incident types?

Ransomware and compromise of shared IT/OT credentials or identities were each cited by 31% of respondents who reported an incident, followed by exploitation of firewalls and edge devices at 24% and supply chain compromise at 21%.

How fast are OT incidents detected?

Only 41% of incidents were detected within 24 hours, which SANS describes as the first deterioration in detection times since it began collecting the data.

What counts as IP in an industrial environment?

Typical examples are native CAD models and drawings on engineering workstations, PLC, robot and CNC programs, recipes and process parameters, historian and quality data, and machine builder documentation.

Which EU rules apply after an OT incident with data theft?

Depending on the company, NIS2 incident reporting with a 24-hour early warning, Cyber Resilience Act reporting for product manufacturers, GDPR if personal data is involved, and the Trade Secrets Directive's reasonable-steps test for protecting know-how.

How does CADChain help?

CADChain encrypts CAD files at file level, so a copy taken from a breached workstation or server cannot be opened without permission. It also logs every access and records ownership on a blockchain. It works alongside network security and patching, not instead of them.