The State of IoT/OT Cybersecurity inthe Enterprise
Sponsored by Microsoft
Independently conducted by Ponemon Institute LLC
Publication Date: November 2021

Ponemon Institute© Research Report

The State of IoT/OT Cybersecurity in the EnterprisePresented by Ponemon InstituteNovember 2021

Part 1. Executive summary
Sponsored by Microsoft and conducted by Ponemon Institute, the purpose of this study is todetermine how effective organizations are in securing their Internet of Things (IoT) devices,
including Enterprise Internet of Things (EIoT) and Industrial Internet of Things (IIoT) devices aswell as their Operational Technology (OT) and Industrial Control Systems (ICS). Ponemon
Institute surveyed 615 IT and IT security practitioners in the United States who areknowledgeable about the state of cybersecurity in their organizations.
As shown in this research, organizations are increasingly relying upon these devices to optimize
their operations and the number of IoT and OT endpoints is growing dramatically. Industry
analysts estimate that CISOs will soon be responsible for an attack surface three times larger
than just a few years ago. Further, these devices are typically unmanaged and don’t support
agents leaving their security posture unknown and often insecure (e.g. security baselines
unimplemented, unpatched and unmonitored). Finally, these devices are often invisible to IT
security teams because they often lack the tools to discover and inventory such IoT and OT
devices.
IoT/OT adoption is critical to ongoing business success. Advancing IoT/OT projects is a toppriority even with concerns about the security. Sixty-eight percent of respondents say senior
management believes IoT/OT is critical to supporting business innovation and other strategic
goals as shown in Figure 1.
Sixty-five percent of respondents say senior management has made it a priority for IT and IT
security practitioners to plan, develop or deploy IoT projects to advance business interest. As apossible consequence of senior management’s push for deployment, few IT security practitioners(only 31 percent of respondents) are willing to slow, limit or stop the adoption of IoT/OT projects
due to security concerns, which are described in more detail in the report.
Figure 1. Perceptions about the importance of IoT/OT to achieving business innovation
Strongly agree and Agree responses combined

Senior management believes IoT/OT is critical tosupporting business innovation and otherstrategic goals

68%

Senior management has made it a priority for IT
and IT security practitioners to plan, develop or
deploy IoT projects to advance business interests

65%

IT security practitioners in our organization haveslowed, limited, or stopped the adoption of
IoT/OT projects due to security concerns

31%

0%

Ponemon Institute© Private & Confidential Document

10% 20% 30% 40% 50% 60% 70% 80%

Page 1

Following is a summary of the findings that cover the following topics: the ineffectivenessof current security practices, vulnerability of IoT/OT devices, the risky exposure of IoT/OT
devices, the threat landscape and the willingness to pay more for IoT devices andsolutions in order to improve IoT/OT security.
IoT/OT devices are vulnerable. These devices are not designed with security in mind such as
PC’s and mobile devices are.
§Sixty percent of respondents say IoT/OT devices are one of the least secured part of theirorganizations’ IT/OT infrastructure.

§

Fifty-five percent of respondents do not believe IoT/OT devices have been designed withsecurity in mind and 11 percent of respondents do not know.

The risky exposure of IoT/OT devices. The least secure devices on the typical network can bereached by attackers from the internet.
§

Eighty-eight percent of respondents say their organizations’ enterprise IoT devices areconnected to the internet (e.g., for cloud printing services).

§

Fifty-six percent of respondents say their organizations’ OT devices are connected to theinternet for such purposes as to enable remote access.

§Fifty-one percent of respondents say the OT network is connected to corporate IT (business)
network (e.g., for SAP, remote access, etc.).

Lack of visibility is a key security challenge in the IoT/OT environment. Organizations
struggle to get a view of what devices exist on their network and if they are being secured andmonitored. Forty-seven percent of respondents say their organizations primarily use manual
processes to identify and correlate compromised IoT/OT devices to the attacks.
§

Twenty-nine percent of respondents say their organizations have a complete inventory of
their IoT/OT devices. According to these respondents, organizations have an average of
9,685 devices.

§

Barriers to ensuring the security of IoT devices are the lack of visibility of assets andvulnerabilities. Sixty-one percent of respondents have low or average confidence in the ability
to identify whether IoT devices are compromised.

§

Forty-two percent of respondents lack visibility of vulnerabilities. Seventy percent ofrespondents have low or average confidence in the security of their organizations’ IoT
devices and 64 percent of respondents have low or average confidence that IoT devices arepatched and up to date.

§On a positive note, 67 percent of respondents say senior management considers improving
IoT/OT security is top priority over the next 12 to 24 months.

The threat landscape defined. The volume of attacks against IoT/OT devices are increasing.
§Thirty-five percent of respondents say in the past two years their organizations experienced acyber incident where an IoT device was used by an attacker to conduct a broader attack.

§Thirty-nine percent of respondents experienced a cyber incident in the past two years wherean IoT device was the target of the attack itself.

Ponemon Institute© Private & Confidential Document

Page 2§

Fifty percent of respondents say the volume of attacks against IoT/OT devices haveincreased significantly (26 percent) or increased (24 percent).

§

Sixty-three percent of respondents say the volume of attacks will significantly increase (36percent) or increase (27 percent).

Organizations are willing to spend more on IoT devices and solutions to Improve thesecurity of the IoT/OT environment. Devices are being designed to be more secure. According
to a special analysis, respondents would be willing to spend more if the security of these devices
would improve, especially for industrial IoT devices (an average of 37 percent more) andindustrial IoT solutions (an average of 41 percent more).

