The systems that keep power flowing, factories running and hospitals open are more connected than ever and harder to defend. Palo Alto Networks’ first State of Critical Infrastructure Cybersecurity Report says as much. Sapio Research carried out the survey, which covers more than 1,600 security leaders across 11 countries. Respondents work at large organizations (over 1,000 employees and $500 million in revenue) in five sectors: manufacturing, healthcare and life sciences, energy and utilities, transportation, and government.
Visibility is the weakest link
Most organizations do not have a full picture of what is connected to their operational technology (OT) networks, the systems that control physical machinery. Only 32% say they have complete, real-time visibility. On average, nearly a quarter (23%) of connected OT assets is unmanaged or hard to monitor.
Aging equipment is the biggest obstacle, named by 52% of respondents. Even among companies with full visibility, 49% still struggle with legacy systems. Seeing a problem is not the same as fixing it, and 84% expect 5G to be widely adopted within two to three years, adding another layer of connected devices to secure.
More tools, more headaches
Companies have tried to close these gaps by adding security products and now use an average of 7 different tools. The result is often more complexity, not more safety. In the survey, 59% report operational complexity, 56% report higher costs, and 46% report coverage gaps. Only 17% have more than four of the seven core OT security capabilities in place. While 92% say prioritizing alerts is critical, more than half still rely on basic scoring systems or manual review.
Attacks are already causing real damage
This is not a theoretical risk. Over the past year, 59% of organizations suffered a significant breach, and one in five were hit more than once. Half cited safety concerns as a result, and 49% faced unplanned downtime. Downtime costs an average of $288,563 per hour. Today, only 15% can contain incidents within minutes, and half want to reach that speed within the next year.
AI cuts both ways
Nearly all respondents (95%) worry about attacks powered by frontier AI, and 91% expect AI-driven defenses to help counter them. Adoption, however, is shallow. Almost every organization uses AI somewhere, most often for security monitoring (66%), but only 19% use it across four or more operational areas. Looking ahead, 60% plan to adopt automated troubleshooting within two years, and 56% plan to use AI to automatically resolve alerts.
IT and OT still work in silos
Just 26% of organizations have fully integrated their IT and OT security teams. The top barriers are incompatible technology and differing priorities between teams, each cited by 44%. The most popular fix is automated alert correlation across both environments, chosen by 52% of respondents.
The bottom line
Palo Alto Networks sells many of the consolidated, AI-driven tools the report recommends, so readers should keep that in mind. Still, the core takeaway is clear: critical infrastructure leaders know their weaknesses, but complexity, aging equipment, and divided teams continue to slow them down just as AI makes attackers faster.
