AI in OT: What It Can Help Fix, and What It Still Needs From Us Some organisations are exploring AI-assisted engineering, predictive insights and automated risk assessments while still working through incomplete asset information, poorly understood connections and uncertainty about who owns what. That creates a tension. The ambition is understandable. There are real opportunities…
The State of OT Defence – Part 5: Your OT Incident Response Plan Needs to Leave the PDF A lot of organisations have an incident response plan. Far fewer have proved that it works in an OT environment. And there’s an important difference between the two. One of the weaknesses I see most often is…
The State of OT Defence – Part 4: Visibility Isn’t the Finish Line Seeing more is useful. Knowing what to do with what you’re seeing is where it starts to make a difference. I see this regularly when organisations start sending OT security data into their Security Operations Centre (SOC). On paper, it makes perfect…
The State of OT Defence – Part 3: Where Should Your Next £1 of OT Security Budget Go? OT cybersecurity budgets are rarely unlimited. There is always something else that could be improved. Another system that needs attention. Another site. Another control. Another risk somebody wants addressed. So one of the most important questions isn’t:…
The State of OT Defence – Part 2: You Don’t Need to Know Everything to Improve Something One of the easiest ways to slow down an OT cybersecurity improvement is to get stuck deciding who owns it. I saw this with a food manufacturer that needed to introduce separation between its IT and OT networks.…
The State of OT Defence – Part 1: Why OT Security Should Start with Consequence Most cybersecurity conversations start with technology. In OT, I think we need to start somewhere else. Earlier this year, I opened the OT Defenders Summit in London with a keynote called The State of OT Defence: From Cyber Controls to…
OT Remote Access is a Trust-Boundary Problem. When OT teams discuss remote access, they often begin with the wrong questions. The conversation quickly turns to MFA, session recording, PAM integration, centralised management, or whether the product claims to follow Zero Trust principles. These features may matter, but they do not explain what kind of remote…
What Does a Realistic OT Cybersecurity Baseline Actually Look Like? What Does a Realistic OT Cybersecurity Baseline Actually Look Like? From Reflection to Action by an OT Cybersecurity Practitioner Across the previous series (Part 1, Part 2, Part 3 & Part 4), I reflected on governance behaviour, visibility gaps, incentives, and the tendency to wait…
Progress Beats Perfection in OT Cybersecurity Progress Beats Perfection in OT Cybersecurity Reflections from an OT Cybersecurity Practitioner Across the previous parts of this series (Part 1, Part 2 & Part 3), I’ve reflected on recurring patterns that shape OT cybersecurity maturity far more than technology alone. Governance structures influence intent. Visibility determines the quality of…
Actions Follow Incentives, Not Policies. Actions Follow Incentives, Not Policies Reflections from an OT Cybersecurity Practitioner In Part 1 and Part 2 of this series, I reflected on how OT cybersecurity maturity is shaped more by governance, visibility, and decision-making than by technology. A third pattern that emerges repeatedly across OT environments is the role…