Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why CISOs Are Investing in OT Security Now
Transcript
- Lucas: Luna, I want to start with a number: thirty-five billion dollars. That's what Gartner is projecting for global OT security spending by 2027. And just a few years ago, most CISOs at industrial firms would have told you OT security was a niche concern handled by the automation engineers. Luna: Right, the old air-gap assumption. 'If it's not connected to the internet, it can't be hacked.' That idea died hard. Lucas: It didn't just die—it was killed by a series of very specific events. The Colonial Pipeline in 2021 was the first real wake-up call, but that was actually IT ransomware that took down OT operations indirectly. The real paradigm shift came in 2024, when a German wind farm operator had its turbine control systems hijacked remotely—not through the corporate network, but through a third-party monitoring service that had direct access to the SCADA layer. Luna: That case was chilling because it proved that even 'isolated' OT environments have connections we don't always map. Remote maintenance portals, vendor VPNs, even smart sensors that phone home for firmware updates. Lucas: Exactly. And that brings us to the specific incident I want to drill into today. In early 2025, a petrochemical plant on the Gulf Coast—I won't name the company, but it's a mid-cap operator with multiple refineries—suffered a breach that started on a loading dock. Literally, on a loading dock. Luna: Oh, I remember reading about this in the incident report. It was a temperature sensor used to monitor the temperature of chemical railcars during loading. A legacy wireless sensor that had been installed years ago and was never on the OT asset inventory. Lucas: Right. That sensor was connected to a local gateway, which had a cellular modem for 'convenience'—the plant manager wanted to check temperatures from his phone. That modem was the entry point. The attackers used it to pivot into the level 2 control network, then into the distributed control system itself. They didn't cause a spill or an explosion, but they gained enough access to manipulate valve positions. Luna: And the scariest part? The sensor had been deployed by the railcar leasing company, not the plant's own IT or OT team. So it was completely outside the security team's visibility. This is the classic shadow OT problem. Lucas: Shadow OT—I like that term. And it's everywhere. The same dynamic plays out in factories, power plants, water treatment facilities. The traditional model for securing industrial networks is the Purdue Enterprise Reference Architecture, which divides the network into levels—level 0 is the physical process, level 1 sensors and actuators, level 2 controllers, level 3 operations, level 4 the enterprise IT network. The assumption was that traffic flows neatly between levels, and you can firewall them. Luna: But in practice, the boundaries are porous. That sensor on the loading dock was essentially a level 0 device that had a direct cellular connection to the internet, completely bypassing the Purdue model. Lucas: So the question becomes: how do you secure a network when you can't even see all the endpoints? And this is where the conversation has shifted in 2026. CISOs are now buying OT asset discovery tools that use passive network monitoring to fingerprint every device on the industrial network—including devices that were never officially added to the inventory. Luna: I've seen a few vendors in this space. They use deep packet inspection to recognize proprietary industrial protocols like Modbus, Profinet, OPC UA, even older serial protocols converted to TCP. The discovery is completely passive, so it doesn't risk disrupting the control system. Lucas: Right, and that's critical because availability is the top priority in OT. You cannot run an active vulnerability scan against a programmable logic controller that controls a turbine—you might cause a fault. So the security approach has to be fundamentally different from IT. You monitor, you segment, you control access, but you very rarely patch in real time. Luna: And that's why we're seeing a surge in interest in the IEC 62443 standard. It provides a framework for security by design in industrial automation and control systems. More and more engineering firms are requiring their automation vendors to certify their products to IEC 62443-4-1 and 4-2. Lucas: That standard is becoming a de facto requirement in new builds. But the installed base is enormous—there are tens of thousands of legacy controllers out there that were designed before anyone thought about security. They have no authentication, no encryption, and they communicate in plaintext over the network. Luna: So what do you do with those? Rip and replace is not an option for most plants. A single large refinery might have twenty thousand I/O points, and a controller upgrade can cost millions and require a full shutdown. Lucas: That's where micro-segmentation and unidirectional gateways come in. Some vendors now offer hardware diodes—essentially one-way data diodes that allow information to flow out of the control network for monitoring, but prevent any traffic from flowing back in. They're basically optical data diodes; physically impossible for data to go the other way. Luna: That's an elegant solution for read-only scenarios. But what about situations where you need to send commands—say, a remote operator needs to start a pump? Then you need authenticated, encrypted sessions with strict role-based access control. Lucas: And that's exactly what the zero-trust architecture for OT looks like. You never trust the network, you always verify the user and device, you enforce least privilege. NIST just released updated guidance—SP 800-82 Rev 3—that explicitly maps zero-trust principles to industrial environments. Luna: The challenge is that many OT protocols were never designed for authentication. Modbus TCP, for example, has no built-in security. So you have to wrap it in something like TLS or use a gateway that terminates the protocol and re-encrypts it. Lucas: That adds latency, and in some processes, latency of even a few milliseconds can cause problems. But the vendors are getting better. Some modern PLCs and RTUs now support OPC UA with built-in security, and the IEC 61850 standard for substation automation includes strong authentication and encryption. Luna: I think the key takeaway for our listeners—many of whom are in manufacturing, energy, or logistics—is that OT security is no longer optional. It's not just about compliance with NERC CIP or the CFATS program. It's about operational resilience. A cyber attack that stops production costs real money, and in some cases, can endanger lives. Lucas: And regulators are taking notice. The SEC's new cyber incident disclosure rules explicitly cover OT incidents. The EPA has stepped up enforcement of water system cybersecurity. The TSA has updated pipeline security directives. If you're a CISO at a company with physical operations, you need a dedicated OT security program—not just a checkbox on the IT risk register. Luna: And if these conversations are useful for what you're building or running, we should mention that listener support is what keeps this show ad-free and independent. It's a small thing that makes a big difference for us. Lucas: Yeah, if you find value in episodes like this—where we drill into a specific security challenge and what's actually being done about it—you can support the show at buy me a coffee dot com slash fexingo. That's buy me a coffee dot com slash fexingo. Every bit helps us keep digging into the topics that matter for your work. Luna: And we really appreciate it. Now, back to the OT security landscape—one trend I'm watching closely is the convergence of IT and OT security teams. In the past, they were completely separate, but now we're seeing combined SOCs that can monitor both environments. Lucas: That convergence is happening, but it's slow, because the cultures are different. IT security people think in terms of confidentiality, integrity, availability—in that order. OT people think availability, integrity, confidentiality. The priorities are reversed. So a combined team needs to understand both mindsets. Luna: I've seen some organizations create a hybrid role—the OT security engineer—someone who understands both industrial automation and cybersecurity. They're becoming the most sought-after professionals in the field. Lucas: And they command premium salaries, for good reason. If you're listening and you have a background in controls engineering and you've picked up some security certifications, you are in a very strong position right now. Luna: So to wrap up: OT security is no longer a niche. It's a core business risk for any organization that touches physical infrastructure. The threat is real, the regulatory pressure is mounting, and the solutions are maturing. The question isn't whether to invest—it's how fast. Lucas: And that thirty-five billion dollar number? We'll check back in 2027 to see if it was an underestimate. My bet is it will be higher.