OT and ICS Cybersecurity: Companies, Startups and Research

Microsoft, IBM and Siemens AG are among the prominent companies working on OT and ICS cybersecurity. Microsoft offers Defender for IoT for asset discovery and network monitoring, while IBM provides industrial threat assessment and incident response. Siemens supplies automation systems and cybersecurity services. Cisco Systems, Honeywell, Google, Schneider Electric and ABB Group also appear among the major organizations active in the field.

FACTS identifies 14 startups overall, with Salvador Technologies and Stifel Ridge LLC among the specifically described examples. Salvador Technologies is developing OT/ICS cyber-recovery systems, including immutable backup and integrity validation. Stifel Ridge has patents describing an independent device for monitoring bidirectional IT and OT traffic. These profiles indicate areas of activity, not a ranking or assessment of commercial performance.

The U.S. National Institute of Standards and Technology, Idaho National Laboratory and the Norwegian University of Science and Technology are notable research organizations in FACTS. NIST develops relevant cybersecurity guidance, Idaho National Laboratory works on OT risk modeling and hands-on training, and NTNU researchers have evaluated protocol-aware software-defined networking enforcement for IEC-104 smart-grid networks.

FACTS records $314,507,350 across 203 grants since 2020. This is an aggregate funding figure associated with the topic data, not a verified total of capital dedicated exclusively to OT and ICS cybersecurity. The listed funding-round entries also include broad infrastructure and AI investments, so they should be assessed individually before being treated as sector-specific financing.

ABB Schweiz AG leads the listed patent holders with 21 patents in the topic data. Rockwell Automation follows with 19, and Siemens AG has 17. Honeywell is listed with 11, while Samsung and Schneider Electric Systems, USA Inc. each have 7. These counts reflect the patent-holder list in FACTS rather than a complete measure of each company’s overall intellectual property.

Patent activity is down 40% in the stated comparison, with 312 patents in the 24-month window. Publication activity moved in the opposite direction: 2,333 publications were recorded last year, up 15.6%. The divergence suggests continued research output alongside weaker recent patent activity, though those measures capture different kinds of innovation and should not be treated as interchangeable.

Two recent examples are Gachon University’s TGLDA research and Marlink’s maritime OT security offering. Published in October 2026, TGLDA uses tail-guided augmentation of rare normal data to address degradation in industrial anomaly detection. Marlink launched its OT Security offering for maritime and land-based industries in August 2026. Together, they illustrate movement in both detection methods and operational security services.

The main approaches are asset visibility and monitoring, network segmentation, endpoint and controller protection, identity and remote access, threat detection and response, and vulnerability and resilience management. They address different layers of risk: discovering systems, limiting pathways, protecting devices, controlling access, finding threats and preparing for recovery. The trade-off is that controls must reduce exposure without interrupting industrial operations.

FACTS identifies applications in buildings and public infrastructure, electric power, manufacturing, water and wastewater, transportation and maritime, and oil and gas. These environments use industrial control systems to manage physical processes, so cybersecurity needs to account for both digital threats and operational consequences. The application data lists 6,132 documents for buildings and public infrastructure, 5,951 for electric power and 4,231 for manufacturing.