Cyberattack Incident Response in Industrial Control Systems: A Critical Review of Detection-to-Response Approaches

Industrial control systems (ICS) increasingly operate within interconnected information and operational technology environments, where cyber incidents can propagate from communication networks to control functions and physical processes. Conventional incident response remains dependent on analyst judgement, predefined rules and sequential manual activities, potentially causing delays and inconsistency during numerous, rapid as well as technically complex incidents. Although recent research has advanced machine-learning-based detection, anomaly monitoring, security orchestration and automated containment, existing literature remains fragmented across individual stages of the incidentresponse lifecycle. This critical review examined automated cyberattack incident response in ICS through four (4) computational functions: attack detection, attack-vector classification, severity assessment and response selection. Evidence from ICS-security surveys, machine-learning studies, automated-response research, threat-evaluation frameworks, processaware monitoring and relevant standards were synthesized. The review revealed a principal research gap in effectively integrating detection outputs with appropriate and situation-specific response decisions. Hence, existing approaches frequently generated alerts and classifications without adequately incorporating asset criticality, physical-process consequences, response confidence, operational constraints and safety implications of autonomous actions. Accordingly, the review proposed an intelligent response pipeline that transforms heterogeneous security and process features into attack representations, classifies attacks, assigns sensitive severity levels as well as maps incident to appropriate response under explicit safety and human-oversight constraints. Priority research directions included: explainability, adaptive learning, data quality, benchmark limitations, response validation, adversarial robustness and safe autonomy. This synthesis, provided the foundation for developing intelligent computational models that progress from cyberattack detection, severityaware to sensitive incident-response selection in ICS environments.