Cyber‑attacks are costing manufacturing and critical national infrastructure (CNI) organisations as much as £5 million in OT downtime, new research from e2e‑assure has found, with global conflicts spiking concerns over increasingly aggressive nation‑state actors.

Surveying 250 cybersecurity decision makers across midsize and enterprise firms, the study found 80% of manufacturing and CNI firms have experienced downtime losses of between £100,000 and £5 million, with OT systems routinely subjected to attack.

Almost a quarter (23%) of the most severe OT downtime incidents now cost businesses over £1 million, with 6% passing £5 million. These financial losses are not limited to rare, worst-case scenarios, becoming a common outcome of incidents affecting essential services and industrial operations, with the long-term damage caused by such attacks outweighing concerns over the immediate financial impact.

With cyber-attacks on typical IT environments now commonplace, the threat to OT systems is increasing, particularly as geopolitical tensions rise, with 64% of IT decision-makers now fearing nation-state attacks.

e2e-assure warned that nation-state actors often exploit common entry points such as phishing or compromised credentials before moving into OT systems, increasing the risk of prolonged disruption if organisations are unable to detect and remediate activity quickly. 

These concerns are supported by findings which show the average time from compromise to detection has fallen to 52 days, giving attackers time to move through networks and access critical systems before being identified.

Given this protracted timeline, the study points to a growing “remediation gap” in industrial cybersecurity. While 31% of organisations can now detect breaches within twelve hours, fully resolving incidents remains a challenge, as one in ten enterprises admits it takes over a year to remediate major incidents.

At the same time that the remediation gap widens, cyber incidents are becoming more frequent, with the most common repeat attacks including phishing (17%), malware and ransomware (16%), insider threats (15%), and credential theft or account compromise (15%). 

According to e2e‑assure, this suggests attackers are still leaning on familiar techniques, particularly email and compromised access, rather than more advanced methods, highlighting a significant gap between perceived and actual risk.

Nearly half (45%) of decision-makers said they are least concerned about insider threats, while 44% place less importance on visibility into OT network activity, areas where incidents can persist undetected, particularly when remediation takes months or longer.

Recommended reading

• Report: Enterprise PCs Wide Open to Hackers 76 Days a Year
• NCSC Warns UK Business to Prepare for Iranian Cyber-attacks
• One in Ten UK Firms “Wouldn’t Survive” a Cyber-Attack

Supply chain compromise, for instance, is often a critical point of failure for mid-sized organisations, with 21% reporting four or more incidents linked to suppliers or third parties. Similarly, CNI organisations report high levels of repeated supply chain compromise and credential theft, both at 21%, evidence that trusted access points are frequently used to gain entry.

Beyond this, organisations are increasingly concerned about longer-term impacts, such as reputational damage (25%) and brand or revenue loss (20%), which are now seen as greater risks than immediate financial impact. 

“Organisations are making progress in how quickly they can detect incidents, but that progress is not yet carrying through to remediation, and this gap between detection and resolution is leaving OT environments exposed for extended periods,” said Rob Demain, CEO at e2e-assure.

“In OT environments, where cyber-physical systems directly support operations and essential services, delays in resolving incidents can have lasting operational and financial consequences.”