Ponemon Institute© Private & Confidential Document

Page 3

Part 2. Key findings
In this section, we provide a deep dive into the research. The complete findings are presented in
the Appendix of this report. We have organized the report according to the following topics.
§§§§

IoT/OT devices are important to business innovation and profitability but create security risks
The barriers and challenges to securing IoT/OT devices
How much more would organizations spend on IoT/OT devices if they become more secure?
Industry differences

IoT/OT devices are important to business innovation and profitability but create security
risks
Senior management and IT security practitioners agree the insecurity of IoT/OT devices isposing risks to the organization. According to Figure 2, 60 percent of respondents say IoT/OT
is one of the least secured aspects in the IT/OT infrastructure. As discussed previously, theimportance of IoT/OT devices to the future of organizations has been established and, on a
positive note, 67 percent of respondents say senior management views improving IoT/OT
security as one of their top security priorities over the next 12 to 24 months.
Figure 2. Perceptions about the current state of IoT/OT cybersecurity
Strongly agree and Agree responses combined

Senior management views improving IoT/OT
security as one of their top security priorities overthe next 12 to 24 months

67%

IT security practitioners in my organization view
IoT/OT security as one of the least secured
aspects of our IT/OT infrastructure

60%

0%

10% 20% 30% 40% 50% 60% 70% 80%

While a gap between productivity and security risk continues to grow. Our research suggest
senior-level management recognize the need for a more robust IoT/OT infrastructure,

Ponemon Institute© Private & Confidential Document

Page 4

The volume of attacks against IoT/OT devices will increase. As shown in Figure 3, 50 percent
of respondents say the volume of attacks against IoT/OT devices has increased significantly (26percent) or increased (24 percent). In the future (2021 and beyond), 63 percent of respondents
say the volume of attacks will significantly increase (36 percent) and increase (27 percent).
Figure 3. How has the volume of attacks changed in the past and will change?
Significantly increased and Increased responses presented
70%
60%
50%
40%

27%
24%

30%
20%
10%

36%
26%

0%
Volume of attacks in the past 12 to 24 months
Significantly increased

Volume of attacks in the future
Increased

The main consequence of an increasing security risk in the IoT/OT infrastructure is thesubstantial rise in targeted attacks. Many of these attacks rely on leading-edged automation
methods such as machine learning, orchestration and artificial intelligence.

Ponemon Institute© Private & Confidential Document

Page 5

Many cyber incidents involve IoT/OT devices. Forty-four percent of respondents say theirorganizations experienced a cyber incident in the past two years that involved an IoT/OT device.
Contributing to security risks is the increasing reliance of edge devices. These devices can takethe form of any small device with compute power near the end-user. Most IoT devices do nothave much processing power and security features, leaving a vast number of vulnerable network
entry points at the edge.
According to Figure 4, 35 percent of respondents say in the past two years their organizations
experienced a cyber incident where an IoT device was used by an attacker to conduct a broader
attack and 39 percent of respondents experienced a cyber incident in the past two years wherean IoT device was the target of the attack itself.
Figure 4. Types of cyber incidents organizations experienced in the past two years
60%

54%
49%

50%
40%

39%

35%

30%
20%
11%

12%

10%
0%
Yes

No

UnsureIoT device was used by an attack to conduct a broader attack
IoT device was the target of the attack

The small footprint of IoT devices, such as surveillance video, lighting systems or local printers,present inherent limitations to built-in security at the device level.

Ponemon Institute© Private & Confidential Document

Page 6

Few organizations have an accurate asset inventory of their IoT devices in their security
solutions. Only 37 percent of respondents are confident that their organizations have an
accurate asset inventory of IoT devices in their security solutions. As shown in Figure 5, only 29
percent of respondents say their organizations have a complete inventory of its IoT/OT devices. Ifthey do, organizations have an average of 9,685 devices.
Figure 5. Does your organization have a complete inventory of its IoT/OT devices?
70%
62%
60%
50%
40%
30%

29%

20%
9%

10%
0%
Yes

No

Don’t know

Our research presents the need for IoT/OT governance procedures such as the completion of
an inventory process that lists the physical locations of all devices (including devices that are
not connected to the Internet).

Ponemon Institute© Private & Confidential Document

Page 7

Organizations are vulnerable to attacks because IoT devices on IT networks and the OT
networks are connected to the internet. As shown in Figure 6, 88 percent of respondents saytheir IoT devices are connected to the internet. These include such devices as smart TV,
conferencing systems and printers connected to cloud printing services.
These devices are intended to improve ease of access and connection, rather than for security. It
is recommended that IoT devices should be patched as soon as a vulnerability is identified. In
addition, monitoring which devices interact and the movement of traffic between them will make iteasier to detect abnormalities.
Fifty-six percent of respondents say the OT network and devices on the OT network areconnected to the internet and 51 percent of respondents say their organizations’ OT network isconnected to their corporate IT network for SAP, remote access and more.
Figure 6. OT network and device connections
Yes responses

IoT devices on the IT network are connected tothe internet

88%

The OT network is connected to the internet

56%

The OT network is connected to corporate IT(business) network (e.g., for SAP, remote
access, etc.)

51%

0% 10% 20% 30% 40% 50% 60% 70% 80% 90%100%

Results show that a source of significant vulnerabilities for many organizations is theconnection of IoT devices operating in IT networks.

