Industrial Cybersecurity and OT Protection Market

Colonial Pipeline shut all 5,500 miles of its fuel network by 6:10 a.m. on 7 May 2021 and only returned every line to service on the evening of 12 May, about five and a half days, its chief executive told the US Senate. That stoppage set the price of doing nothing in the Industrial Cybersecurity and OT Protection Market, which Douglas Insights puts at USD 10.42 billion for 2025: 112,400 protected industrial sites × USD 92,700 of annual OT security spend per site. Revenue reaches USD 27.55 billion by 2035, a 10.21% revenue CAGR built from 7.62% growth in protected sites and 2.41% growth in spend per site. Ownership of the category shifted on 28 January 2026, when Mitsubishi Electric completed its acquisition of Nozomi Networks, a monitoring specialist with USD 101.7 million of 2025 revenue. Site counts and spend bands follow the Douglas Insights research methodology and feed our industrial safety and instrumentation coverage.

Which assets does industrial cybersecurity and OT protection cover, from PLC networks to contractor remote-access gateways?

Industrial cybersecurity and OT protection covers 112,400 sites in 2025 where an operator pays for security engineered for control networks, not office laptops. Four capabilities sit inside: asset visibility and network monitoring, network segmentation and industrial firewalls, secure remote access, and managed detection and response. Six verticals buy them: power generation and grids, oil and gas, water and wastewater, discrete manufacturing, process manufacturing, and transport and logistics.

Delivery splits three ways. Douglas Insights estimates that product licence and appliance sales take 37.6% of 2025 revenue, subscription software 34.8% and managed service 27.6%. Enterprise IT security, safety instrumented systems and guards stay outside, as do the in-car controls sized in the Connected Vehicle Cybersecurity Market report. Gas sensors that trip a plant are counted in the Industrial Gas Detection Market study; the network that carries their alarms is counted here.

Why does an unpatchable PLC push OT protection budgets toward monitoring and segmentation?

An industrial controller often runs 10 to 20 years without a maintenance window long enough to patch, so OT protection buys walls and watchers instead of fixes. Dragos’s 2026 year-in-review found that 26% of ICS advisories in 2025 carried no patch or mitigation at all. A further 25% had a wrong CVSS score, and only 2% of ICS-relevant flaws qualified as act-now priorities.

Detection speed is the payoff. Dragos puts average dwell time at 42 days, against 5 days to contain an incident at operators with full OT visibility. That 37-day gap is the sales pitch for every passive sensor sold into a refinery or substation. Compensating controls win. Patching loses.

Why are protected OT sites multiplying 7.62% a year across substations, refineries and factories?

Protected industrial sites grow 7.62% a year because four forces add sites net of restraints: EU law adds 2.31 points, North American mandates 1.86, ransomware losses 2.47 and OEM bundling 0.98. Before the restraints below remove 2.28 points, the gross pull on OT protection is 9.90 points a year.

European law is the first engine. Member states had until 17 October 2024 to transpose the NIS2 Directive, which stretches cyber duties across 18 sectors, manufacturing and waste management among them. Douglas Insights counts roughly 14,900 newly obliged European industrial sites entering OT protection programmes between 2026 and 2030, worth 2.31 points of annual site growth. The original directive covered 6 sectors; NIS2 adds 12 more, so plant operators in sectors such as manufacturing, waste management and postal logistics face cyber duties for the first time.

North American mandates add 1.86 points. Fifteen days after Colonial restarted, on 27 May 2021, the TSA issued its first pipeline security directive, requiring incident reporting to CISA, a round-the-clock cybersecurity coordinator and a gap review within 30 days. Water lags further: an EPA testimony cites a 2021 survey in which only 31% of utilities had identified all OT-networked assets and 22% had fully implemented protections, across roughly 16,000 publicly owned wastewater works. Closing that gap at even 2,000 additional US water and wastewater sites a year adds about USD 76.6 million of annual spend at the USD 38,300 band.

Ransomware is the largest single contributor at 2.47 points. Dragos counted 119 ransomware groups hitting industrial organisations in 2025, up from 80 in 2024, and 3,300 victims, more than two-thirds of them manufacturers. Discrete manufacturing plants that never faced a regulator now buy industrial cybersecurity because a production stop costs more than a sensor rollout. That works out to more than 2,200 manufacturers hit in a single year, while the average manufacturing site in this study spends only USD 78,900 a year on OT protection.

