The $240 Billion Question Nobody in OT Is Answering

Global cybersecurity spending will reach $240 billion in 2026, up 12.5% from $213 billion in 2025. That is not a forecast – it is Gartner’s published projection. The money is flowing. The budgets are approved. The checks are being signed.

And OT security is getting worse.

Dragos tracked 119 ransomware groups targeting industrial organizations in 2025 – a 64% increase from 80 groups in 2024. Manufacturing has been the most targeted industry for five consecutive years, accounting for 27.7% of incidents across critical sectors according to IBM’s X-Force 2026 Threat Intelligence Index. The Jaguar Land Rover ransomware event in September 2025 shut down production for over a month at a reported cost of £882 million ($1.1 billion) – making it the costliest industrial cyberattack in recorded history. Ransomware attacks on manufacturing companies have caused an estimated $17 billion in downtime costs over the last seven years.

Here is the uncomfortable truth that most OT security investments ROI 12 months analyses avoid: the problem is not underspending. The Wiz 2026 CISO Budget Benchmark Report, based on insights from more than 300 security leaders, found that 85% of organizations increased cybersecurity spending in 2025 – and the highest-spending enterprises reported the lowest satisfaction with their security posture. Over half of organizations now run 25 or more security tools.

More money. More tools. Worse outcomes. That is the trajectory.

This article identifies three specific OT security investments that break the pattern – not by adding another tool to the stack, but by eliminating the structural inefficiencies that make every other tool less effective. Each investment pays for itself within 12 months through measurable cost reduction, not theoretical risk avoidance. Each produces a board-ready ROI narrative that translates into continued funding. And each addresses the architectural root cause that 119 ransomware groups are actively exploiting.

If you are a CISO presenting OT security investments to your board in the next budget cycle, these are the three investments you can defend with numbers – and the three your board will fund because they can see the return.

Why Most OT Security Spending Fails the ROI Test

Before examining what works, it is worth understanding why most OT security spending does not produce measurable returns. The pattern is consistent across industries:

The Tool Accumulation Trap

A typical critical infrastructure organization managing IT/OT connectivity operates 4–7 separate security products at each network boundary: a VPN concentrator, a jump server, an SMB proxy, a data diode, point TCP connectors, a session recording tool, and a legacy MFA appliance. Each product was a reasonable purchase at the time. Each solved a specific problem. Together, they create a stack that costs $100K–$260K per site annually in licenses, maintenance, and integration labor – and produces fragmented visibility that attackers exploit at the seams.

The Wiz data confirms this at scale: the organizations that spend the most on security tools are the least satisfied with the results. The reason is structural. Each additional tool adds integration overhead, log normalization complexity, vendor management cost, and operational friction. The marginal security value of tool number 26 is lower than the marginal security value of tool number 5 – but the marginal cost is the same or higher.

The “We Bought a Thing” Problem

Most OT security budget requests follow a pattern: identify a threat category (ransomware, remote access risk, vendor access exposure), procure a product that addresses that category, and report to the board that the risk is “mitigated.” The next quarter, another threat category emerges, another product is procured, and the stack grows.

The board sees a growing line item with no visible improvement in security posture. The CISO cannot articulate which dollar produced which outcome. The budget conversation becomes adversarial – the CISO asks for more; the board asks what happened to last year’s investment.

The solution is not to argue louder. It is to invest differently – in structural changes that produce measurable, demonstrable, board-visible returns.

Investment 1: Vendor Consolidation – Replace 4–6 OT Boundary Products with One Platform

The Problem You Are Paying For

Count the products at your IT/OT boundary. Not the ones in the architecture diagram – the ones actually running. Include the VPN concentrator that handles remote access ($15K–$40K/year in license and maintenance). The jump server that provides RDP to SCADA workstations ($10K–$25K/year). The SMB proxy for bidirectional file sharing ($20K–$50K/year). The session recording tool ($15K–$35K/year). The point TCP connectors for vendor-specific applications ($5K–$15K/year per application). The legacy MFA appliance ($5K–$15K/year).