Ponemon Institute© Private & Confidential Document

Page 8

Organizations are relying upon manufacturers to secure IoT/OT devices. Fifty-five percent ofrespondents say they do not believe IoT/OT devices have been designed with security in mind
and 11 percent of respondents say they do not know.
Yet, according to Figure 7 almost half (47 percent) of respondents are relying upon
manufacturers to secure these devices. This is followed by assigning responsibility to the CISO
and security team (42 percent).
Figure 7. Who secures IoT/OT devices within your organization?
More than one response permitted
The manufacturers of the device

47%

The CISO and his/her security team42%

The operational team (facilities, OT engineers,
etc.)

34%

The IT department

33%

Managed security service provider

28%

System integrator

21%

No one function is responsible

19%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

There is no clearly defined leader who has overall responsibility for ensuring the security of
IoT/OT devices used throughout the organization. Ownership of this function is essential forestablishing a strong IoT/OT governance and/or industrial control process.

Ponemon Institute© Private & Confidential Document

Page 9There is a significant gap between the importance of IoT/OT devices and confidence in the
security of these devices. Respondents were asked to rate the level of confidence in theirorganization’s IoT/OT devices on a scale of 1 = no confidence to 10 = high confidence. Figure 8
presents the high confidence and very high responses (7+ on the 10-point scale).
As shown in Figure 8, only 30 percent of respondents have high or very high confidence that their
IoT devices are secure, in their ability to identify if devices have been compromised (only 39
percent of respondents), IoT devices are patched and up-to-date (only 36 percent ofrespondents) and the supply chain is trusted to ensure IoT/OT devices are secure (32 percent ofrespondents).
Figure 8. Confidence in the security of IoT/OT devices
On a scale from 1 = no confidence to 10 = high confidence, 7+ responses presented
Ability to identify if devices have been
compromised

39%

IoT devices are patched and up-to-date

36%

Supply chain is trusted to ensure IoT and IIot
devices are secure32%

IoT devices are secure30%
0%5% 10% 15% 20% 25% 30% 35% 40% 45%

The lack of confidence in the security of IoT/OT devices is not surprising given the lack ofstrong governance and industrial control processes in many organizations.

Ponemon Institute© Private & Confidential Document

Page 10

The barriers and challenges to securing IoT/OT devices
While there are barriers and challenges to securing these devices, improvement in the
IoT/OT security posture is expected to be achieved. As discussed previously, senior
management recognizes the vulnerabilities of IoT/OT devices and is committed to making IoT/OT
security a priority. Because of this commitment, respondents are optimistic that the security
posture of IoT/OT devices will improve in the next five years, as shown in Figure 9.
Respondents were asked to rate the security posture of their organizations’ legacy IoT/OT
devices from a scale of 1 = not secure to 10 = highly secure. Figure 9 presents the security
posture from secure to highly secure (7+ responses on the 10-point scale).
Figure 9. The security posture of legacy IoT/OT devices today and in five years
10-point scale from 1 = not secure to 10 = highly secure, 7+ responses presented
80%
69%

70%
60%
50%
40%

37%

30%
20%
10%
0%
The security posture of your legacy IoT/IIoT
devices today

The security posture of your legacy IoT/IIoT
devices in the next five years

This figure paints a very positive picture about the state of IoT/OT security over the next five(5) years.

Ponemon Institute© Private & Confidential Document

Page 11

Lack of visibility is the primary barrier to ensuring the security of IoT/OT devices.
According to Figure 10, 57 percent of respondents say the lack of visibility of their organizations’assets is affecting the security of IoT/OT devices. Organizations are also operating in the dark
because of not having visibility of threats (50 percent of respondents) and visibility ofvulnerabilities (42 percent of respondents).
Other barriers are a lack of personnel with sufficient knowledge and expertise (36 percent ofrespondents), interoperability issues among cybersecurity solutions (25 percent of respondents)and silo and turf issues (23 percent of respondents).
Figure 10. What are the primary barriers to ensuring the security of IoT and IIoT devices?
Visibility of assets

57%

Visibility of threats

50%

Visibility of vulnerabilities

42%

Lack of personnel with sufficient knowledge andexpertise

36%

Inability to reduce attack surface (e.g., network
segmentation, patching, secure configuration,
etc.)

28%

Interoperability issues among cybersecurity
solutions and/or tools

25%

Significant silo and turf issues

23%

Insufficient budget

19%

Lack of C-level buy-in and support

17%

Other

3%
0%

10%

20%

30%

40%

50%

60%

Our research shows the importance of visibility in the IoT/OT infrastructure in order to improvegovernance and control processes within my organization.

Ponemon Institute© Private & Confidential Document

Page 12

Organizations are ineffective in preventing cyberattacks against IoT/OT devices.
Respondents were asked to rate the effectiveness of their organizations in preventing cyberincidents on a scale from 1 = not effective to 10 = highly effective. Figure 11 presents the 7+
responses on the 10-point scale (high to very high effectiveness).
As shown in Figure 11, only 33 percent of respondents rate the prevention of cyber incidents
where IoT devices are used by an attacker to conduct broader attacks as high or highly effective,
preventing the tampering of IoT and OT devices by outside adversaries (only 31 percent ofrespondents) and preventing cyber incidents involving IoT devices in a persistent or lateral
movement (only 26 percent of respondents).
Figure 11. Effectiveness in organizations’ ability to prevent cyber incidents involving IoT
devices
On a scale from 1 = not effective to 10 = highly effective, 7+ responses presented

Preventing cyber incidents where an IoT device
is used by an attacker to conduct a broader
attack33%

Preventing tampering of IoT and OT devices byoutside adversaries

31%

Preventing cyber incidents involving IoT
device(s) in a persistent or lateral movement

26%

0%

5%

10%

15%

20%

25%

30%

35%

The above figure shows the lack of effectiveness with respect to preventing cyber incidents,
tampering of IoT devices deducting outside adversaries.