Vendor consolidation adds the last 0.98 points by selling OT protection inside automation and IT contracts. Mitsubishi Electric closed the Nozomi purchase on 28 January 2026, and on 23 December 2025 ServiceNow agreed to buy Armis for USD 7.75 billion in cash. Bundled sensors reach sites that would never run a standalone security tender, especially the 34,100 discrete manufacturing plants already counted as protected, where control-system orders arrive far more often than security budgets.

Which bottlenecks slow industrial cybersecurity rollouts inside running plants?

Three bottlenecks remove 2.28 points from OT protection site growth, led by a 1.12-point drag from the shortage of engineers who understand both control loops and threat hunting. A security analyst who cannot tell a malicious Modbus write from a normal batch change raises false alarms, and plants then switch the tool off; managed services absorb only part of that gap.

Outage windows take 0.74 points. A refinery turnaround comes every 4 to 5 years, and segmentation that re-addresses a control network has to wait for one. Inline industrial firewalls therefore lag passive monitoring by one full maintenance cycle at most process manufacturing sites.

Small-utility budgets take the remaining 0.42 points. Systems serving 10,000 people or fewer make up 97% of US public water systems, according to EPA, and few can fund a USD 38,300 annual OT security line without grant money.

Which OT protection capability makes the money: firewalls, asset visibility, managed detection or remote access?

Network segmentation and industrial firewalls lead OT protection with 32.1% of 2025 revenue, USD 3.34 billion, because every zone-and-conduit design needs hardware at each boundary.

Segmentation and firewalls grow slowest at 8.06% because appliance prices fall as volumes rise. Managed detection and response holds USD 3.05 billion, 29.3% of industrial cybersecurity spend, and grows fastest at 12.17% a year, overtaking firewalls by 2028 because operators rent analysts they cannot hire. Asset visibility and network monitoring earns USD 2.75 billion at a 26.4% share; an inventory is the first purchase because no operator can segment a network it has not mapped. Secure remote access takes USD 1.27 billion, 12.2%, a narrow problem with a clear fix: vendor engineers logging in to a PLC. The four 2035 values sum to USD 27.38 billion, 0.62% below the headline, a gap that reflects mix effects.

Where do pipeline directives, NIS2 and Gulf refinery build-outs concentrate OT security spending?

North America leads OT security spending with 39.4% of 2025 revenue, USD 4.11 billion, growing 9.55% a year to USD 10.22 billion on pipeline, power and water mandates.

Europe follows at USD 2.99 billion, 28.7%, and grows 10.74% to USD 8.29 billion as NIS2 enforcement reaches mid-sized manufacturers. Asia Pacific holds USD 2.28 billion, 21.9%, rising 10.39% a year on Japanese, Korean and Australian utilities and on export factories meeting customer audits. The Middle East grows fastest at 11.63%, from USD 552.2 million to USD 1.66 billion, because national oil companies secure new refinery, LNG and petrochemical trains from day one. Latin America adds USD 333.4 million, 3.2%, growing 9.74%. Africa is the wildcard: USD 156.3 million and 1.5% of industrial cybersecurity revenue today, reaching USD 404.7 million at 9.98%, with mining and grid projects able to swing it either way.

Which vendors win plant-floor security contracts now that Mitsubishi Electric owns Nozomi Networks?

No vendor controls more than 7% of industrial cybersecurity and OT protection; Douglas Insights reckons the top three, Fortinet, Siemens and Cisco, held about 16.8% of 2025 revenue on estimated OT lines.

Nozomi Networks alone equals 0.98% of 2025 market value, which shows how fragmented OT protection remains even after the 28 January 2026 Mitsubishi Electric closing. Armis reported ARR above USD 340 million growing more than 50%, though only part of it sits in plants. Fortinet said OT billings rose more than 25% in the fourth quarter of 2025 and cited a high seven-figure utility contract. Dragos built its position on incident response and intelligence, tracking 26 threat groups. Claroty sells visibility and remote access to hospitals and plants. Siemens, Rockwell Automation and Honeywell sell hardening and monitoring to plants already running their controllers, and Waterfall Security supplies unidirectional gateways for the highest-assurance links.

How much does one protected refinery, substation or water plant pay for OT security each year?

An average protected industrial site paid USD 92,700 for OT security in 2025, and Douglas Insights expects USD 117,600 by 2035 as monitoring contracts turn into managed services.

