“The biggest cyber risks today are no longer confined to IT systems. They increasingly impact physical operations, safety, and continuity.”
Cybersecurity budgets aren’t just growing. They’re quietly being pulled toward operations, plants, hospitals, grids, and other environments where downtime is the business. But most organizations still track and govern security spend as if the main goal is protecting IT estates and data. That mismatch is why the reporting looks reassuring while operational exposure keeps rising.
The key mistake is assuming the budget is portable. In operations, change is expensive, regulated, and constrained by safety and uptime. You can approve spending in a quarter and still spend a year negotiating patch windows, validating vendor support, and proving you didn’t introduce process risk. That time lag doesn’t show up in market sizing, and it’s where “we invested” turns into “we didn’t reduce downtime.”
Over the next few years, winners won’t be defined by who allocates more money to OT. They’ll be defined by who can convert reallocated budget into controls that survive real-world constraints: maintenance windows, safety cases, legacy systems, and engineering ownership.
What Actually Breaks in Practice
- The first failure is governance. Cyber budgets sit with IT leadership, but the assets and outage consequences sit with operations, clinical engineering, and facilities. That split creates paralysis: no one can approve the trade-offs that matter, planned downtime for patching, segmentation work that touches production networks, or vendor-led upgrades that interrupt operations.
- The second failure is treating OT cyber as a project instead of a capability. Organizations fund visibility and discovery, but don’t fund the recurring work: keeping inventories accurate, tuning detections as processes change, coordinating firmware updates, and running incident drills that test recovery under real constraints. Without that opex, risk drifts back quickly and “controls” become screenshots.
- The third failure is tool mismatch. Many environments can’t take standard IT agents, rapid patch cycles, or aggressive authentication changes without breaking deterministic behavior or vendor support agreements. Large parts of the installed base are effectively non-patchable. That pushes the problem toward segmentation, safe remote access, compensating controls, and recovery engineering, work that’s slow, cross-functional, and talent-intensive.
- Finally, execution gets boxed in by lead times and qualification cycles. OT-grade hardware, spares, and upgrades move on industrial timelines due to certification and vendor qualification, not procurement speed. That’s why reallocated budgets often land first in documentation, assessments, and “programs,” while the physical and procedural controls that reduce downtime arrive later, if they arrive at all.
The gap between approved budgets and deployed controls becomes clear once operational realities are considered.
Many operational environments cannot accept standard IT agents or rapid patch cycles without violating deterministic behavior or vendor support agreements. Large portions of the installed base are effectively end-of-life but irreplaceable. Operational networks expose a large number of devices with legacy vulnerabilities, presenting unique risk pathways that traditional IT security tools do not address (nearly 70,000 exposed OT devices).
Where the Budget Charts Don’t Show the Risk Shift
At an aggregate level, cybersecurity spending appears healthy. Global security budgets continue to rise in nominal terms, and many enterprises report year-on-year increases. After adjusting for inflation, however, growth is modest, and the internal composition of spend remains heavily skewed.
- Recent benchmarks consistently indicate that roughly 90% to 95% of cybersecurity budgets are still directed toward IT environments, leaving operational and clinical systems funded from a very small base. This imbalance persists even as risk migrates toward environments where downtime can halt production, delay patient care, or disrupt essential services.
While enterprise reporting suggests balanced investment, cybersecurity spending remains heavily skewed toward IT environments even as operational risk grows.
Two structural factors explain why this gap is hard to see in standard reporting.
1. OT spending is hidden inside projects, not budgets
Operational security investment often appears as one-off projects rather than recurring line items. Asset discovery pilots, network assessments, or visibility tools are funded as capital initiatives. Once deployed, there is frequently no operating budget to maintain inventories, tune detections, or test recovery plans. On paper, spend occurred. In practice, exposure gradually returns.
This creates a perception gap. Boards hear that the organization invested in operational security. Operators continue to work with outdated inventories, stale rules, and untested recovery procedures.
2. Centralized reporting masks site-level reality
Cyber budgets are typically reported centrally under IT or security leadership. Operational risk, however, is experienced at the site level. A manufacturing plant, hospital wing, or substation either runs or it does not. A centralized increase in spending does not guarantee that any given site is better protected or faster to recover.
The result is a measurement mismatch. Dollars allocated are visible. Controls deployed per site are not.
The gap between reported cybersecurity spend and operational exposure becomes clear when budgets are compared against where failure actually hurts.
Why “More Budget” Quietly Fails in Operational Environments
Even when organizations intend to shift spending toward operations, several patterns limit impact.
Budget growth starts from a very low base
- Industry surveys cited in 2025 commentary show that 55%of organizations increased operational technology security budgets over the past two years, and 23% reported significant increases. While directionally important, these increases start from such a small base that they rarely close the gap with IT spending.
- A doubling of a 5% share still leaves operations structurally underfunded relative to risk.