Ponemon Institute© Private & Confidential Document

Page 13

Organizations believe they are effective in achieving compliance with regulations.
Respondents were asked to rate the effectiveness in meeting various features of their IoT/OT
security program on a scale of 1 = not effective to 10 = very effective. The highly effective
features (7+ responses) are shown in Figure 12. According to respondents, organizations aremost effective in achieving compliance with regulations and standards (62 percent), third-party
risk management (58 percent) and awareness and training (53 percent).
Figure 12. Effectiveness in meeting IoT/OT security program features
On a scale from 1 = not effective to 10 = very effective, 7+ responses presented

Compliance with regulations and standards

62%

Third party risk management

58%

Awareness and training

53%

0%

10%

20%

30%

40%

50%

60%

70%

Organizations are generally positive with respect to meeting compliance requirements in the
IoT/OT infrastructure.

Ponemon Institute© Private & Confidential Document

Page 14

Organizations are not effective in creating an effective IoT/OT security program.
Respondents were asked to rate the effectiveness in achieving IoT security program features ona scale of 1 = not effective to 10 = very effective. Figure 13 presents the high effective or very
effective respondents. As shown, most respondents are not confident in being effective inmeeting IoT/OT security program features.
Figure 13. Following are features that relate to creating an effective IoT security program
and their ability to be high or highly effective
On a scale from 1 = not effective to 10 = very effective, 7+ responses presented
Safety program management

51%

Threat and risk assessment

49%

Cybersecurity planning and business priorities

49%

Incident management preparedness

48%

Security program management

47%

Testing and assessment

46%

A culture that supports efforts to secure IoT
devices

46%
0%

10%

20%

30%

40%

50%

60%

The main features of a highly effective IoT security program include safety, threat assessmentand other business priorities.

Ponemon Institute© Private & Confidential Document

Page 15

Network detection and response (NDR) solutions are shown to effectively secure IoT/OT
devices, yet only 39 percent of respondents say their organizations are deploying them.
Figure 14 presents security tools that can be used to secure devices. Fifty-two percent ofrespondents say their organizations use vulnerability scanners, 51 percent of respondents rely
upon firewalls and 49 percent of respondents use anti-virus technologies. Many of these solutions
are not applicable to securing devices, which indicates organizations are not mature inunderstanding how to achieve better security.
Figure 14. Which of the following existing security tools in the market can be used toeffectively secure IoT/OT devices?
More than one response permitted
Vulnerability scanners

52%

Firewalls

51%

Anti-virus

49%

IDS/IPS

47%

Network Access Control

44%

Network Detection & Response

39%

None are effective

25%
0%

10%

20%

30%

40%

50%

60%

Our research suggests that organizations are using conventional IT security tools rather thanOT-specific tools and applications to protect IoT devices and OT infrastructure.

Ponemon Institute© Private & Confidential Document

Page 16

How much would organizations spend on a more secure solution?
How valuable is a solution that would increase an organization’s security posture in the
IoT/OT environment? In this research, a second survey was conducted to determine how much
more organizations would pay if they were assured that greater security would be achieved in the
IoT/OT environment.
We surveyed individuals on four different scenarios as shown below to determine the averagepremium in percentage that organizations would pay to enhance their security posture. The four
scenarios are as follows.
§§§§

How much more would you be willing to pay for an Enterprise IoT device that was designed
to be as secure as a mobile device?
How much more would you be willing to pay for an Enterprise IoT security solution thatprovides protection, detection and response capabilities that has the same level of efficacy as
those that are available for traditional endpoints?
How much more would you be willing to pay for an industrial IoT (OT/ICS) device that was
designed to be as secure as a mobile device?
How much more would you be willing to pay for industrial IoT (OT/ICS) security solution thatprovides protection, detection and response capabilities that has the same level of efficacy as
those that are available for traditional endpoints?

In Table 1, the results are presented in four quartiles. Each quartile represents the averageamount of premium in percentage respondents would be willing to pay. The research is divided
between enterprise and industrial IoT. As shown, respondents will pay a higher average premiumfor industrial than enterprise: 23 percent and 32 percent premiums for enterprise vs. 37 percent
and 41 percent for industrial.
EnterpriseIoT device

Enterprise
IoT solution

Industrial
IoT device

Industrial
IoT solution

First quartile

19%

21%

24%

28%

Second quartile

20%

26%

29%

31%

Mean, median, mode

23%

32%

37%

41%

Third quartile

37%

42%

45%

50%

Fourth quartile

44%

50%

56%

62%

Difference

25%

29%

32%

34%

Table 1. How much are you willing to pay?