Bands are wide. A water or wastewater plant spends about USD 38,300; a transport or logistics hub USD 79,800; a manufacturing plant USD 78,900; a power plant or grid control centre USD 131,400; an oil and gas site USD 198,600. Sensors are priced per site or per monitored asset, firewalls per appliance plus an annual support fee, and managed service per site per month. Spend per site climbs 2.41% a year because the second and third tranche of a programme adds detection services, not hardware.

Which pipeline directives, NIS2 duties and ISA/IEC 62443 standards turn OT protection into a compliance line?

Three rule layers convert industrial cybersecurity from a discretionary project into a reportable obligation, starting with NIS2 across 18 sectors from 17 October 2024.

Sector directives come second. TSA pipeline rules dating from 27 May 2021 require CISA reporting and a 30-day review, and US water regulators keep pressing a utility base where 22% had fully implemented protections. Standards come third. The ISA/IEC 62443 series sets requirements for asset owners, product suppliers, integrators and service suppliers across the lifecycle of industrial automation and control systems; tender documents increasingly cite it by number.

Why do managed OT detection contracts outgrow sensor licences when control engineers are scarce?

Managed detection grows 12.17% a year against 10.33% for monitoring licences, because an industrial cybersecurity sensor without an analyst behind it becomes shelfware. A plant needs a 24-hour desk to act on the 5-day containment benchmark; few sites can fund 5 shift analysts. Douglas Insights tallies 27.6% of 2025 revenue in managed service contracts.

What would a second Colonial-scale shutdown, or a stalled NIS2, do to the 2035 OT protection forecast?

The 2035 forecast for industrial cybersecurity and OT protection spans USD 20.53 billion to USD 35.64 billion around a USD 27.55 billion base.

The slower path assumes light NIS2 penalties and stalled programmes after pilots: site growth of 5.31% and spend growth of 1.62%, a 7.02% revenue CAGR to USD 20.53 billion. The faster path assumes another pipeline-scale outage of five days or more and insurers demanding OT controls: 9.74% site growth and 3.05% spend growth, 13.09% a year, USD 35.64 billion. Moving site growth up or down by 1 point shifts 2035 revenue by USD 2.56 billion on average, USD 2.67 billion upward and USD 2.46 billion downward. Consolidation of the Nozomi and Armis kind accelerates the faster path because bundled sensors arrive with each automation order.

Published forecasts run from about 5.75% to 16.5% a year; the 10.21% base lands in the middle because it counts paying sites, not every IT tool sold to an industrial company.

Douglas Exclusive: the protected-site spend ledger

The protected-site spend ledger counts every industrial site paying for OT protection by vertical, then multiplies by its spend band; manufacturing holds 51.1% of sites but 43.5% of value.

The ledger’s finding: oil and gas sites are 8.6% of the count but 18.4% of industrial cybersecurity value, while water sites are 15.9% of the count and only 6.6% of value. Grid owners connecting distributed assets, sized in the Smart Grid Distribution Automation Market report, add about 1,900 protected substations and control centres a year. Water and wastewater is the cheapest site to protect and the slowest to sign.

Which receipts tie 112,400 protected sites to the OT protection revenue line?

The industrial cybersecurity model multiplies 112,400 sites by USD 92,700 to reach USD 10.42 billion, built from 46 country site counts and 1,380 reconciled data points.

Sites come from 5 vertical ledgers, each sized from operator registers and screened against NIS2, TSA and water-sector scope. A supply-side check sums five vendor pools to USD 10.17 billion, 2.37% below the bottom-up figure. Nozomi’s USD 101.7 million and Armis’s USD 340 million ARR anchor the specialist pool; Fortinet’s 25% OT billings growth anchors the firewall pool. The volume leg of 7.62% and price leg of 2.41% multiply to 10.21%.

Sources

1. US Senate Homeland Security and Governmental Affairs Committee Testimony of Joseph Blount, Colonial Pipeline, 8 June 2021 (2021)
2. Mitsubishi Electric Mitsubishi Electric completes full acquisition of Nozomi Networks (2026)
3. ServiceNow ServiceNow to acquire Armis (2025)
4. European Commission NIS2 Directive (2025)
5. US Department of Homeland Security DHS announces new cybersecurity requirements for critical pipeline owners and operators (2021)
6. US Environmental Protection Agency EPA testimony on water sector cybersecurity (2023)
7. International Society of Automation ISA/IEC 62443 series of standards (2025)