You Can’t Automate What You Can’t See: AI Is Racing Into OT Ahead of the Asset Map
Honeywell’s 2026 OT Cybersecurity Benchmark found that 72% of industrial security teams already use AI for threat detection while only 21% hold a complete asset inventory. For maritime operators, where 87% reported a significant OT incident this year, that gap is the whole story.
September 25, 2026 | By The CyberSurv Team | CyberSurv
Ask an industrial security leader to grade their OT program. Odds are you’ll hear a confident answer. Honeywell Technologies asked 603 of them in May and June. Fully 88% described their programs as planned or design-led. Then came the follow-up question. Only 21% could say they hold a complete inventory of their OT assets.
That gap, published September 22 in Honeywell’s inaugural 2026 OT Cybersecurity Benchmark Report, would be worrying on its own. What makes it urgent is the other trend the survey captured. AI is already doing real work inside OT security operations. Put simply, many organizations are handing detection duty to software that’s working from an incomplete chart.
For maritime operators, the stakes run higher still. Here’s what the numbers say, why they matter at sea and how to get the foundation right before you give AI more authority.
Mature on Paper, Partial in Practice
The benchmark reads like a tale of two surveys. On one side sits confidence. Some 92% of respondents place their organizations in the top two tiers of recovery readiness. Another 80% report strong coordination between IT and OT teams.
On the other side sits the fine print. Just 31% call themselves fully recovery-ready. Only 33% have OT fully integrated into a central security operations center. Continuous monitoring of more than three-quarters of connected IoT devices? A mere 20%.
Those blind spots carry a price tag. Respondents averaged 16.2 hours of downtime from their most significant OT incident. Among incident-affected organizations, 21% estimate downtime costs above $100,000 per hour. For 4%, the meter runs past $500,000.
Visibility clearly pays. Among incident-affected respondents with stronger asset visibility, 42% kept downtime to six hours or less. With weaker visibility, only 25% managed that. Root-cause identification showed an even wider spread: 41% versus 10%.
AI Has Already Clocked In
AI isn’t a future project in OT security. It’s on shift right now.
| OT security function | Using AI-enabled tools | Running autonomous or agentic AI |
|---|---|---|
| Threat detection | 72% | 23% |
| Continuous monitoring | 68% | 23% |
| Asset inventory | 59% | 19% |
Most of that AI still assists human analysts rather than acting alone. That’s healthy. However, 99% of respondents expect AI to affect OT security within two to three years. The direction of travel points toward more autonomy. Honeywell’s advice is refreshingly plain. Organizations will need “clear decision rights, human oversight and testing” before AI starts taking action on live systems.
Why the Map Matters More Than the Model
Think of AI detection as a fast, tireless watch officer. Now hand that officer a chart with half the shoals missing. Speed won’t save the ship.
The benchmark hints at exactly this dynamic. Asset inventory is the least mature foundational capability in the survey. Among organizations with strong asset visibility, 22% report autonomous inventory capabilities. Among those with weak visibility, just 8% do. That’s an association, not proof of cause. Still, the logic holds. AI can only baseline, correlate and flag what it knows exists.
There’s a second risk that gets less airtime. Gartner predicted earlier this year that by 2028, misconfigured AI in cyber-physical systems will shut down national critical infrastructure in a G20 country. No attacker required. Picture an autonomous tool misreading an unmapped legacy controller and isolating the wrong network segment. In a plant, that stalls a production line. On a vessel, it could knock a propulsion or cargo-handling system offline mid-passage.
The View From the Bridge
Maritime earned its own spotlight in the report. The picture is sobering.
- 87% of maritime respondents reported a significant OT cybersecurity incident in the past 12 months, versus 73% across the full sample.
- 83% said a significant incident could severely affect safety or physical equipment, compared with 64% overall.
- 17% describe their organizations as fully recovery-ready.
- 47% report a complete or mostly complete asset inventory, against 80% for the full sample.
One honest caveat: the maritime group numbered just 30 respondents. Honeywell therefore labels these findings directional. Even so, they match what we see aboard ships.
The top challenges maritime respondents named will sound familiar to anyone who’s worked a vessel. Limited onboard security expertise and legacy onboard systems tied at 40% each, with intermittent connectivity at 37%. Those constraints are exactly where AI promises the most help. Unfortunately, they’re also where an unsupervised AI can do the most damage. When the nearest OT specialist sits 2,000 miles away and the satellite link keeps dropping, nobody is available to overrule a bad automated call in real time.
The threat backdrop isn’t calming down either. Federal teams recently boarded two US-bound tankers and found malicious cyber activity. This month, ransomware froze cargo operations at the Port of Tanjung Pelepas. Another tanker crew has since reported suspected interference with cargo-tank systems, although Italian authorities have so far confirmed only a malfunction, according to Cydome’s latest bulletin.
Decision Rights Before Autonomy
None of this argues for keeping AI out of OT. Used well, it’s one of the few ways a lean maritime security team can keep pace. The real issue is sequencing. Here’s the order of operations we recommend:
- Finish the map first. Build a complete, continuously updated inventory that reaches past process control into safety systems, bridge and engine-room networks, CCTV, access control and connected IoT.
- Write down who decides. For every AI capability, document what it may do alone, what needs human sign-off and who that human is at 0300 in mid-ocean.
- Test for the wrong answer. Don’t just confirm the AI catches threats. Rehearse what happens when it’s confidently wrong. Make sure systems fail safe.
- Segment around legacy. Where old controllers can’t be patched, compensating controls carry the load. Among faster-recovering respondents, 33% credited network segmentation with cutting downtime.
- Line up expertise early. Arrange shore-side or partner OT support that can be activated quickly, even across patchy links.
That sequence mirrors the Principles for the Secure Integration of AI in OT from CISA and its international partners, which stress governance, human oversight and fail-safe mechanisms.
RiskGuard 365℠ delivers continuous visibility and risk monitoring across IT and OT, giving AI tools a trustworthy baseline to work from. A Maritime Cybersecurity Assessment builds that baseline vessel by vessel and facility by facility. Penetration Testing then proves whether your segmentation actually holds. Meanwhile, our Security Leadership Program helps executives define AI decision rights that boards, insurers and regulators can live with.
Final Thoughts
The Honeywell benchmark doesn’t say industrial security teams are failing. It says they’re confident, busy and partly blind at once. AI can shrink that blindness or amplify it. Which outcome you get depends on whether you give it an accurate map and clear rules before you give it authority. At sea, where help is far away and consequences are physical, that order matters more than anywhere else.
Let’s Explore What’s Possible
Weighing where AI belongs in your OT security program? Start with a clear view of what you’re protecting. Our team can help you map your fleet or facility, define decision rights for automation and build a roadmap that holds up under real operating conditions.