Ponemon Institute© Private & Confidential Document

Page 17

Industry differences
In this section, we provide findings from respondents in the following industries. These include
financial services (92 respondents), oil & gas (55 respondents), industrial & manufacturing (74respondents) and health & pharma (80 respondents).
All industries represented in this research are most likely to believe IoT/OT deployment is
critical to their organizations’ business goals. According to Figure 15, 72 percent ofrespondents in health & pharma and 71 percent of respondents in financial services say theirorganizations are committed to the deployment of IoT/OT devices.
Figure 15. Senior management’s perception about the importance of IoT/OT deployment
Strongly agree and Agree responses combined
80%

72%

71%

69%

67%

Financial services

Oil & gas

Industrial &manufacturing

70%
60%
50%
40%
30%
20%
10%
0%
Health & pharma

The bar chart reveals that industry difference in the IoT/OT environment are only nominal (notstatistically significant)Ponemon Institute© Private & Confidential Document

Page 18

According to Figure 16, health & pharma and industrial & manufacturing are slightly more likely tohave had a cyber incident in the past two years where an IoT device was used to conduct a
broader attack.
Figure 16. Did your organization experience a cyber incident in the past two years wherean IoT device was used by an attacker to conduct a broader attack?
Yes responses presented
38%

40%

37%
34%

35%

32%

30%
25%
20%
15%
10%
5%
0%
Health & pharma

Industrial &manufacturing

Oil & gas

Financial services

Yes

Visibility of assets, threats and vulnerabilities is critical to ensuring the security of IoT
devices. Companies in the oil & gas industries are most likely to say the lack of visibility of their
IoT assets (64 percent of respondents) followed by financial services (58 percent of respondents)
is a barrier to ensuring the security of IoT devices. Health & pharma (43 percent of respondents)and financial services (45 percent of respondents) are less likely to say the lack of visibility ofvulnerabilities is a barrier, as shown in Figure 17.
Figure 17. What are the top three barriers to ensuring the security of IoT devices?
Top three responses presented
70%

64%
58%

60%
50%

50%

55%

55%
45%

45% 43%Financial services

Health & pharma

43%

51% 49%
48%

40%
30%
20%
10%
0%
Oil & gas

Visibility of assets

Visibility of threats

Ponemon Institute© Private & Confidential Document

Industrial &manufacturing

Visibility of vulnerabilities

Page 19

As shown in Figure 19, financial services (54 percent of respondents) and health & pharma (53percent of respondents) are most likely to use automated processes to identify and correlate
impacted IoT devices to the incidents and alerts raised by other security solutions such as SIEM
and EDR. Companies in the industrial & manufacturing sector are most likely to rely upon manual
processes.
Figure 18. What processes does your organization use to identify and correlate impacted
IoT devices to the incidents and alerts raised by other security solutions such as SIEM and
EDR?
60%

54%

50%

53%
47%

46%

49%

54%

51%
46%

40%
30%
20%
10%
0%
Financial services

Health & pharma

Primarily automated processes

Oil & gas

Industrial &manufacturing

Primarily manual processes

Virtually every industry in this special analysis has IoT devices on the IT network
connected to the internet, as shown in Figure 19. These connections are difficult to securewith traditional technologies. Moreover, the sheer volume of endpoints are a potential entry for
attackers. The more devices connected, the more chance of a security incident.
Figure 19. The mythical airgap
Yes responses presented
100%
90%
80%
70%
60%
50%
40%
30%
20%
10%
0%

90%

89%

55%

Financial services

86%
61%

Health & pharma

85%
57%

Oil & gas

56%

Industrial &manufacturing

IoT devices on the IT network are connected to the internet
OT network is connected to the internet

Ponemon Institute© Private & Confidential Document

Page 20

Part 3. Methodology
A sampling frame of 17,003 IT and IT security practitioners in the United States who areknowledgeable about the state of cybersecurity in their organizations were selected as
participants to this survey. Table 1 shows 672 total returns. Screening and reliability checks
required the removal of 57 surveys. Our final sample consisted of 615 surveys or a 3.6 percent
response.
Table 1. Sample response
Sampling frame
Total returns
Rejected or screened surveys
Final sample

Freq
17,003
672
57
615

Pct%
100%
4.0%
0.3%
3.6%

Figure 20 reports the respondent’s organizational level within participating organizations. By
design, more than half (54 percent) of respondents are at or above the supervisory levels. The
largest category at 19 percent of respondents is manager.
Figure 20. Current position within the organization

4%

2% 4%

3%

9%

5%
14%

12%
19%
15%

Senior Executive
Vice President
Director
ManagerSupervisor
EngineerTechnician
Staff/Analyst
Consultant
Contractor
Other

13%

Ponemon Institute© Private & Confidential Document

Page 21

Figure 21 reports the primary person the respondent reports to within the organization. Twentysix percent of respondents report to the chief information officer, 21 percent of respondents reportto the chief information security officer and 10 percent of respondents report to the head of
product engineering, as shown in Pie Chart 2.
Figure 21. Primary person respondent reports to within the organization

4%

Chief Information Officer

2%2%2%

Chief Information Security Officer

4%

26%

Head, Product Engineering

5%Compliance Officer
Data Center Management

8%

Chief Risk Officer
Chief Security Officer
CEO/Executive Committee

8%

Chief Safety Officer
21%

8%

Chief Financial Officer
General Counsel

10%

Human Resources VP

Figure 22 reports the industry focus of respondents’ organizations. This chart identifies financial
services (15 percent) as the largest industry focus, which includes banking, investment
management, insurance, brokerage, payments and credit cards. This is followed by healthcare
and pharmaceuticals (13 percent of respondents), industrial manufacturing (12 percent ofrespondents), logistics and transportation (11 percent of respondents) and oil and gas (9 percent
of respondents).
Figure 22. Primary industry focus

