Private Is Not Separate. A Private Network Is Not a Plant Boundary
A trusted connection is only as safe as what it can reach. Follow the private-APN attack path in Poland’s energy sector, examine the engineering questions, and download InnovAKT’s 18-page report.
Different Threats. The Same Operational Consequence.
Why OT resilience should begin with the condition in the plant, not the label assigned to the event. Several generating units disappear from the control-room…
OT Cybersecurity Is Simpler Than You Are Being Told. Here Is the Trick.
The following examples are composites built from recurring patterns across industrial assessments. They do not describe a single customer, site or incident.
When Level 4 Can Reach Level 1, the Diagram Is No Longer the Architecture
Why IIoT, cloud connectivity, remote access, and AI require OT leaders to govern authority paths, not only network levels. The Purdue diagram on the wall may…
The Future of OT Is IT. But OT Must Not Become IT.
Technology convergence is real. Accountability for physical consequences cannot disappear. I know that statement will make some people in OT uncomfortable.
AI Is Closing the Exploitation Gap. OT Must Close the Basics Gap First.
Why faster cyber capability makes operational discipline more urgent, not more complicated. A recent Nexus Connect article frames an important concern…
The Control Room Test: When Cybersecurity Best Practice Meets Operational Reality
What a cloud-connected HMI teaches us about architecture, remote access, and operational accountability. Cybersecurity frameworks tell us what good security…
Private Connectivity, Public Consequences
Why private industrial networks must be verified as trust boundaries, not accepted as security controls. OT consultants, please stop spreading fear.
Water and Wastewater Cybersecurity Research Brief
The most important current development is the FBI and EPA warning issued on July 30, 2026. Since July 27, water and wastewater utilities in at least seven U.S.
When One Remote Path Becomes Seven States of Risk
A water-system operator loses visibility into a remote pumping station. The controller may still be running. The process may still be moving water.
Thirty Water Systems, Seven States, One Warning
Why OT cybersecurity assessments must examine operational exposure, lifecycle risk, engineering authority, and recovery capability.
Before an AI Agent Enters the Control Room, Find Where It Fails
Why operational trust depends on testing the AI, the test environment, and the people responsible for both. An AI agent reviews an abnormal operating…
Industrial AI at the Edge: Govern the Decision Before You Automate It
The closer AI moves to the physical process, the more governance must reflect operational consequences. Thank you to Rich Mason for sharing the White House…
A Protection Relay Is Not Another Endpoint
Why field-level vulnerabilities require an operations-led approach to cyber risk. A new cybersecurity advisory lands in the inbox.
The Paper Stress Test: Why ENISA's New Handbook Will Not Survive Its First Real OT Incident
the OTCISO Newsletter ENISA published its Handbook for Cyber Stress Tests in May 2025. I read it the way I read every new regulatory artifact arriving in the…
The New Operator: Why Agentic AI in OT Needs Architecture We Haven't Built Yet
There is a new operator in your control room. You did not hire them. You did not background-check them. You did not run them through the same training…
The Compliance Trap: Why Audit-Ready OT Programs Can Still Fail Their First Real Incident
Compliance is what your auditor sees...Resilience is what your operators do at 3 a.m. That difference may sound simple, but it is one of the most important…
Two Years On: What My 2024 OT Predictions Got Right, Got Wrong, and Missed Entirely
Most prediction lists in this industry are written to be forgotten. The ones worth writing are the ones you have to live with.
The Orphan in OT Security: Why Building Systems Are Everyone’s Blind Spot
I was in a discussion recently with an OT colleague who has spent his entire career in industrial environments, primarily in the energy sector.
Lessons from the Field: When Pride Turns Into Exposure: How Social Media Posts Risk ICS Environments
Public disclosures about industrial work create risk because attackers can combine small details into an actionable view of an environment.