Insight Report: OT/ICS cybersecurity services

Demand for OT/ICS cybersecurity services is rising, but the market is still working through what credible, trusted delivery looks like in practice.

As attacks against operational systems become more disruptive, providers are seeing growing demand shaped by digital transformation, the convergence of IT and OT, and increasing regulatory focus. Yet the findings suggest that demand alone is not the full story.

CREST’s latest Insight Report explores how member companies are delivering OT/ICS cybersecurity services today, and where capability, skills, buyer expectations and market readiness may not be moving at the same pace. As the report covers, OT/ICS is becoming a market defined by trust.

The report looks at the specialist operational knowledge required for OT/ICS delivery, the evidence clients are using to assess providers, and the challenges organisations face in building trusted capability in a growing market. It closes with a look at what’s next, including CREST’S plan to introduce an OT/ICS capability supplement to its accreditation framework in Q4 2026, and a perspective piece from CREST’s Head of Product on what AI means for the future of OT/ICS assessment.

Key insights:

• OT/ICS cybersecurity delivery requires specialist operational knowledge, not just technical security expertise.
• Capability exists across the market, but provider maturity, delivery models and levels of participation vary.
• Demand for OT/ICS services is increasing, while confidence in future market readiness remains measured.
• Buyers are looking beyond broad capability claims and asking for practical evidence of experience and delivery.
• Better buyer understanding could support stronger scoping, safer delivery and more consistent OT/ICS outcomes.

What’s inside:

✔ Findings from CREST’s OT/ICS cybersecurity snap poll of member companies across multiple regions.

✔ Insight into how providers are currently delivering OT/ICS cybersecurity services and the delivery models being used.

✔ Analysis of the specialist knowledge, skills and operational understanding required for OT/ICS engagements.

✔ Findings on demand, market readiness, skills availability and provider confidence over the next 12 months.

✔ Insight into how clients assess OT/ICS provider capability, including the evidence most commonly requested.

✔A first look at CREST’s planned OT/ICS capability supplement, launching Q4 2026 to help providers demonstrate specialist operational capability.

✔A perspective piece from Jonathan Armstrong, CREST’s Head of Product, on what AI means for the future of OT/ICS assessment: “AI will not remove the hard parts of OT security. In many cases, it may introduce new ones.”