Staff and software still dominate spend
Across many enterprises, staffing and software licenses consume the majority of cybersecurity budgets, leaving hardware, training, and operational controls as residual categories. In operational environments, this bias is problematic. Many of the controls that reduce downtime risk are physical or network-based and require engineering involvement rather than additional dashboards.
OT security is treated as a project, not a capability
Operational security efforts are often funded as discrete initiatives. Once the initial deployment is complete, funding ends. There is no recurring allocation for asset lifecycle management, configuration drift, or incident drills. Over time, the environment changes while controls remain static.
Risk returns quietly, even though the budget line was spent.
Accountability sits in organizational limbo
In many enterprises, cybersecurity budgets remain under the CIO or CISO, while the assets and downtime consequences sit with operations, clinical engineering, or facilities. This split delays decisions that matter most, such as approving an outage window for patching or investing in specialized industrial firewalls.
Without a single owner empowered to trade off production loss, safety impact, and cyber exposure, even well-funded initiatives stall.
Why This Gap Persists
Mainstream market research often treats operational security as a subcategory of cybersecurity spend, assuming that once boards approve budgets, deployment follows. This assumption overlooks the reality that operational environments impose costs and delays unrelated to awareness or intent.
Three hidden assumptions appear repeatedly in forecasts.
- More budget implies more risk reduction, even when spend remains IT-skewed.
- Tools designed for IT endpoints are assumed to work in deterministic environments.
- Accountability is assumed to sit with the budget owner, not the downtime owner.
These assumptions fail during execution. When they do, the result is not a lack of tools but a lack of deployable resilience.
The friction in operational environments is not about awareness or intent, but about the cost and risk of change.
Evidence from Failures, Insurance Friction, and Loss Economics
The limits of budget reallocation become most visible when incidents occur. Despite years of increased cybersecurity investment, ransomware and operational disruptions continue to rise in sectors where downtime is most costly.
- Manufacturing has repeatedly been identified as the most targeted sector for ransomware. Incident response and threat intelligence reports indicate that roughly half of reported manufacturing breaches in 2024 involved ransomware, despite ongoing improvements in perimeter security and IT controls.
What stands out in post-incident analysis is that many shutdowns are not caused by direct compromise of control systems. Instead, they are triggered indirectly through IT outages, precautionary shutdowns, or disruptions to supporting systems such as MES and ERP.
These indirect shutdowns expose fragile dependencies between office IT and operational systems. Even when OT networks are not directly compromised, production stops because organizations cannot safely operate without upstream scheduling, quality, or authentication systems. This reality undermines the assumption that protecting IT alone sufficiently protects operations.
The economic incentives reinforce this exposure.
- Average ransom payments in manufacturing reached approximately 2.4 million dollars in 2023, reflecting the high willingness to pay for rapid restoration of production.
- For operators facing losses measured in millions per day, ransom demands represent a painful but rational trade-off.
This dynamic effectively subsidizes attackers, even as security budgets rise.
Insurance was once viewed as a backstop for this risk. That assumption is eroding quickly.
Cyber insurance for industrial and operationally intensive organizations has become more expensive, more restrictive, and harder to claim against. Premiums have risen while exclusions and sub-limits have expanded, particularly for ransomware, dependent business interruption, and events attributed to nation-state activity. Insurance specialists increasingly describe policies that appear comprehensive but contain exclusions that activate precisely when industrial incidents occur.
Insurers are responding by demanding operationally specific controls as conditions for coverage. Asset inventory accuracy, segmentation between IT and operational networks, secure remote access, and documented patch governance are now common underwriting requirements. For many organizations, these requirements are the strongest external force pushing budget and ownership into operations.
However, this pressure cuts both ways. Smaller operators often implement only the minimum controls needed to maintain coverage, reinforcing a compliance mindset rather than true resilience. Larger enterprises, by contrast, use insurance requirements to justify multi-year modernization programs that include dedicated OT security teams, firmware management platforms, and recovery testing aligned with real maintenance windows.
How Operators and Enterprises Are Adapting in Practice
Where operational security programs are making progress, the shift is not simply about spending more. It is about spending differently and moving authority closer to where downtime is experienced.
- One common adaptation is the formation of hybrid OT security teams. These teams embed control engineers alongside security professionals, often reporting jointly into operations and security leadership. Their mandate is not tool deployment alone, but dependency mapping, design of compensating controls, and coordination of changes with maintenance schedules.
In these environments, spending priorities look different. Rather than broad endpoint rollouts, budgets increasingly favor segmentation between IT and operational networks, secure remote access for vendors and engineers, and monitoring tools that understand industrial protocols and process behavior. Detection is aligned with operational anomalies rather than generic indicators of compromise.
- Regulatory frameworks also shape how reallocated budgets are used. In critical infrastructure sectors, standards such as NERC CIP in North America and the EU’s NIS and NIS2 directives act as both floor and ceiling for investment. Controls with direct audit and compliance implications tend to receive priority funding, while more experimental approaches struggle to justify operational risk.
