Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why OT Security Is the Next Frontier for CISOs
Transcript
- Lucas: So it's mid-2026, and for years the cybersecurity conversation has been dominated by IT — endpoints, cloud, identity, email. But there's this whole other world of computer systems that run physical things, and it's becoming the next major front for enterprise CISOs. Luna: You're talking about operational technology — OT. The stuff that runs power plants, water treatment, manufacturing lines, pipelines. Lucas: Exactly. And the reason it's suddenly urgent isn't just more headlines. It's a structural shift. For decades OT was air-gapped — physically disconnected from the internet and from corporate IT networks. But over the last ten years, industrial firms have connected those systems for efficiency, remote monitoring, predictive maintenance. That connection creates exposure. Luna: Right — and the Colonial Pipeline attack in 2021 was the wake-up call. That wasn't even a hack of the pipeline's OT directly. They got in through a legacy VPN account on the IT side, then the ransomware spread enough that the company shut down the pipeline themselves as a precaution. Lucas: That's the paradox. Colonial's actual pipeline control systems were never compromised. But because the IT and OT networks were connected, the company couldn't be sure. So they pulled the plug. And that one decision caused fuel shortages across the entire U.S. East Coast. Luna: And since then, attackers have gotten more sophisticated. Let's talk about the 2025 water-treatment facility breach in Florida — what happened there? Lucas: That case is really instructive. A medium-sized water treatment plant near Tampa had connected its building management system — the HVAC, lighting, that kind of thing — to a single network for remote access. They didn't segment it from the actual process control network. Attackers found their way in through a vulnerable internet-facing controller on the BMS side, then pivoted to the SCADA system that controls chemical dosing. Luna: They manipulated the levels of sodium hydroxide, right? Lye. Lucas: Yeah. They changed setpoints remotely. Luckily an operator noticed unusual valve activity on a dashboard and reversed the changes before any harm reached the water supply. But the incident exposed something uncomfortable: the detection came from a human, not any security tool. The plant had traditional antivirus on its Windows-based SCADA workstations, but no ot specific monitoring. Luna: That seems to be the pattern. According to a Dragos report from last year — I think it was their 2025 year-end review — there are roughly 3.5 million internet-exposed OT devices globally. That's everything from programmable logic controllers to RTUs to safety instrumented systems. Lucas: And many of those devices are running proprietary protocols — Modbus, DNP3, Profibus — designed decades ago with zero security. No authentication, no encryption. The assumption was that if you could physically touch the network, you were authorised. Luna: So then, the question becomes: can you just apply standard IT security tools to OT environments? Endpoint detection, firewalls, network monitoring? Lucas: Short answer: no. And that's been a painful lesson for a lot of organisations. OT devices are often resource-constrained. You can't install an agent on a PLC from 2005 that has 64 megabytes of memory and runs a real-time operating system. The tools have to be passive, non-intrusive, and they need to understand industrial protocols. Luna: That's where companies like Dragos and Nozomi Networks come in. They build specifically for OT — network traffic analysis that can parse Modbus and DNP3, build a baseline of normal behaviour, and then flag anomalies without touching the devices themselves. Lucas: Right. And they've been growing fast. Dragos raised another $200 million in 2024 at a valuation reported at over $1.7 billion. Nozomi has been expanding into the Asian market. But the overall market for OT security is still pretty small relative to the need — maybe $8 billion globally this year, compared to nearly $200 billion for IT security overall. Luna: Which raises a really practical question for CISOs. If you're responsible for both IT and OT in an industrial company, how do you prioritise? Because the consequence of an OT breach can be physical — property damage, environmental harm, even loss of life — not just data theft. Lucas: Yeah, and that's the fundamental shift in risk. The old approach was to keep OT completely separate — the so-called air gap. But that's largely a myth now. A 2024 survey by SANS found that over 70% of industrial organisations have some level of connectivity between IT and OT networks. Once you accept that, you have to start treating OT as an attack surface. Luna: So what does a practical OT security program look like? I imagine it starts with asset inventory — you can't protect what you don't know you have. Lucas: Exactly. And that's harder than it sounds. Many industrial sites have undocumented devices, legacy controllers that haven't been patched in a decade. You need to do network discovery using passive scanning — active scanning can crash older PLCs. Then you segment the network. At a minimum, you create a DMZ between IT and OT with a data diode — a device that physically allows data to flow only one way. Luna: Data diodes have been around for a while in defence and nuclear, but they're becoming more mainstream. They essentially guarantee that if the IT side gets compromised, the attack can't reach the OT side through that channel. Lucas: Right. And then you layer on continuous monitoring with ot specific SOC