The Detection Gap in US Oil and Gas OT Security | 2026 Research

71 Point

Gap between self-rated confidence
and the basis for it

94%

Already moving emergency OT security
funding, not a future budget cycle

45%

Name IT/OT culture gap as the
single biggest barrier to progress

What You'll Find Inside

Five Findings. The Gaps Are Clear.

Operators across US upstream and midstream oil and gas are spending aggressively on OT security after Operation Epic Fury. Most are confident in their ability to detect a breach. This research, conducted independently by Dimensional Research on behalf of Tosi in April 2026, examines what that confidence is based on, and what it is not.

The report covers these five findings in depth.

It closes with four diligence questions operators can take into the next OT security investment decision.

Confidence Without Foundation

The 71-point detection gap between self-rated confidence and the basis for it.

87%confident vs 16% capable

The Breach Reality

The incident reality, with 99 of 100 operators reporting at least one cyber incident category since Operation Epic Fury.

99/100operators affected

The New Bottleneck

The dominant barrier to faster progress, which has shifted from financial to organizational.

45%IT/OT culture gap

The Spending Response

The budget movement already in motion, with 94 percent of operators moving emergency funding.

94%moving funds now

Looking Forward

The capabilities operators say they need to acquire next.

42%prioritise detection

About the Research

Independent Research. Full Methodology.

100OT decision makers surveyed

36%Upstream operators

64%Midstream operators

61%Operate 100+ OT sites

The 2026 Oil and Gas OT Decision Maker Survey was fielded by Dimensional Research, an independent third-party research firm, in April 2026. The sample comprises 100 OT decision makers at US upstream and midstream oil and gas operators, with 36 percent upstream and 64 percent midstream.

Respondents include OT security leaders, engineering leaders, and operations technology leaders with direct responsibility for OT cyber programs. Sixty-one percent of respondents operate 100 or more OT sites.

Hear the findings live or on demand

In a Tosi webinar featuring Margaret Herndon, Chief Marketing Officer at Tosi, and Al Lindseth, Founder of CI5O Advisory Services and former CIO and CISO at Plains All American, a Fortune 100 midstream company. Margaret presents the full survey findings. Al presents the pipeline ICS security perspective. Register for the live event or watch the replay.

Why Tosi Commissioned This Research

Purpose-Built OT Security

Tosi has been building purpose-built OT security since 2011, when most of the industry was still treating OT as a subset of IT. Tosi works with oil and gas operators, EPCs, OEMs, and managed service partners to deploy secure remote access and OT network security at field sites in minutes rather than weeks.

Tosi commissioned this research independently because the questions in this report are the questions oil and gas operators are working through right now.

Expert Commentary

What OT Leaders Are Saying

"The fallout from Operation Epic Fury has exposed a massive confidence gap in the oil and gas sector. Eighty-seven percent of operators believe they can detect a breach in 24 hours, yet only 16 percent have the OT-native monitoring required actually to do it."

Damon Small
Board of Directors, Xcape, Inc.

"The capital is available. What separates operators who get resilience from those who only get activity is whether the investments integrate into operations or just copy IT security models into OT."

Al Lindseth
Founder, CI5O Advisory Services & former CIO/CISO, Plains All American

Go Deeper

Related from Tosi

Article

The Detection Gap Hiding in Plain Sight in Oil and Gas OT

Sakari Suhonen, CEO of Tosi US, on what the research means for the next budget cycle.

Coming soon

Webinar Replay

The Evolution of OT Security in Oil and Gas With Guest Speaker

A conversation featuring Al Lindseth, former CIO/CISO at Plains All American. Watch on demand after May 27.

Watch On Demand →

Media

Oil and Gas Operators Are Confident. But The Tools Cannot Prove It.

Oil and Gas operators are confident they can detect a cyberattack. The tools they are using cannot.

Read the Coverage →

NEW RESEARCH | OIL & GAS OT SECURITY

THE DETECTION GAP HIDING IN PLAIN SIGHT IN U.S. OIL AND GAS OT

A new Tosi survey of 100 OT decision makers at US upstream and midstream operators finds 87% confident they could detect an OT breach within 24 hours. Only 16% have the OT monitoring to prove it. Download the full report.