CREST research: OT/ICS cybersecurity demand is growing. Can capability keep pace? New report published.

Posted by Catherine Jones on 11 September 2026

OT/ICS cybersecurity demand is growing. Can capability keep pace?

As industrial environments become more connected and cyber threats increasingly target operational systems, demand for operational technology and industrial control systems (OT/ICS) cybersecurity is growing. CREST’s latest research examines whether the market has the capability to support that growth.

Recent events and high-profile incidents have pushed OT/ICS higher up the cybersecurity agenda. In August 2026, the UK’s National Cyber Security Centre’s news update warned of increased targeting of operational technology systems across multiple sectors, including in the UK, with some activity resulting in real-world disruption. It urged organisations to improve their visibility of OT assets, strengthen cyber resilience and prepare for recovery when incidents occur.

The warning followed reports that a small-scale UK power plant had been taken offline for four days in July following a suspected cyberattack. While wider power generation was unaffected, the incident illustrates how the consequences of cyber attacks can affect physical operations as well as systems and data.

And this is not solely a UK concern.

In July, CISA, the FBI, the Australian Cyber Security Centre and international partners published joint CI Fortify guidance for critical infrastructure operators, urging them to prepare to isolate vital OT systems during significant cyber incidents. The guidance calls for organisations to identify critical assets, establish separation points, and regularly test isolation plans.

These are important technical and operational recommendations, but they also raise a wider question for the cybersecurity services market:

As demand for OT/ICS cybersecurity grows, do providers have the capability to meet it?

CREST’s latest insight report Inside OT/ICS: Growth, capability and trust in an evolving market explores this question in detail. Drawing on external market analysis and research with CREST members, it examines how the market itself is changing, and the implications for providers and buyers. Read on for the key findings.

Request a copy of the OT/ICS Insight Report

1. Growth is creating a capability challenge

Two-thirds of our survey respondents expect demand for OT/ICS cybersecurity services to increase over the next 12 months. In comparison, only 27% expect an increase in the availability of skilled practitioners, and only 29% expect an increase in specialist provider availability.

This suggests demand is growing faster than the expertise needed to support it. 85% of respondents believe skills shortages are limiting service quality and consistency, while 76% state that finding specialist personnel is the biggest barrier to entering the OT/ICS market.

These shortages in availability present significant opportunities for providers and for professional development.

2. OT/ICS cybersecurity requires specialist operational expertise

One of the strongest themes to emerge from our research was that OT/ICS cybersecurity requires a different approach to enterprise IT security. Operational expertise is crucial.

Respondents highlighted specialist protocols and engineering knowledge, safety and uptime constraints, legacy systems, restricted access and limited asset visibility among the characteristics that distinguish OT/ICS work. This is particularly relevant in the context of recent government guidance.

CISA’s CI Fortify guidance (linked above) emphasises the importance of understanding which systems are vital, how they connect, where they can safely be separated, and how essential services will continue during isolation. The NCSC’s bulletin reinforces the need to understand OT assets, system dependencies and operational environments when managing cyber risk.

OT/ICS work is highly specialised, requiring technical expertise, operational understanding, sensitivity and judgement. The survey results show those respondents with deeper OT/ICS experience were more likely to view operational expertise as a critical component of effective service delivery. They were also more likely to recognise the limitations of conventional IT security approaches and the need to adapt delivery to operational environments.

3. OT/ICS buyers want proof of specialist capability

As the market matures, the questions buyers ask appear to be changing from:

“Do you offer OT/ICS cybersecurity services?”

To more specific, assurance-based questions like:

“How do we know you can deliver OT/ICS services safely in our environment?”

Our respondents reported increasing scrutiny of provider capability, with clients most commonly requesting case studies, specific OT/ICS experience and delivery methodologies to evidence operational competence alongside cybersecurity credentials. They also highlighted the importance of collaboration in OT/ICS engagements. Clients need to involve the right operational and engineering stakeholders, share sufficient information about their environments, and define objectives and constraints clearly.

Providers can support the process by helping organisations scope engagements, explain access and testing requirements, identify operational stakeholders and set realistic expectations. Strong collaboration helps providers deliver more effective engagements and helps buyers get greater value from them.

4. OT/ICS is a market increasingly defined by trust

Our survey findings point to a market where demand is on the rise, specialist capability is constrained, and buyers are placing greater emphasis on demonstrable competence.

In this environment, trust and assurance become increasingly important. 77% of respondents told us buyers are raising expectations around demonstrable competence, while 65% see growing demand for formal assurance and good practice. 85% believe the market would benefit from clearer shared expectations around credible service delivery.

In response, we will introduce OT/ICS capability supplements to the suite of CREST accreditations in Q4 2026, to help providers demonstrate specialist operational capability and give buyers greater confidence in procuring specialist services. Shared standards and processes will become increasingly important as industrial environments and the OT/ICS market continue to evolve.

AI, automation and new technologies are reshaping industrial environments

Greater connectivity, automation, and the introduction of AI-enabled and autonomous systems could create new questions about how operational technology is assessed and governed.

“The opportunity for providers is unlikely to be fully autonomous testing – it’s helping organisations deploy and secure AI safely within OT and ICS environments.”
Jonathan Armstrong, CREST Head of Product

As AI becomes more deeply integrated into operational environments, both digitally and physically, organisations will need to understand the security implications. This includes how AI alters existing security risks, creates new dependencies and attack paths, and changes the way OT/ICS systems are secured.

Industrial environments will continue to change, bringing new technologies, new risks, and new questions. But our research suggests the fundamentals remain constant: operational expertise, safe delivery, demonstrable competence and trusted assurance.

For providers, buyers and cybersecurity professionals alike, CREST’s Inside OT/ICS: Growth, capability and trust in an evolving market examines where the market is heading, and what that means for those delivering and buying services, and professionals building careers in the field.