Now add the hidden costs: 40–80 hours of SIEM integration labor to normalize 4–6 different log formats into a single timeline. 0.3–0.5 FTE dedicated to keeping the products integrated and operational. 3–5 separate vendor contracts to manage, renew, and audit. 5–10 days of operator training per year across multiple product interfaces.

Total annual cost per site: $100K–$260K. For a 10-site organization, that is $1M–$2.6M per year in OT boundary security products alone.

The Investment

Replace the VPN concentrator, jump server, standalone SMB proxy, point TCP connectors, session recording tool, and legacy MFA appliance with a single platform that handles all OT connectivity types through one architecture.

The platform must provide:

• Zero inbound firewall ports (reverse-access architecture)
• Application-level RDP, SSH, and HTTP access with per-session MFA
• Integrated bidirectional file sharing with CDR scanning
• Built-in session recording (video + keystroke) for all session types
• Unified audit trail with single Syslog feed to the SIEM
• Per-workstation/per-application access policies

The data diode stays for flows where regulation mandates physical unidirectional enforcement. Everything else consolidates.

The 12-Month ROI Calculation

Cost Element	Before (Multi-Vendor)	After (Consolidated)	Annual Savings
Product licenses + maintenance	$100K–$260K	$40K–$80K	$60K–$180K
SIEM integration labor (4–6 formats → 1)	$15K–$30K	$2K–$5K	$13K–$25K
Integration/administration FTE	0.3–0.5 FTE ($30K–$60K)	0.05 FTE ($5K–$10K)	$25K–$50K
Training (5–10 days → 2 days)	$5K–$10K	$2K–$3K	$3K–$7K
Total annual savings per site			$101K–$262K

For a 10-site organization: $1M–$2.6M in annual savings.

The platform deployment cost is typically recovered within 6–9 months through eliminated product licenses alone. The SIEM, integration, and training savings accelerate the payback.

The Board Narrative

This is not a security argument. It is a procurement efficiency argument. You are replacing 5–7 products from 3–5 vendors with 1–2 products from 1–2 vendors – while improving security posture (zero inbound ports versus 3–8 open ports, unified audit versus fragmented logs, per-session MFA versus VPN-level authentication). The board understands “fewer vendors, lower cost, better security.” That is the narrative.

EO 14240 (March 2025) directed federal agencies to consolidate procurement. OMB M-25-31 provided specific consolidation guidance. GSA’s OneGov strategy produced 19 enterprise-wide agreements with discounts up to 90%. The consolidation mandate is government policy. OT boundary security is one of the last areas where agencies are still running 5+ products from 3+ vendors to solve what should be a single-platform problem.

Investment 2: Zero-Inbound-Port Architecture – Eliminate the VPN Attack Surface

The Problem That Keeps CISOs Awake

Claroty found that 82% of verified OT intrusions in 2025 used internet-facing remote access tools as the initial entry vector. Not zero-day exploits. Not supply chain attacks. Not sophisticated APT tradecraft. VPN portals with stolen credentials.

Dragos reported that ransomware affiliates in 2025 consistently authenticated into VPN portals using credentials obtained from infostealers, then leveraged RDP and SMB to move laterally toward OT systems. The dwell time for ransomware in OT environments averaged 42 days – meaning the attacker was inside for six weeks before anyone noticed.

Ivanti, Fortinet, Palo Alto Networks, and Cisco all had VPN/firewall vulnerabilities actively exploited in 2024–2025 – many with proof-of-concept exploits publicly available within days of disclosure. Researchers disclosed 670 new OT vulnerabilities in the first half of 2025 alone, with 50% rated Critical or High severity and 21% having public exploit code within days.

Every VPN concentrator at your IT/OT boundary is a target. Not theoretically. Actively. Right now. And the attackers are not using exotic techniques – they are logging in with valid credentials.

The Investment

Replace the internet-facing VPN with a reverse-access architecture: the component inside the OT network initiates all connections outbound (HTTPS 443, TLS 1.2/1.3) to a gateway in the DMZ. No inbound firewall ports. No internet-facing service. No login page to brute-force. No VPN firmware to patch.

