Cyberattacks on industrial and operational systems create losses that ordinary IT recovery metrics can miss. A recent attack on refrigeration systems at several large supermarket chains in France caused food waste and reduced customer availability, while the financial losses continue to be measured.
The lesson is not that technology teams need another dashboard. They need operational resilience built around actual business outcomes: maintaining critical services, protecting safety and making sound decisions when systems cannot be restored as planned.
- The supermarket refrigeration attacks caused waste and service disruption.
- Claroty’s 2026 survey found 51% of CIOs had experienced cyber-related operational downtime.
- 27% reported their most significant CPS-related incident lasting three to seven days.
- 64% said IT and CPS security governance and risk management were mostly or fully integrated.
- Only 54% were somewhat confident that CPS were adequately covered in continuity plans.
The outage was operational, not merely digital
When an operational environment stops working, the visible failure appears in the physical process. Refrigeration fails. Products are lost. Customers cannot buy what they came for. The cyber incident may be the cause, but the consequence is operational.
Claroty’s survey points to the same pattern at scale. More than half of surveyed CIOs reported downtime connected to a cyber incident involving cyber-physical systems. For 27%, the most significant incident lasted between three and seven days.
The financial impact of such outages is still being measured in the supermarket example. Other attacks, including the Stryker healthcare supply chain attacks and the Jaguar Land Rover cyberattack, have similarly shown that cyber-physical disruption can extend beyond the technology layer.
Three recurring pressures complicate response: the convergence of IT and operational technology, rapid AI adoption and sprawling third-party exposure. As these dependencies multiply, restoring a system is no longer enough if the underlying operation remains unsafe, unavailable or impossible to sustain.
Join continuity planning with operational recovery
Integrating IT and CPS security governance does not automatically produce operational resilience. Claroty’s research found that 64% of CIOs described their IT and CPS security governance and risk management as mostly or fully integrated, yet only 54% were somewhat confident that CPS were adequately represented in business continuity and disaster recovery plans.
That gap matters because conventional IT failover and operational recovery answer different questions. IT failover asks whether infrastructure or applications can be restored. Operational recovery asks whether a critical service can continue, be safely degraded or return to an acceptable state.
The distinction changes the planning unit. A server may come back online while refrigeration, production or another physical process remains interrupted. Conversely, an operational service may continue through manual procedures or segmented safety mechanisms while parts of the technology stack remain unavailable.
Scenarios therefore need to be built around the operation, not merely the architecture. Leaders should identify which services must continue, who can operate them manually, what information responders need and which safety mechanisms remain independent.
Our analysis: assign outcomes to accountable owners
The survey identifies fragmented accountability. Although 39% of respondents said CIOs held primary accountability for operational protection, budget control and oversight remain divided across IT, security and operations.
Unified governance does not mean every decision should move to the CIO. It means the organization should use one risk model across functions. Operations should define the consequence for the service. Security should explain the exposure. IT should lead the technology response. Business continuity should connect those choices to recovery priorities.
The trade-off is explicit: a plan can be technically successful while still failing operationally. Restoring every system in sequence may ignore the service that matters most, while moving too quickly to manual operation may introduce risks that the exercise never tested.
Regular attack drills should therefore evaluate more than technical failover. They should test offline system recovery, manual overrides and segmented safety mechanisms. A useful exercise reveals who has authority to accept partial restoration, how long a workaround can remain in place and what conditions should trigger escalation.
| Decision area | Conventional IT recovery | Operational resilience |
|---|---|---|
| Primary objective | Restore infrastructure or applications | Restore a critical operation safely and sustainably |
| Planning unit | Systems, servers and applications | Services, processes and physical dependencies |
| Recovery options | Technical failover and backups | Technical failover, offline recovery and manual procedures |
| Safety layer | Often treated separately | Built into scenarios through segmented safety mechanisms |
| Success test | Systems return to service | Operations continue or recover within defined safety constraints |
| Accountability | Technology-led restoration | One governance model with coordinated IT, security, operations and continuity ownership |
Who bears the risk when ownership stays fragmented?
Organizations with divided oversight risk leaving the hardest recovery decisions to the people least equipped to make them. Technology teams may have restored a platform, but operations may still lack a safe way to continue the service. Security may understand the intrusion without knowing which physical process is affected. Business continuity may have a recovery target that does not match operational reality.
This is why accountability must be clear without becoming siloed. The CIO can provide unified governance, but the organization still needs operational expertise distributed across the teams that understand the process, the exposure and the recovery constraints.
The meaningful measure of readiness is not whether an exercise ends with every system online. It is whether leaders can continue the critical operation, protect safety and make a defensible decision about partial recovery.
What to watch next
Watch whether continuity plans begin using service and safety outcomes rather than infrastructure recovery alone as their success measures. The confidence gap identified by Claroty’s survey could push the issue beyond the IT function, particularly where an outage threatens revenue, service availability or physical safety.
The next stage of resilience should also be visible in exercises: regular cyber-attack drills, tested offline workflows, functional manual overrides and clearly authorized decisions about when to accept partial service.
Bottom line: operational resilience must survive contact with a physical operation. Test the workaround, name the decision-maker and rehearse the trade-off before an incident forces the choice.
Key takeaways
- Define continuity scenarios around critical operations, not just systems.
- Include offline recovery, manual overrides and segmented safety controls in exercises.
- Use one governance model with clear ownership while distributing operational expertise.
- Measure recovery by continued or safely restored operations, not system availability alone.
- Rehearse the decisions and trade-offs required for partial recovery.
Frequently asked questions
What does operational resilience mean in this context?
It means protecting or restoring critical operations after a cyber incident affects IT and cyber-physical systems.
How many CIOs reported cyber-related operational downtime?
Claroty’s 2026 survey found that 51% had experienced downtime linked to a cyber incident involving cyber-physical systems.
Are business continuity plans covering CPS adequately?
Only 54% of surveyed CIOs were somewhat confident that cyber-physical systems were adequately represented in their continuity and disaster recovery plans.
What should a cyber recovery exercise include?
It should test offline recovery, manual overrides and segmented safety mechanisms, not only conventional IT failover.
Who should be accountable for operational resilience?
Accountability should be unified through governance across CIO, IT, security, operations and business continuity, with clear ownership of outcomes and recovery decisions.