BAKU, Azerbaijan, September 22. Energy and
utilities companies reported the highest rate of significant
operational technology (OT) cybersecurity incidents among sectors
covered by Honeywell Technologies’ 2026 OT Cybersecurity Benchmark
Report.


According to the report, 91% of energy and utilities respondents
said they had experienced a significant OT cybersecurity incident
over the past 12 months. At the same time, 91% said they expected
to be able to restore critical OT systems within 24 hours, the
highest recovery confidence recorded among the sectors
surveyed.


"Oil and gas companies reported a lower incident rate, with 54%
of respondents saying they had experienced a significant OT
cybersecurity incident during the same period. However, only 52%
said they could restore critical systems within 24 hours,
representing the lowest expected recovery rate among the four
sectors analyzed," said Honeywell.


The report also highlights differences in the geographic impact
of cyber incidents. Among oil and gas organizations affected by an
incident, 28% reported impacts across multiple regions, compared
with 10% of affected energy and utilities respondents.


In terms of overall recovery preparedness, 28% of oil and gas
respondents described their organizations as fully recovery-ready,
compared with 36% in the energy and utilities sector.







Both sectors reported relatively high levels of OT asset
visibility. Some 91% of oil and gas respondents said they had a
complete or mostly complete inventory of their assets, compared
with 85% among energy and utilities companies and 80% across all
respondents.


Honeywell said the findings demonstrate that strong asset
visibility does not necessarily translate into effective recovery
capabilities, particularly across geographically dispersed oil and
gas operations and highly regulated, continuously operating energy
networks.


The 2026 benchmark examines security coverage across connected
OT environments, as well as visibility, monitoring and recovery
practices linked to incident detection and downtime reduction. The
report is intended to help organizations assess their cybersecurity
maturity and identify capabilities that can improve operational
resilience.