The architectural change is specific: instead of opening port 443 (or 1194, or 500/4500) inbound to the OT zone and letting the VPN handle authentication, you flip the connection direction. The OT-side component reaches out to the gateway. The gateway handles authentication and policy. Authorized sessions are pulled inward through the outbound tunnel. The firewall rule is deny-all inbound – permanently, with no exceptions other than regulated diode flows.

An external scan (Shodan, Censys, Nmap) of your OT network returns zero results. There is nothing to scan. Nothing to probe. Nothing to exploit.

The 12-Month ROI Calculation

The ROI of zero-inbound-port architecture comes from three sources:

Source 1: Eliminated VPN patching urgency.

Every VPN CVE for Ivanti, Fortinet, Palo Alto, or Cisco triggers an emergency patching cycle at your OT boundary. Emergency patches mean change control escalation, OT maintenance windows, testing, and deployment – often within 48–72 hours of disclosure because the exploit is public. Each emergency patch cycle costs $5K–$15K in labor and operational disruption. With 4–6 critical VPN CVEs per year, that is $20K–$90K annually in emergency patching. With zero inbound ports, there is no internet-facing VPN to patch. The urgency evaporates.

Source 2: Cyber insurance premium reduction.

Organizations with quantified OT cyber risk models achieved average insurance premium reductions of 23% compared to those relying on qualitative assessments. Zero inbound ports is the single most demonstrable risk reduction an organization can present to an insurer – it eliminates the entire category of “internet-facing OT service exploitation.” For organizations paying $200K–$500K in annual cyber insurance premiums, a 15–23% reduction translates to $30K–$115K in annual savings. Underwriters understand “zero discoverable services” – it is concrete, verifiable, and binary.

Source 3: Eliminated initial access vector for ransomware.

This is the hardest ROI to quantify prospectively – because you are calculating the cost of an event that did not happen. But the data provides the framework: IBM reports the average cost of a data breach at $4.4 million. The JLR industrial attack cost $1.1 billion. Siemens calculates that the world’s 500 biggest companies lose $1.4 trillion per year to unplanned downtime. If your OT security budget is $500K and a single ransomware event costs $4.4 million minimum, eliminating the primary entry vector (internet-facing VPN) represents an asymmetric return.

ROI Source	Annual Value
Eliminated VPN emergency patching	$20K–$90K
Cyber insurance premium reduction (15–23%)	$30K–$115K
Risk reduction (avoided incident cost × probability)	Organization-specific – model with FAIR framework
Minimum quantifiable annual savings	$50K–$205K

The Board Narrative

This is not a theoretical security improvement. It is an architectural change with a binary, verifiable outcome: external scan before versus external scan after. Before: 2–5 discoverable services. After: zero. The board can see the scan results. The insurer can see the scan results. The penetration tester can see the scan results.

And every VPN CVE that drops – every Ivanti advisory, every Fortinet emergency patch, every Palo Alto zero-day – becomes a news headline that reinforces your decision rather than triggering an emergency response. Your peers are patching at 2 AM. Your firewall is at deny-all. That is the kind of investment that boards remember when the next budget cycle arrives.

Investment 3: Unified Session Audit – Turn Investigation Hours into Investigation Minutes

The Problem Hiding in Your Log Correlation

When a security event occurs at the IT/OT boundary, the IR team must answer basic questions: Who connected? From where? To which OT resource? When? What did they do? What files were transferred?

With a 4–6 vendor OT boundary stack, answering these questions requires correlating logs from the VPN (connection event in one format), the jump server (Windows Event Log in another format), the target SCADA workstation (a third format), the file gateway (a fourth format), and possibly a session recording tool (if one was recording that particular session type). Different timestamps, different identifiers, different log retention policies, different query interfaces.

Dragos reported 42 days average dwell time for ransomware in OT environments. That is not a detection speed problem – it is a visibility problem. The attack is visible in the logs. But the logs are in five different systems, and nobody has correlated them into a single timeline.

The operational cost is measured in hours. The average time to reconstruct a single cross-boundary session from fragmented logs is 3–6 hours. For a significant incident investigation involving dozens of sessions, that is weeks of IR analyst time.

The Investment

Deploy unified session audit across all OT boundary connectivity – application access, file sharing, vendor sessions, and data transfers – through a single platform that produces a single Syslog feed with complete session attribution.

The audit must include:

• Named identity for every session (no shared credentials – ever)
• Device posture at time of access (OS, EDR status, patch level)
• Policy authorization record (which policy permitted the session)
• Full session recording (video + keystroke capture) for all interactive sessions
• File transfer records with identity, source, destination, CDR scan result
• Auto-termination records for time-bounded sessions

All of this in one log format, one timeline, one SIEM integration, searchable within seconds.

The 12-Month ROI Calculation

ROI Source	Before (Fragmented)	After (Unified)	Annual Savings
Mean time to investigate one session	3–6 hours	10–15 minutes	2.75–5.75 hours per session
Incident investigations per year (average)	12–24	12–24	–
IR analyst time saved per year	33–138 hours	–	$5K–$21K (at $150/hr fully loaded)
SIEM integration labor (4–6 feeds → 1)	40–80 hrs initial + 20 hrs/yr	4 hrs initial + 2 hrs/yr	$3K–$12K/year
Compliance documentation (4–6 vendor packages → 1)	40–60 hours/year	8–12 hours/year	$5K–$7K/year
Audit preparation (ATO renewal, IG, regulatory)	80–120 hours/year	20–30 hours/year	$9K–$14K/year
Total annual savings			$22K–$54K

These are conservative numbers. They assume no major incident. In the event of a significant breach investigation – where forensic reconstruction across 4–6 systems can consume hundreds of analyst hours – the unified audit savings multiply dramatically.

But the larger ROI is strategic: the CISO who can answer “who accessed the SCADA system at 3:47 AM on Tuesday” in 30 seconds has fundamentally different board credibility than the CISO who needs two weeks and three vendors to reconstruct the same answer.

The Board Narrative

Boards do not understand log formats. They understand investigation speed. Present the before/after: “When an OT security event occurs today, our team needs 3–6 hours to determine who connected and what they did. After this investment, the answer takes 15 minutes. Here is a recording of the session.”

The session recording is the killer feature for board communication. It is not a log entry that requires interpretation. It is a video of exactly what happened. When the board asks “what did the vendor do during that maintenance session?”, you press play. That level of visibility changes the dynamic from “trust us, we checked the logs” to “here is the evidence.”

For regulated industries, the compliance ROI is equally tangible: one compliance package instead of 4–6, one audit trail instead of fragmented logs, one vendor’s documentation instead of five. Every compliance review, ATO renewal, and regulatory audit becomes faster and cheaper.

The Combined Investment: What the Total ROI Looks Like

These three investments are not independent – they compound. Vendor consolidation enables zero-inbound-port architecture (you cannot eliminate the VPN while keeping 5 other products that require network access). Zero-inbound-port architecture enables unified audit (all sessions flow through one platform, producing one log). Unified audit enables the board narrative that funds future investments.

Combined 12-Month ROI Per Site

Investment	Annual Savings (Conservative)	Annual Savings (Optimistic)
1. Vendor consolidation	$101K	$262K
2. Zero-inbound-port architecture	$50K	$205K
3. Unified session audit	$22K	$54K
Total per site	$173K	$521K
10-site organization	$1.73M	$5.21M

These numbers do not include the value of a prevented ransomware incident. At $4.4 million average breach cost (IBM 2025), a single prevented incident exceeds the total investment multiple times over. At $1.1 billion (JLR 2025), the comparison is not even worth making – it is a different category entirely.

The Implementation Sequence

All three investments deploy as a single project – because they are one platform, not three separate purchases:

Phase	Weeks	What Happens	Which Investment
Deploy platform infrastructure	1–4	Access Controller + Gateway; identity integration; test sessions	Foundation for all three
Replace VPN + jump server	5–8	Migrate interactive access; decommission VPN	Investment 1 + 2
Replace file gateway	9–16	Migrate file sharing with CDR; decommission SMB proxy	Investment 1
Replace TCP connectors + harden	17–24	Migrate remaining connectivity; deny-all inbound; compliance docs	Investment 1 + 2 + 3

Six months from kickoff to full deployment. ROI begins in Month 2 when the VPN is decommissioned and the first product licenses are eliminated.

What Separates OT Security Investments That Produce ROI from Those That Do Not

After examining hundreds of OT security budget requests and their outcomes, a pattern emerges. The investments that produce measurable ROI share three properties:

Property 1: They Subtract Products, Not Add Them

Every product you add increases integration cost, operational complexity, and log fragmentation. Every product you remove decreases all three. The highest-ROI OT security investments are consolidation investments – replacing a multi-vendor stack with a single platform. The savings are immediate, measurable, and visible in the procurement records.

If your proposed investment adds a sixth product to a five-product stack, ask yourself: is there an investment that eliminates three products instead?

Property 2: They Produce Binary, Verifiable Outcomes

“We improved our security posture” is not a board-ready outcome. “External scan: zero discoverable services” is. “We reduced investigation time from 4 hours to 15 minutes” is. “We reduced vendors from 5 to 1” is.

The highest-ROI investments produce outcomes that do not require interpretation. The external scan result is zero or it is not. The session recording exists or it does not. The vendor contract count decreased or it did not. Binary outcomes earn board trust because they cannot be debated.

Property 3: They Align with Where Mandates Are Heading

EO 14028, OMB M-22-09, DTM 25-003, the CISA Zero Trust Maturity Model, the NSA Zero Trust Implementation Guidelines, the DoD OT-specific guidance with 84 target-level activities – every major regulatory framework is converging on Zero Trust architecture for OT environments. The FY 2026 NDAA allocated $15 billion for cyber modernization tied to Zero Trust.

Investments that move the organization toward Zero Trust compliance are investments that the next audit, the next ATO renewal, and the next regulatory review will validate. Investments that maintain the legacy perimeter stack are investments that the next compliance cycle will question.

The CISO’s Budget Season Question

Budget season is approaching. The board will ask: “What are we getting for our OT security spend?”

If your answer is “we bought four new tools and our vendor count went from 3 to 7,” the board will hear: more complexity, more cost, unclear results.

If your answer is “we consolidated 6 products into 1, eliminated all inbound ports on our OT boundary, and can now investigate any OT security event in 15 minutes with a video recording of the session – and the investment paid for itself in 8 months through eliminated product licenses,” the board will hear: fewer vendors, lower cost, better security, measurable results.

The three OT security investments ROI 12 months framework in this article is not theoretical. The cost data comes from real OT boundary deployments. The savings calculations use conservative ranges. The timeline is achievable with existing platforms that consolidate reverse-access, file sharing with CDR, and application access with session recording in a single deployment.

The question is not whether these investments produce ROI. The question is whether you make them this budget cycle – or explain to your board next year why the VPN you were patching at 2 AM was the same VPN that 119 ransomware groups were targeting in 2025.

Conclusion: The Math That Changes the Conversation

Global security spending hits $240 billion in 2026. OT ransomware groups grew 64% in one year. The costliest industrial cyberattack in history – $1.1 billion – happened through the same IT/OT connectivity path that most organizations still protect with a VPN and a jump server.

The three investments in this article – vendor consolidation, zero-inbound-port architecture, and unified session audit – do not require new budget categories. They redirect existing OT security spend from a multi-vendor stack that creates gaps into a consolidated platform that closes them. The ROI is not theoretical – it is $173K–$521K per site per year in documented savings from eliminated licenses, reduced integration labor, faster investigations, lower insurance premiums, and eliminated emergency patching.

The board does not need another security tool. It needs fewer tools, fewer vendors, fewer attack surfaces, and faster answers. These three investments deliver all four – and they pay for themselves before the fiscal year ends.

The organizations that made these investments in 2025 are the ones that slept through the last Ivanti CVE, the last Fortinet advisory, and the last Palo Alto zero-day disclosure. Their firewalls were already at deny-all. Their investigation time was already at 15 minutes. Their vendor count was already at one.

The organizations that did not make these investments are the ones that patched at 2 AM, correlated logs for six hours, and presented a budget request to the board asking for another tool to add to the stack.

Which organization are you building?