Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Using OT Security Platforms
Transcript
- Lucas: Luna, you know how we talk a lot about enterprise IT security — endpoints, cloud, identity. But there is a whole other world of systems that run physical stuff: power plants, water treatment, chemical refineries, manufacturing lines. And for a long time, those systems were air-gapped, running on proprietary protocols, and barely connected to the internet. Luna: Right — operational technology, or OT. And that air gap has been eroding fast. Now those same industrial control systems are connected to IT networks, often through IoT gateways or remote access solutions. Lucas: Exactly. So the attack surface has expanded dramatically. And the stakes are different. If someone breaches your CRM database, that is bad. If someone hits the PLC controlling a chemical reactor, you could have a physical explosion. That is the cyber-physical risk. Luna: And that is why we are seeing a whole category of OT security platforms emerge. Vendors like Nozomi Networks, Dragos, Claroty — they focus specifically on monitoring industrial protocols, building asset inventories of programmable logic controllers, and detecting anomalies in real time. Lucas: Right. And the market is growing fast. I saw a projection that the global OT security market could hit $25 billion by 2027. That is up from maybe $15 billion today. So enterprises that own critical infrastructure are starting to spend seriously. Luna: Let's get concrete. Can you give me a specific deployment — a company that actually rolled one of these platforms out and what they learned? Lucas: Sure. There is a major European chemical manufacturer — I will call them ChemCo for anonymity. They operate 12 plants across Germany, France, and Belgium. Each plant has hundreds of PLCs, RTUs, and SCADA systems running batch reactors, distillation columns, and safety instrumented systems. Luna: So a pretty complex OT environment. What prompted them to invest in a dedicated OT security platform? Lucas: Two things. First, a water treatment utility in the US was breached in 2023 — an attacker gained remote access to a SCADA system and tried to spike the lye concentration. That got a lot of attention in the industry. Second, ChemCo's own internal audit found that nearly 30 percent of their OT assets were not inventoried properly. They had ghost devices on the network. Luna: Ghost devices — meaning nobody knew they were there. That is a huge blind spot. So what platform did they choose? Lucas: They went with Nozomi Networks. Deployed passive sensors at each plant that tap into the OT network — no agents, so they do not affect the operational processes. The sensors capture traffic on protocols like Modbus, Profinet, and opc ua. Then the platform builds a live asset inventory and uses machine learning to baseline normal behavior. Luna: And what did they find? Any surprises? Lucas: Biggest surprise was the amount of plaintext traffic. Some older PLCs were communicating credentials in the clear over Modbus. Also, they found several engineering workstations that had dual-homed NICs — connected to both the OT network and the corporate IT network, which is a classic bridge for an attacker to cross. Luna: That is the kind of thing you only catch with passive monitoring. So after deployment, they started seeing real-time alerts. Any incidents they detected early? Lucas: Within the first three months, the platform flagged an anomaly at one plant — a PLC that controlled a cooling water valve started sending unexpected write commands during a non-production shift. Turned out a contractor had plugged in a laptop to run a diagnostic and accidentally triggered a command. The system detected it, alerted the operator, and they stopped it before any physical impact. Luna: So it caught a near-miss. And that probably paid for itself in avoided downtime. What about patching? One of the big challenges in OT is that you cannot just patch a PLC like you patch a Windows server — it might require a production shutdown. Lucas: Exactly. ChemCo's approach was to use the platform to segment the network and apply virtual patching — basically intrusion prevention rules that block the exploit traffic without touching the PLC firmware. They also implemented a change management workflow where any firmware update has to go through a simulation test before deployment. Luna: That makes sense. But I wonder — does the platform also help with compliance? I know that industries like chemicals and energy have regulations around NERC CIP or IEC 62443. Lucas: It does. The Nozomi platform includes compliance dashboards that map events to specific standards. ChemCo was able to automate some of their reporting for the German BSI's critical infrastructure requirements. That saved their compliance team about 200 hours per quarter. Luna: So it is not just about security — it is also about operational efficiency and compliance. That probably makes the business case easier. Lucas: Exactly. And look, I think this is a trend we are going to see accelerate. As more industrial companies connect their OT to IT — for predictive maintenance, remote monitoring, supply chain integration — the attack surface grows. And regulation is tightening. The EU's NIS2 directive explicitly covers operators of essential services, which includes chemical plants and power grids. Luna: But there is a talent gap, right? Finding security engineers who understand both IT and OT is tough. Most IT security people do not know Modbus from a hole in the ground. Lucas: True. ChemCo addressed that by training two of their existing OT engineers on the security platform. They did not try to hire new people. They said it was easier to teach security fundamentals to someone who already understands the process than to teach process engineering to a security analyst. Luna: That is a smart strategy. So if I am a CISO at a mid-size manufacturer, what is the first step? Should I go out and buy a platform tomorrow? Lucas: First step is asset discovery. You cannot protect what you cannot see. Do a network scan — passive is better — to find every PLC, RTU, and controller on your floor. Then you need to map the data flows. Once you have that baseline, you can evaluate platforms. But do not skip the inventory step. I have seen companies buy a million-dollar platform and then realize they do not even know how many devices they have. Luna: That is a classic mistake. And speaking of best practices — we should mention that some of the insights we share on this show come from our own research and conversations with practitioners. If you find these discussions useful for what you are building or running, there is a small thing you can do. Lucas: Yeah, a handful of listeners already chip in monthly through buy me a coffee dot com slash fexingo. That is literally what funds us making this many episodes — no ads, no sponsors. Just people who find value in the show. Luna: It is a simple way to keep the conversation going and ad-free. And we really appreciate it. Lucas: So back to OT security. I think another big development is the convergence of IT security tools with OT platforms. For instance, Splunk and Nozomi have an integration that brings OT alerts into the same SIEM. That is where the industry is headed — a unified view. Luna: That makes sense because the attacks themselves are converging. Ransomware groups like Cl0p have targeted OT environments — they hit a Japanese automaker's plant last year and forced a shutdown. Lucas: Right. And those attacks often start in IT — a phishing email, a compromised VPN — then they pivot to OT. So having visibility across both domains is critical. I think within five years, OT security will be considered a standard pillar of any enterprise security program, not a niche specialty. Luna: And maybe the regulatory push will accelerate that. The US TSA has already mandated cybersecurity requirements for pipelines. The EU is doing similar. So compliance will force investment. Lucas: Yeah. And the vendors are responding. Claroty just raised $140 million at a $1.2 billion valuation. Dragos is reportedly preparing for an IPO. This is a hot space. Luna: Last question — for companies that are still air-gapped, is an OT security platform still useful? Lucas: Even air-gapped environments have maintenance laptops, USB drives, and contractor connections. A passive sensor can still detect anomalies. So yes, I would argue it is still useful. The threat is not just external — it can be an insider or a misconfiguration. Luna: Good point. So the takeaway: OT security is not optional anymore. Start with asset discovery, train your own people, and consider a dedicated platform. Lucas: Exactly. And if you are curious about the specifics of passive monitoring or the protocols we mentioned, we can do a deeper dive in a future episode. For now, I think we have given everyone a solid picture of why OT security platforms matter. Luna: Agreed. Thanks for listening, everyone. We will be back with another episode soon.