OT Security Leadership Shifts to Executive Level as Threats Evolve

A significant transformation is occurring in operational technology (OT) security leadership, with 52% of organizations now placing OT security responsibility under their Chief Security Officer or Chief Information Security Officer, according to new research from Fortinet. This marks a dramatic increase from 16% in 2022.

Critical Infrastructure Protection Takes Center Stage

The elevation of OT security to executive leadership comes as organizations implement comprehensive cybersecurity strategies for business protection. The research reveals a maturing approach to OT security, with organizations implementing more sophisticated cybersecurity practices and seeing tangible results.

Organizations have achieved notable progress in security maturity levels:

• 26% have established basic visibility and segmentation (Level 1)
• The majority of organizations are at Level 2, focusing on access control and profiling
• Companies at Level 4 or higher report better handling of common threats like phishing

These improvements have led to a decrease in operational outages affecting revenue, dropping from 52% to 42% in 2025.

AI and Modern Solutions Transform OT Security

Jeff Macre, Industrial Security Solutions Architect at Darktrace, emphasizes the role of artificial intelligence in strengthening OT security: "OT device communications are often highly predictable and routine, making it easier for AI to understand their normal behavior and detect deviations that may indicate cyber threats."

The predictable nature of OT systems presents both challenges and opportunities. Organizations must conduct thorough security risk assessments to identify vulnerabilities in OT environments. Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck, notes: "One of the biggest challenges with cybersecurity in critical infrastructure is the long lifespan of the devices. Something that was designed and tested to the best practices available when it was released can easily become vulnerable to more sophisticated attacks later in its lifecycle."

Practical Applications for Organizations

Organizations can leverage these findings by:

1. Implementing unified platforms that support both IT and OT security monitoring
2. Adopting AI-powered tools for faster threat detection and response
3. Breaking down silos between IT and OT teams to improve coordination

The shift toward executive-level OT security management reflects the critical nature of protecting industrial systems and infrastructure. As threats continue to evolve, organizations must maintain focus on both technological solutions and leadership engagement to ensure comprehensive protection of critical systems.

James Maude, Field CTO at BeyondTrust, emphasizes the importance of privileged access management: "Organizations need to think about how to securely manage privileged access into their critical environments, ensuring that employees, vendors, and third parties have just the access and permissions needed to do their job without additional risk exposure."

For more information about OT security best practices, visit the CISA Industrial Control Systems guidance page.