BAKU, Azerbaijan, September 22. Energy and utilities companies reported the highest rate of significant operational technology (OT) cybersecurity incidents among sectors covered by Honeywell Technologies’ 2026 OT Cybersecurity Benchmark Report.
According to the report, 91% of energy and utilities respondents said they had experienced a significant OT cybersecurity incident over the past 12 months. At the same time, 91% said they expected to be able to restore critical OT systems within 24 hours, the highest recovery confidence recorded among the sectors surveyed.
"Oil and gas companies reported a lower incident rate, with 54% of respondents saying they had experienced a significant OT cybersecurity incident during the same period. However, only 52% said they could restore critical systems within 24 hours, representing the lowest expected recovery rate among the four sectors analyzed," said Honeywell.
The report also highlights differences in the geographic impact of cyber incidents. Among oil and gas organizations affected by an incident, 28% reported impacts across multiple regions, compared with 10% of affected energy and utilities respondents.
In terms of overall recovery preparedness, 28% of oil and gas respondents described their organizations as fully recovery-ready, compared with 36% in the energy and utilities sector.
Both sectors reported relatively high levels of OT asset visibility. Some 91% of oil and gas respondents said they had a complete or mostly complete inventory of their assets, compared with 85% among energy and utilities companies and 80% across all respondents.
Honeywell said the findings demonstrate that strong asset visibility does not necessarily translate into effective recovery capabilities, particularly across geographically dispersed oil and gas operations and highly regulated, continuously operating energy networks.
The 2026 benchmark examines security coverage across connected OT environments, as well as visibility, monitoring and recovery practices linked to incident detection and downtime reduction. The report is intended to help organizations assess their cybersecurity maturity and identify capabilities that can improve operational resilience.