tools. You implement strict remote access policies — no standing VPNs, just jump boxes with multi-factor authentication. And you do regular tabletop exercises that include OT scenarios — not just ransomware on the file server, but a scenario where an attacker changes a pressure valve setpoint. Luna: That kind of exercise forces collaboration between the IT security team and the plant engineers, who often have very different cultures. IT speaks in terms of patches and vulnerabilities; engineers speak in terms of uptime and safety. Bridging that gap is huge. Lucas: If these conversations are useful for what you're building or running — and you want to keep them ad-free and independent — a handful of listeners chip in monthly through Buy Me a Coffee dot com slash Fexingo. That simple support is what funds making episodes like this one. No corporate sponsors, no ads, just the show and the audience. Luna: Yeah, it's a small group that keeps it going, and it's genuinely appreciated. We keep the focus on the substance. Lucas: Back to OT — one more driver that's accelerating adoption. The SEC's new incident disclosure rules, which took effect in late 2023, require public companies to report material cybersecurity incidents within four business days. But they also require disclosure of policies and procedures for risk management. For industrial firms, that means boards are now explicitly asking about OT security posture. Luna: So it's becoming a governance issue, not just a technical one. We've seen some large industrials — like a major chemical manufacturer last year — disclose in their 10-K that they had identified a specific OT risk and were investing in segmentation. Lucas: That's the kind of detail that would never have appeared in a filing five years ago. And it points to something else: insurance. Cyber insurers are increasingly requiring ot specific controls before writing policies for industrial companies. If you don't have network segmentation and OT monitoring, you either pay a huge premium or can't get coverage at all. Luna: So let's talk about the convergence debate. Some experts argue that true it ot convergence is inevitable — that eventually everything will run on standardised IT platforms with security built in. Others say OT will always be fundamentally different because of real-time constraints and safety requirements. Lucas: I think the truth is somewhere in between. We're seeing convergence at the network layer — more industrial organisations use standard Ethernet and ip based protocols. But at the device level, you still have specialised controllers with firmware that can't be patched on a monthly cycle. The practical path is to adopt a zero-trust architecture that spans both environments, but with different enforcement mechanisms. For OT, zero trust means: never trust the network, always verify the device, and enforce strict micro-segmentation. Luna: And there's a talent dimension too. Finding security professionals who understand both IT and OT is extremely hard. Most CISOs come from IT backgrounds. So we're seeing the rise of dedicated OT security leads — people who might have a background in industrial engineering plus security certification. Lucas: Absolutely. There's a program at Idaho National Laboratory that trains OT security practitioners. And some universities are now offering combined degrees in industrial control systems security. But it's going to take years to scale the pipeline. Luna: One more angle — M&A. When a private equity firm buys an industrial company, they increasingly commission an OT security assessment as part of due diligence. Because a target with poor OT segmentation might have hidden liability that could surface after acquisition. Lucas: That's a great point. We saw that in the 2024 acquisition of a mid-sized European automotive parts manufacturer. The buyer — a large industrial conglomerate — walked away after discovering the target had over 200 OT devices directly accessible from the corporate network with no monitoring. The cost to remediate was estimated at over $30 million. The deal fell through, and the target ended up selling at a significant discount to a different buyer who specialised in post-acquisition security turnarounds. Luna: So OT security is not just a technical issue — it's affecting deal valuations and insurance premiums and board-level reporting. That's a big shift from even five years ago. Lucas: And I think it's only going to accelerate. With critical infrastructure increasingly in the crosshairs of both ransomware groups and nation-state actors — think about the 2025 attack on a Japanese port that shut down container operations for four days — the business case for OT security becomes harder to ignore. Luna: What's the one thing you'd recommend a CISO at an industrial company do this week if they haven't started? Lucas: Do a passive network scan of your OT environment to build an asset inventory. You'll probably find devices you didn't know existed. Then identify which of those have any kind of external connectivity — even if it's just a technician's laptop that occasionally connects for maintenance. That's your starting point. Luna: And if you can't do a scan? Lucas: Then walk the floor with the plant manager. Ask them to show you every network drop, every controller cabinet. The physical walkthrough reveals things no tool will find. That's the old-school approach, but it still works. Luna: It's a good reminder that OT security is ultimately about understanding how things actually work, not just deploying software. Lucas: Yeah. And that's a theme we'll keep coming back to — the intersection of the digital and the physical. Thanks for listening.