New study reveals critical gaps in OT cybersecurity across Belgian industry

Belgian industry still faces significant gaps in Operational Technology (OT) cybersecurity. A new Agoria study of 82 Belgian organisations found that only 40% have a complete, up-to-date OT asset inventory. Just 17% have four key security foundations fully in place: IT/OT network segmentation, secure remote access, a formal OT access policy and a complete asset inventory.

The findings point to a clear priority for industrial organisations: move beyond individual security controls and build demonstrable resilience. That means knowing which assets are connected, establishing clear ownership, controlling supplier access, detecting incidents and testing whether production can actually be recovered.

Developed with contributions from Easi and other members of Agoria's CMiB4ICS/OT community, the study examines OT cybersecurity maturity across Belgian industry, including governance, regulatory readiness, detection and recovery.

The Agoria study shows that individual security measures do not always add up to a mature OT cybersecurity strategy.

One of the study's most striking findings is that:

1. only 40% of respondents have a complete and current OT asset inventory,
2. just 19% have a dedicated OT CISO or equivalent,
3. while only 20% combine an organisational cybersecurity framework such as CyberFundamentals or ISO 27001 with IEC 62443 for the production environment.

Individual security measures often look relatively mature when examined separately. For example, 56% of respondents report full IT/OT network segmentation and the same share report secure remote access.

But when the different foundations are combined, the picture changes considerably. Only 25% have segmentation, secure remote access and a formal OT access policy fully implemented. Add a complete asset inventory, and that figure falls to just 17%.

That distinction matters.

Cybersecurity is rarely determined by one individual control. A company may have segmented networks but lack visibility over its assets. It may have remote access technology but not know which suppliers still have access. Or it may have backups without ever having tested whether production can actually be restored.

An up-to-date OT asset inventory helps organisations understand what is connected, identify potential exposure and apply security controls consistently. The Agoria study found that organisations with complete inventories generally have stronger security measures in place.

Among organisations with a complete and current inventory:

• 83% have full IT/OT network segmentation.
• 69% fully apply an OT access policy.
• 92% manage supplier remote access through their own IT or OT teams.

Without an inventory, only 31% report full segmentation, while more than half describe supplier access as vendor-owned, uncontrolled or unknown.

Legacy technology adds to the challenge. Almost half of respondents still operate at least one unsupported Windows version, and two thirds report that their oldest OT device is at least 10 years old.

Replacing industrial equipment is not always straightforward. Production requirements and compatibility constraints can make upgrades difficult, increasing the importance of visibility, segmentation, secure access and appropriate compensating controls.

Detection and recovery remain important weaknesses. Having a plan or backup is not the same as knowing it will work when production is under pressure.

Although 73% of respondents have an incident response plan and 58% have a business continuity or disaster recovery plan, only 24% have extended both to OT.

Detection presents a similar challenge. While 38% believe they could detect an OT attack within hours, 34% have no technical OT detection capability at all. Even among those expecting rapid detection, almost half cannot identify a technical capability that would generate the alert.

Recovery testing is another weak point. Only 31% regularly or partially validate OT backups through actual recovery testing, while 57% rarely or never test them. Tabletop exercises are also uncommon: 26% perform them, while 45% never do.

For industrial organisations, resilience means ensuring that incident response, continuity planning, detection and recovery procedures extend beyond IT and account for the realities of the production environment.

The study suggests that stronger OT cybersecurity maturity is not determined primarily by company size or budget. Implementation, ownership and follow-through make a significant difference.

Among the leading organisations, 63% have IT/OT segmentation, secure remote access, a formal OT access policy and a complete inventory fully in place. Among the remaining organisations, only 20% have all four.

The difference is even clearer in recovery testing: 88% of the leading group test OT backup recovery, compared with just 23% of the other organisations.

The lesson is practical. Mature organisations do not simply invest in security measures; they implement them consistently and test whether they work. Identifying gaps, assigning clear responsibility and validating improvements are essential steps towards stronger OT resilience.

Regulatory requirements are adding urgency to OT cybersecurity. NIS2 addresses cybersecurity risk management and governance for relevant entities, while the Cyber Resilience Act introduces requirements for products with digital elements. The Machinery Regulation establishes requirements for machinery and becomes applicable on 20 January 2027.

For manufacturers, integrators and suppliers, the applicable obligations depend on their activities, products and role in the supply chain. Even organisations outside a regulation's direct scope may face cybersecurity requirements from customers.

The Agoria study found that regulatory readiness remains a challenge. Many respondents are still unsure which regulations apply to them. Among respondents likely to fall within NIS2 scope, only 14% report CyFun® or ISO 27001 conformity.

The challenge is not simply understanding each regulation separately. Organisations need a coordinated approach to governance, risk management and technical security, while verifying which specific obligations apply to them.

The study was developed within Agoria's Cyber Made in Belgium ecosystem, with contributions from members of the CMiB4ICS/OT board.

Gerrit Neyrinck, Cybersecurity Architect IT/OT at Easi and Secretary of Agoria’s CMiB4ICS/OT focus group, was one of the contributors to the study, while Easi’s OT cybersecurity specialists also supported the broader work surrounding the research with practical input from the field.

As Gerrit highlights in the report:

“The overlapping waves of NIS2, CRA, and the Machinery Regulation are placing immense pressure on industrial supply chains. Companies attempting to solve these in silos will pay a high price.”

OT security is not simply traditional IT cybersecurity extended to a factory. Production availability, safety, legacy equipment, industrial protocols and third-party access create specific challenges that require a joined-up approach.

Based on the study's findings, industrial organisations should prioritise: