On 19 October 2026, CISA's ICS advisory listing showed 4,200 results across 419 pages. Siemens had the most entries at 1,028, then Rockwell Automation at 259 and Schneider Electric at 256. Counts reflect how many advisories were published for a vendor, not how secure its products are.
Method
I read the public listing page at cisa.gov on 19 October 2026 and recorded the total and the vendor facet counts it displayed. I did not download or deduplicate individual advisories, so the figures are page totals as shown that day. The numbers will change as CISA publishes and revises advisories, so check the live page before quoting them.
What the listing contains
The page covers vulnerabilities in industrial control system, OT and IoT products. Entries are ICS Advisories (ICSA) and ICS Medical Advisories (ICSMA), sortable by release date, revision date, relevance or vendor, and filterable by type, year, topic and vendor. Mitigation recommendations on the advisories come from the vendors.
The numbers
- Total results: 4,200
- Pages: 419
- Siemens: 1,028
- Rockwell Automation: 259
- Schneider Electric: 256
Siemens accounts for roughly a quarter of the entries shown, from simple division of 1,028 by 4,200.
How not to read this
- More advisories is not worse security. A vendor with a mature disclosure process and a large product line can publish many advisories. A vendor with few may simply have fewer reports.
- Counts say nothing about severity. One advisory can describe one flaw or many.
- Market footprint matters. Widely deployed products attract more research.
What owners can do with the archive
- Filter by your vendors and review the last year.
- Look at how fast fixes are named in advisories for products you run.
- Set a recurring review so new entries for your inventory are triaged weekly.
- Use the sector and topic tags to find advisories relevant to your industry.
The companion post on reading an advisory covers triage in detail.
Questions the data cannot answer
How many distinct CVEs sit behind these advisories? How many had a fix available at publication? How long did vendors take to respond? Which flaws were exploited? None of these can be read from the vendor counts, and each needs a deeper pull from the advisories themselves.
Limits of this analysis
It is a single snapshot with three vendor counts. A fuller study would pull each advisory, count distinct CVEs, record severities and measure time between disclosure and fix. Without that, avoid ranking vendors.
Why a snapshot still helps
Even a rough count tells a plant manager where advisory traffic is heaviest for their own equipment, which is where triage effort will go. The point is workload planning, not vendor ranking.
Quick check
Does a high advisory count mean unsafe products?
Not by itself. It can reflect product breadth, researcher attention and a vendor's disclosure habits.
Will these numbers stay accurate?
No. They are a snapshot from 19 October 2026. Check the live listing.
Sources
Last reviewed: 19 October 2026.