7%

2%

Financial Services

15%

Healthcare & Pharmaceuticals

7%

Industrial Manufacturing
Logistics & Transportation

8%

13%

Oil and Gas
Consumer Goods/Retail

8%

Energy & Utilities
Public Sector
12%8%Automotive
Telecommunications

9%

11%

Ponemon Institute© Private & Confidential Document

Other

Page 22

When asked where the employees are located, 97 percent of respondents identified the UnitedStates, 63 percent of respondents identified Europe, 51 percent of respondents identified AsiaPacific, 49 percent of respondents identified Canada, 46 percent of respondents identified Latin
America and 25 percent of respondents said their organization has employees in the Middle East
and Africa.
Figure 23. Location of employees
More than one response permitted
United States

97%

Europe63%

Asia-Pacific51%

Canada49%

Latin America (including Mexico)

46%

Middle East & Africa

25%
0%

20%

40%

60%

80%

100%

120%

As shown in Figure 24, 35 percent of respondents are from organizations with a global headcountof between 5,000 to 10,000, 36 percent of respondents are from organizations with a global
headcount of between 10,000 and 25,000 and 29 percent of respondents are from organizations
with more than 25,000 employees.
Figure 24. Global full-time headcount

12%

More than 75,000

35%
17%

25,001 to 75,000

10,001 to 25,000

5,000 to 10,000
36%

Ponemon Institute© Private & Confidential Document

Page 23

Part 4. Caveats to this study
There are inherent limitations to survey research that need to be carefully considered before
drawing inferences from findings. The following items are specific limitations that are germane tomost web-based surveys.
<<<

Non-response bias: The current findings are based on a sample of survey returns. We sent
surveys to a representative sample of individuals, resulting in a large number of usable
returned responses. Despite non-response tests, it is always possible that individuals who did
not participate are substantially different in terms of underlying beliefs from those whocompleted the instrument.
Sampling-frame bias: The accuracy is based on contact information and the degree to which
the list is representative of individuals who are IT and IT Security practitioners. We also
acknowledge that the results may be biased by external events such as media coverage.
Finally, because we used a web-based collection method, it is possible that non-web
responses by mailed survey or telephone call would result in a different pattern of findings.
Self-reported results: The quality of survey research is based on the integrity of confidential
responses received from subjects. While certain checks and balances can be incorporated
into the survey process, there is always the possibility that a subject did not provide accurate
responses.

Ponemon Institute© Private & Confidential Document

Page 24

Appendix: Detailed Survey Results
The following tables provide the frequency or percentage frequency of responses to al survey
questions. All survey responses were captured in May 2021.
Survey response
Total sampling frame
Total returned surveys
Rejected surveys
Final sample
Response rateFreq
17,003
672
57
615
3.6%

Part 1. Screening questions
S1. How familiar are you with the cybersecurity initiatives within your company today?
Very familiar
Familiar
Somewhat familiar
No knowledge (Stop)
Total

Pct%
45%
34%
21%
0%
100%

S2. How familiar are you with the use of enterprise IoT devices in your organization?
Very familiar
Familiar
Somewhat familiar
No knowledge (Stop)
Total

Pct%

S3. How familiar or aware are you with OT/ICS/IIoT in your organization?
Very familiar
Familiar
Somewhat familiar
No knowledge (Stop)
Total

Pct%

39%
36%
25%
0%
100%

41%
32%
27%
0%
100%

Part 2. Attributions
Please express your opinion about each one of the following statements using theagreement scale below each item. Strongly agree and Agree responses combined.

Pct%

Q1. Senior management believes IoT/OT is critical to supporting business innovationand other strategic goals.

68%

Q2. Senior management has made it a priority for IT and IT security practitioners toplan, develop or deploy IoT projects to advance business interests.

65%

Q3. IT security practitioners in our organization have slowed, limited, or stopped theadoption of IoT/OT projects due to security concerns.

31%

Q4. IT security practitioners in my organization believe that existing IoT/OT security
solutions are in their infancy when compared to endpoint protection platforms (EPP)and endpoint detection and response (EDR) solutions.

53%

Q5. IT security practitioners in my organization view IoT/OT security as one of the least
secured aspects of our IT/OT infrastructure.

60%

Q6. Senior management views improving IoT/OT security as one of their top security
priorities over the next 12 to 24 months.

67%

Ponemon Institute© Private & Confidential Document

Page 25

Part 2. The state of cybersecurity in industrial organizations
Q7a. How has the volume of attacks against IoT/OT devices in your organization
changed in the past 12 to 24 months?
Significantly increased
Increased
Stayed the same
Decreased
Significantly decreased
Total
Q7b. How will the volume of attacks against IoT devices in your organization change in
2021 and beyond?
Significantly increase
Increase
Stay the same
Decrease
Significantly decrease
Total
Q8. Did your organization experience a cyber incident in the past two years where an
IoT device was involved?
Yes
No
UnsureTotal
Q9. Did your organization experience a cyber incident in the past two years where an
IoT device was used by an attacker to conduct a broader attack?
Yes
No
UnsureTotal
Q10. Did your organization experience a cyber incident in the past two years where an
IoT device was the target of the attack itself?
Yes
No
UnsureTotal
Q11. What processes does your organization use to identify and correlate impacted IoT
devices to the incidents and alerts raised by other security solutions such as SIEM and
EDR? Please select only one choice.
Primarily manual processes
Primarily automated processes
Total

Ponemon Institute© Private & Confidential Document

Pct%
26%
24%
25%
18%
7%
100%

Pct%
36%
27%
18%
13%
6%
100%

Pct%
44%
50%
6%
100%

Pct%
35%
54%
11%
100%

Pct%
39%
49%
12%
100%

Pct%
47%
53%
100%

Page 26

Q12. Who is ultimately accountable for the security of IoT/OT devices? Please selectyour top two choices.
CISO and the security organization
Operational leaders such as VP/Operations or VP/Manufacturing (OT organization)Line of business manager
Product developer/engineer
Other (please specify)
No one function is responsible
Total
Q13. What are the primary barriers to ensuring the security of IoT and IoT devices?
Please select your top three choices.
Visibility of assets
Visibility of vulnerabilities
Visibility of threats

