7% of industrial organisations tackle vulnerabilities only when they occur —Study

Zawya

25-06-2025

A study titled: 'Securing OT with Purpose-built Solutions' conducted by Kaspersky in collaboration with VDC Research, illuminates the shifting landscape of cybersecurity within the industrial sector.
Focusing on key industries such as energy, utilities, manufacturing and transportation, this research surveyed over 250 decision-makers to unveil vital trends and challenges faced in fortifying industrial environments against cyber threats.
A strong cybersecurity strategy begins with complete visibility into an organisation's assets, allowing leaders to understand what assets need protection and assess the highest risk areas. In environments where ICT and OT (Operational Technology) systems converge, this demands more than just a comprehensive asset inventory.
Organisations must implement a risk assessment methodology that is aligned with their operational realities – by establishing a clear asset baseline, organisations can engage in meaningful risk assessments that address both corporate risk criteria and the potential physical and cyber consequences of vulnerabilities.
Recent survey findings reveal a concerning trend: a significant number of organisations are not engaging in regular penetration testing or vulnerability assessments.
Only 27.1 per cent of respondents perform these critical evaluations on a monthly basis, while the majority—48.4 per cent—conduct assessments every few months. Alarmingly, 16.7 per cent do so only once or twice a year, and 7.4 percent address vulnerabilities solely as needed. This inconsistent approach can leave organisations vulnerable as they navigate an increasingly complex threat landscape.
Every software platform is inherently vulnerable to bugs, insecure code, and other weaknesses that malicious actors can exploit to compromise IT environments. For industrial companies, effective patch management is therefore crucial to mitigate these risks.
However, studies reveal that many organisations encounter significant challenges in this area, often struggling to allocate the necessary time to pause operations for critical updates.
Disturbingly, many organisations patch their OT systems only every few months or even longer, significantly heightening their risk exposure. Specifically, 31.4 percent apply patches monthly, while 46.9 percent do so every few months, and 12.4 percent update only once or twice a year.
These challenges in maintaining effective patch management are exacerbated in OT environments, where limited device visibility, inconsistent vendor patch availability, specialised expertise requirements and regulatory compliance add layers of complexity to the cybersecurity landscape.