Less than 8% of OT and ICS Companies Have Robust AI Deployment, According to new Nozomi Networks and BlastWave-Sponsored Takepoint Research

SAN FRANCISCO and PALO ALTO, Calif., July 22, 2026 /PRNewswire/ -- Nozomi Networks, the leader in operational technology (OT), Internet of Things (IoT) and cyber physical systems (CPS) security and BlastWave, a leader in OT Zero Trust Protection, today released the State of AI in OT Cybersecurity 2026 Report. Nozomi Networks and BlastWave sponsored the survey alongside Industrial Cyber, which was conducted by Takepoint Research.

Notably, the report found that 87.7% of respondents are already using, evaluating, piloting, or planning AI for OT cybersecurity, but only 7.9% have deployed AI for multiple OT cybersecurity functions. That said, 69.9% believe AI's benefits in industrial cybersecurity outweigh the risks, with 49% of that group recognizing  material risks around reliability, data integrity, model manipulation, and need for human oversight to ensure the benefits outweigh the risks.

"We've reached one of the most critical inflection points in the history of cybersecurity, especially in the OT and ICS industries," said Edgard Capdeveille, CEO of Nozomi Networks. "Adversaries are increasingly using AI to augment their attacks, heightening the speed and sophistication of threats. As a result, defenders need to implement AI in their work to keep pace. These findings show that critical infrastructure industries are poised to move forward in the AI era, and not a moment too soon."

"Embrace AI for everything it can do in OT, but deploy it behind a perimeter that assumes the adversary has AI too," said Tom Sego, CEO and co-founder of BlastWave. "The same AI that automates and defends OT can be turned against it, and attackers are already using it to automate reconnaissance, generate polymorphic exploits, and poison the very models meant to automate the network. BlastWave's approach is preemptive and AI-resistant by design: we cloak OT assets so there is nothing to find, and we drop any traffic that is not cryptographically authenticated so there is no path to reach them."

Additional findings from the report include:

Agentic AI engagement is broadening, but production deployment remains rare
Nearly half of respondents have moved beyond general awareness to formally evaluate, pilot, or deploy agentic AI for an OT cybersecurity function. Twenty-one percent report that agentic AI has reached an active pilot, proof of concept, or production  environment. This includes 16.2% conducting a pilot or proof of concept and only 5.0% reporting  production deployment.

AI adoption is concentrating in monitoring, detection, and analyst support workflows
Threat detection and alerting is the most widely reported OT cybersecurity function for AI use  (33.8%), followed by network monitoring and anomaly detection (31.5%), SOC augmentation (24.5%),  and incident response and triage (22.2%). Organizations are introducing AI first where it can process  large data volumes, identify patterns, reduce alert burden, and help experienced personnel  investigate and prioritize activity.

Concern about AI-related physical consequences is widespread, but formal safeguards remain limited
Almost two-thirds of respondents consider attacks targeting AI systems or operational data  either a top-tier operational risk (20.5%) or an emerging priority they are beginning to address  (43.4%). Just over one-third of respondents report having controls intended to protect AI tools and models against manipulation, adversarial inputs, or supply chain compromise, but only 7.6%  are very confident because those controls have been tested. Only 11.9% of respondents have formally mapped and reviewed which AI-driven decisions could directly affect physical processes, safety systems, or operational continuity.

"These findings indicate a clear interest in deploying AI systems, but OT and ICS organizations struggle with how to implement AI safely, effectively, and with operational control," said Jonathon Gordon, Directing Analyst at Takepoint Research. "Over the next 6 to 12 months,  the organizations that progress furthest are likely to be those that expand AI use without granting it more authority than their controls, evidence, and operating models can support."

Click here to access the full report.

About Nozomi Networks
Nozomi Networks protects the world's critical infrastructure from cyber threats. Our platform uniquely combines network and endpoint visibility, threat detection, and AI-powered analysis for faster, more effective incident response. Customers rely on us to minimize risk and complexity while maximizing operational resilience. www.nozominetworks.com 

About BlastWave
BlastWave securely connects Industrial Control Systems, Operational Technology, and Critical Infrastructure networks with Zero Trust Protection and delivers industrial-grade cybersecurity with consumer-grade ease-of-use. Visit www.blastwave.com to learn more.

SOURCE Nozomi Networks