Pct%
25%
30%
12%
16%
2%
15%
100%

Pct%
57%
42%
50%

Inability to reduce attack surface (e.g., network segmentation, patching, secure
configuration, etc.)
Lack of personnel with sufficient knowledge and expertise
Lack of C-level buy-in and support
Insufficient budget
Significant silo and turf issues
Interoperability issues among cybersecurity solutions and/or tools
Other (please specify)
Total
Q14. Using the following scale from 1 = no confidence to 10 = high confidence, howconfident are you that your IoT devices are secure?
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q15. Using the following scale from 1 = no confidence to 10 = high confidence, howconfident are you in your organization’s ability to identify if devices have been
compromised?
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Ponemon Institute© Private & Confidential Document

28%
36%
17%
19%
23%
25%
3%
300%

Pct%
19%
30%
21%
18%
12%
100%
4.98

Pct%
22%
28%
11%
18%
21%
100%
5.26

Page 27

Q16. Using the following scale from 1 = no confidence to 10 = high confidence, howconfident are you that you have an accurate asset inventory of your IoT/OT devices inyour security solutions?
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q17. Using the following scale from 1 = no confidence to 10 = high confidence, howconfident are you that IoT/)OT devices in your organization are patched and up-todate?
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q18. Using the following scale from 1 = no confidence to 10 = high confidence, howconfident are you that your organization’s supply chain is trusted to ensure IoT and OT
devices are secure?
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q19. Using the following scale from 1 = not effective to 10 = highly effective, please
rate the effectiveness of your organization in preventing cyber incidents involving
IoT/OT device(s) in a persistent or lateral movement.
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Ponemon Institute© Private & Confidential Document

Pct%
16%
27%
20%
22%
15%
100%
5.36

Pct%
20%
29%
15%
21%
15%
100%
5.14

Pct%
16%
29%
23%
22%
10%
100%
5.12

Pct%
15%
31%
28%
15%
11%
100%
5.02

Page 28

Q20. Using the following scale from 1 = not effective to 10 = highly effective, please
rate the effectiveness of your organization in preventing cyber incidents where an
IoT/OT device is used by an attacker to conduct a broader attack.
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q21. Using the following scale from 1 = not effective to 10 = highly effective, please
rate the effectiveness of your organization in preventing tampering of IoT and OT
devices by outside adversaries.
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Following are program features that relate to the effective security of yourorganization’s IoT/OT devices. Please use the 10-point scale to rate yourorganization’s effectiveness in meeting each program feature. 1=not effective to10=very effective.
Q22. A culture that supports efforts to secure IoT and OT devices
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q23. Cybersecurity planning and business priorities
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Ponemon Institute© Private & Confidential Document

Pct%
21%
27%
19%
20%
13%
100%
5.04

Pct%
16%
33%
20%
23%
8%
100%
5.00

Pct%
10%
18%
26%
26%
20%
100%
6.06
Pct%
13%
20%
18%
23%
26%
100%
6.08

Page 29

Q24. Threat and risk assessment
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

Q25. Security program management
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

Q26. Safety program management
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

Q27. Incident management preparedness
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

Q28. Awareness and training
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

Ponemon Institute© Private & Confidential Document

12%
20%
19%
22%
27%
100%
6.14

13%
21%
19%
22%
25%
100%
6.00

9%
20%
20%
26%
25%
100%
6.26

12%
19%
21%
18%
30%
100%
6.20

10%
23%
14%
25%
28%
100%
6.26

Page 30

Q29. Testing and assessment
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

Q30. Compliance with regulations and standards
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

Q31. Third party risk management
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Pct%

12%
24%
18%
15%
31%
100%
6.08

9%
11%
18%
27%
35%
100%
6.86

13%
10%
19%
28%
30%
100%
6.54

Part 3. Background on device cyber protection
Q32. What best describes the maturity of your organization’s IoT/OT industrial controls
program?

Pct%

Early stage – many industrial control program activities have not as yet been planned or
deployed. Response to cybersecurity issues is reactive and ad hoc. Resources are notsufficient for staffing and administration of the program.

19%

Middle stage – industrial control program activities are planned and defined but only
partially deployed. Efforts are being made to establish security protocols, businessprocesses and workflows.

34%

Late-middle stage – industrial control program activities are deployed across theenterprise. The program has C-level support and adequate budget.

26%

Mature stage – industrial control program activities are fully deployed and maintained
across the enterprise. C-level executives and board are regularly informed about theeffectiveness of the program. Program activities are measured with KPIs.
Total

21%
100%

Ponemon Institute© Private & Confidential Document

Page 31Q33a. Does your organization have a complete inventory of its IoT/OT devices?
Yes
No
Don’t know
Total

Pct%

Q33b. If yes, how many IoT/OT devices does your organization have?
Less than 1,0001000 to 5,000
5,000 to 10,000
10,000 to 25,000
More than 25,000
Do not know
Total
Extrapolated value

Pct%

Q34. Which of the following existing security tools in the market can be used toeffectively secure IoT/OT devices? Please check all that apply.
Firewalls
Anti-virus
Vulnerability scanners
Endpoint Protection Platforms (EPP)
Endpoint Detection & Response (EDR)
Network Detection & Response (NDR)
Network Access Control (NAC)
IDS/IPS
None are effective
Total
Q35. Do you believe that existing IoT/OT devices have been designed with security in
mind?
Yes
No
Do not know
Total
Q36. Who secures IoT/OT devices within your organization? Please select all that
apply.

