Skip to content

SecurityNot yet confirmed elsewhere1 publisher2 min readPublished

Full OT visibility still leaves 49 percent of operators struggling with legacy equipment

Palo Alto Networks found 49 percent of critical infrastructure operators who see every OT asset still list legacy equipment as a challenge. Most respondents say their security tools, seven on average at large operators, have raised complexity and cost.

The Watch · Security desk

How we use AISend a correction

Illustration accompanying Full OT visibility still leaves 49 percent of operators struggling with legacy equipment
Generated illustration

What happened

  • Forty-two percent of respondents name legacy equipment that cannot be patched as their biggest cybersecurity risk.
  • In the past twelve months, 59 percent had a significant security breach, and one in five was hit more than once.
  • Unplanned downtime costs a mean of $288,563 an hour, and half of respondents list safety concerns among the impacts of incidents.
  • IT and OT security operations remain unintegrated at 74 percent of the organisations surveyed.

Why it matters

  • constraint Asset inventories do not retire the legacy exposure, so operators running unpatchable gear depend on how fast they can detect and contain an incident on it.
  • decision With alert correlation as the top-ranked fix for the IT and OT split, operators already running seven tools have to decide whether it replaces some of them or becomes an eighth.
  • cost At last year's rate of improvement, most operators will keep paying hourly downtime for years before they can contain incidents in minutes.

Seeing every OT asset barely moves the legacy problem [18]. In the Palo Alto Networks sample of more than 1,600 security and operations leaders [2], 52 percent name legacy OT as their most common visibility problem [3]. Among those who say they see everything, 49 percent still list it as a challenge [5]. The two figures sit three points apart, on different bases [18].

The seven tools large operators run on average have not given most of them a full view of their OT assets [1]. Respondents put the cost plainly: 59 percent say the tools make operations more complicated [6], and 56 percent report higher operating costs [7]. Alert handling has not kept up. Just over half still sort alerts by a standard severity score or by hand [8].

The survey write-up [2] does not break out breach rates by tool count or say how many respondents claimed full visibility. It supports the complaint about complexity and cost, and it cannot show whether a bigger stack meant fewer breaches.

The respondents' preferred next step is more automation. Asked what would most speed IT and OT convergence over the next two years, 52 percent picked automated alert correlation [15]. Correlation software speaks to incompatible technology, cited by 44 percent of operators that have not merged the two security operations, and 44 percent cite differing priorities between the teams [14].

For gear that cannot be patched, the survey's measure of response is containment speed [11]. Fifteen percent contain incidents in minutes through automation, up from 10 percent a year earlier [11]. Half of respondents, 51 percent, want to reach that point within twelve months [12], a target 36 points above today [19]. Last year's gain was five points. At that rate the 51 percent mark is about seven years away [20].

The AI figures say little about defense [17]. Ninety-five percent worry about attacks driven by Frontier AI, the survey's term, and 91 percent think AI-based security tools will help fend those attacks off [16]. Only 19 percent use AI across four or more operational areas, and that count includes process optimization and predictive maintenance, so it does not isolate security use [17].

What to watch

  • Whether Palo Alto Networks publishes fuller methodology, including the size of the full-visibility group and breach rates broken out by tool count.
  • The next edition's share of operators containing incidents in minutes, measured against last year's five-point gain and the 51 percent target.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence35
Adoption18
Hype gap+15
Incentives
Insufficient
Confidence40
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Large critical infrastructure operators run seven separate security tools on average, and most still cannot see every asset on their OT networks.

    ReportedSupportedView cited source
  2. [2]

    The findings come from a Palo Alto Networks survey of more than 1,600 security and operations leaders.

    ReportedSupportedView cited source
  3. [3]

    Legacy OT is the most common visibility problem, named by 52 percent of respondents.

    ReportedSupportedView cited source

Sources

1 independent publisher whose own reporting we read for this story.

  1. helpnetsecurity.com

    1 article · October 6, 2026

    Even with OT network visibility, critical infrastructure operators struggle with legacy equipment

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Loading related stories