In some utility and grid environments, cybersecurity costs are being embedded directly into regulated operating expenses. Operators seek explicit approval from regulators to fund cyber operations, incident response, and engineering support as part of tariff structures. This approach makes operational security a regulated cost rather than discretionary IT spend, shifting who ultimately pays and reducing internal resistance to sustained investment.
Even as budgets shift toward operations, most spending is still absorbed by tools rather than sustained engineering and operational work.
Underappreciated Near-Term Risks Over the Next Two to Five Years
Several risks are likely to intensify over the near term, even as budgets continue to rise.
Workforce scarcity will become the limiting factor
The global cybersecurity workforce is estimated to exceed 5.5 million professionals, yet the shortfall continues to widen and now exceeds 4 million roles. While these figures are often cited in aggregate, they mask an even more acute shortage in operational and clinical security roles.
OT and clinical security require hybrid skills that combine control engineering, safety, and cybersecurity. These profiles cannot be created quickly through salary adjustments alone. Budget reallocation without parallel investment in training and career pathways risks creating unfunded mandates where plants and hospitals are accountable for security they cannot practically staff.
Liability and solvency exposure will rise
As insurance exclusions tighten, cyber incidents with physical or safety impact increasingly threaten balance sheets rather than being absorbed by insurers. Clauses excluding malicious cyber acts or nation-state activity often contain narrow write-backs that focus on physical damage, leaving business interruption underinsured.
Organizations that assumed insurance would cover worst-case operational losses may discover that modeled coverage is materially lower than expected. This shift is likely to push more capital into self-insurance, resilience engineering, and recovery capability rather than additional detection tools.
Digital transformation expands attack surfaces faster than budgets move
The integration of cloud connectivity, AI-driven optimization, and remote operations into industrial and clinical environments is accelerating. These initiatives are often funded from IT innovation budgets, with limited consideration of their downstream impact on operational exposure.
Threat intelligence reporting already shows attackers probing beyond traditional IT environments. If ransomware can disrupt operations indirectly today, targeted disruption of safety-instrumented systems becomes a plausible next phase. Many current observability and AI initiatives are not fully priced for their operational risk implications.
Forecasts continue to overestimate deployability
Market reports for operational security platforms frequently assume linear adoption driven primarily by awareness and budget. They underplay certification cycles, vendor lock-in, installed-base heterogeneity, and regulatory friction.
Decision-makers relying on these forecasts risk misallocating capital, expecting rapid deployment of tools while underfunding the slow engineering work of lifecycle upgrades, decommissioning, and process redesign that actually reduces operational risk.
Why Centralized Cyber Metrics Miss Operational Reality
Another reason the reallocation of cybersecurity budgets remains poorly understood is that most enterprise metrics are designed for centralized IT environments, not for distributed operational sites. Dashboards track patch percentages, alert volumes, and tool coverage, yet these indicators say little about whether a plant, hospital, or grid asset can continue operating during a cyber incident. In operational environments, effectiveness is measured in minutes of downtime avoided, safety incidents prevented, and recovery actions successfully executed under stress. These outcomes depend on local readiness, not global averages.
This mismatch encourages false confidence. Organizations may appear mature on paper while individual sites remain fragile. A single poorly segmented facility or untested recovery path can dominate enterprise risk, regardless of how well the rest of the estate performs. Until metrics evolve to reflect site-level resilience, budget decisions will continue to reward visibility over durability, reinforcing the gap between reported security maturity and real-world operational exposure.
Reframing How Operational Cyber Spend Should Be Evaluated
The shift of cybersecurity budgets toward operations should be evaluated as an operational redesign, not a spending trend. The relevant question is whether security investment is governed where downtime is owned and whether it funds the engineering work operational environments require.
A more realistic evaluation framework replaces budget percentages with site-level readiness indicators, including:
- Segmentation status between IT and operational networks
- Secure remote access coverage for vendors and engineers
- Patch governance aligned to approved maintenance windows
- Recovery time tests for critical processes
- Clarity on who can approve downtime for security work
Success is measured in fewer and shorter outages, lower uncertainty around insured loss, and faster recovery under stress, not in the number of tools deployed or licenses purchased.
Operational cyber resilience is built from a small number of repeatable capabilities, not from tool count.
From Budget Tracking to Operational Resilience
This shift should be evaluated as an operational redesign, not a budget trend. The relevant question is whether security spend is governed where downtime is owned, and whether it funds the engineering work that operational environments require: segmentation, controlled remote access, patch governance aligned to maintenance windows, and tested recovery. Track spend the way operators experience risk, at the site, at the handoff points, and at the moment recovery is demanded, not where it happens to be booked on an org chart.
Author
Hilari M J
Research Analyst
https://www.linkedin.com/in/hilari-m-j-243003236/