29%
62%
9%
100%

12%
23%
25%
24%
11%
5%
100%
9,685

Pct%
51%
49%
52%
34%
32%
39%
44%
47%
25%
373%

Pct%
34%
55%
11%
100%

Pct%

The manufacturers of the device
System integrator
Managed security service provider (MSSP)The IT department
The CISO and his/her security teamThe operational team (facilities, OT engineers, etc.)
No one function is responsible
Total

47%
21%
28%
33%
42%
34%
19%
224%

Ponemon Institute© Private & Confidential Document

Page 32

Q37. What are the top three IoT/OT security risks facing your organization? Please
select only three responses.
Compliance with industry standards/regulations
Theft of sensitive IP such as proprietary formulas and manufacturing processes
Production downtime resulting in revenue loss
Safety and/or environmental incidents
Brand impact
Cost of breach recovery and response
Supply chain risks
Other (please specify)
Total

Q38a. Using the following 10-point scale, please rate the security posture of yourorganization’s legacy IoT/OT devices today from 1 = not secure to 10 = highly secure
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Q38b. Using the following 10-point scale, please rate the security posture of yourorganization’s legacy IoT/OT devices in the next five years from 1 = not secure to 10 =highly secure
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q39. Is your OT network connected to your corporate IT (business) network (e.g., for
SAP, remote access, etc.)?
Yes
No
Total
Q40. Is your OT network connected to internet (e.g., for remote access) or do you have
any OT devices on the OT network that are connected to the internet?
Yes
No
Total

Ponemon Institute© Private & Confidential Document

Pct%
54%
57%
43%
38%
19%
28%
58%
3%
300%

Pct%
20%
20%
23%
20%
17%
100%
5.38

Pct%
10%
7%
14%
32%
37%
100%
7.08

Pct%
51%
49%
100%

Pct%
56%
44%
100%

Page 33

Q41. Do you have any IoT devices on your IT network that are connected to theinternet (e.g., smart TV conferencing systems, printers connected to cloud printing
services, etc.)?
Yes
No
Total

Pct%
88%
12%
100%

Part 4. Budget
Q42a. What range best describes your organization’s annual IT operations budget in
the current fiscal year?
Less than $1 million$1 to $10 million$11 to $25 million$26 to $50 million$51 to $100 million$101 to $250 million$251 to $500 million
More than $500 million
Total
Extrapolated value (US$ millions)Q42b. If yes, what percentage of your company’s IT security budget is dedicated tosecuring IoT/IIoT/ICS devices.
None
Less than 1%Less than 5%Less than 10%
More than 10%
Total
Extrapolated value
Part 4. Your role and organization
D1. What organizational level best describes your current position?
Senior Executive
Vice President
Director
ManagerSupervisor
EngineerTechnician
Staff / Analyst
Consultant
Contractor
Other
Total

Ponemon Institute© Private & Confidential Document

Pct%
1%
5%
9%
12%
17%
25%
18%
13%
100%
$ 208.33

Pct%
0%
4%
11%
25%
60%
100%
10%

Pct%
3%
5%
14%
19%
13%
15%
12%
9%
4%
2%
4%
100%

Page 34

D2. Check the Primary Person you or your IT security leader reports to within theorganization.
CEO/Executive Committee
Chief Financial Officer
General Counsel
Chief Information Officer
Chief Information Security Officer
Compliance Officer
Chief Safety Officer
Chief Privacy Officer
Human Resources VP
Head, Product Engineering
Chief Security Officer
Data Center Management
Chief Risk Officer
Other (please specify)
Total

Pct%
4%
2%
2%
26%
21%
8%
4%
0%
2%
10%
5%
8%
8%
0%
100%

D3. What industry best describes your organization’s industry focus?
Automotive
Consumer Goods / Retail
Energy & Utilities
Financial Services
Healthcare & Pharmaceuticals
Industrial Manufacturing
Logistics & Transportation
Oil and Gas
Public Sector
Telecommunications
Other (please specify)
Total

Pct%

D4. Where are your employees located? (Select all that apply)
United States
CanadaEuropeAsia-PacificMiddle East & Africa
Latin America (including Mexico)
Total

Pct%

Ponemon Institute© Private & Confidential Document

7%
8%
8%
15%
13%
12%
11%
9%
8%
7%
2%
100%

97%
49%
63%
51%
25%
46%
331%

Page 35

D5. What is the worldwide headcount of your organization?
Less than 5,000
5,000 to 10,000
10,001 to 25,000
25,001 to 75,000
More than 75,000
Total

Pct%
0%
35%
36%
17%
12%
100%

Ponemon Institute
Advancing Responsible Information Management
Ponemon Institute is dedicated to independent research and education that advances responsible
information and privacy management practices within business and government. Our mission is to conduct
high quality, empirical studies on critical issues affecting the management and security of sensitive
information about people and organizations.
We uphold strict data confidentiality, privacy and ethical research standards. We do not collect any
personally identifiable information from individuals (or company identifiable information in our businessresearch). Furthermore, we have strict quality standards to ensure that subjects are not asked extraneous,
irrelevant or improper questions.

Ponemon Institute© Private & Confidential Document

Page 36