Breaking Into OT Cybersecurity: Closing the Skills Gap and Protecting Critical Infrastructure

Podcast: PrOTect It All (LS 27 · TOP 10% what is this?)Episode: Breaking Into OT Cybersecurity: Closing the Skills Gap and Protecting Critical InfrastructurePub date: 2026-04-20Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationThe biggest challenge in OT cybersecurity isn’t just technology - it’s people. In this episode of Protect It All, host Aaron Crow sits down with Mike Holcomb to explore one of the most urgent issues facing the industry today: the growing skills gap in OT and ICS cybersecurity. Mike shares his journey from IT into operational technology security and breaks down why more professionals are needed to defend the systems that power energy, manufacturing, and critical infrastructure worldwide. This conversation goes beyond awareness - it’s about practical pathways into the field and how the community is stepping up to make OT cybersecurity more accessible. You’ll learn: Why OT cybersecurity is one of the most in-demand and underserved fields How to transition from IT to OT cybersecurity The biggest barriers newcomers face - and how to overcome them What foundational skills and controls matter most in ICS environments The role of community initiatives like BSides ICS in closing the gap Why training, mentorship, and collaboration are critical for the future Whether you’re looking to break into cybersecurity, pivot your career, or build stronger teams, this episode delivers actionable guidance and inspiration from someone actively shaping the future of OT security. Tune in to learn how to build a career while helping protect the infrastructure the world depends on - only on Protect It All. Key Moments:  03:07 Getting started in cybersecurity 06:33 Early passion for cybersecurity 11:54 Hurricane Katrina aftermath discussion 15:50 Awareness and education on OT security 17:49 First experiences with GRID class 25:07 Early challenges in OT cybersecurity 29:17 Importance of effective communication 35:11 Global expansion of cybersecurity events 39:52 Building a foundation in OT cybersecurity 43:36 Excitement for new CompTIA exam 46:48 Expressing appreciation for community involvement About the guest:  Mike Holcomb is an independent consultant focused on OT/ICS cybersecurity and an educational content creator. Prior to supporting clients full-time through UtilSec, he was the Fellow of Cybersecurity and the OT/ICS Cybersecurity Global Lead for one of the world’s largest engineering and construction companies, providing him with the opportunity to work in securing some of the world’s largest OT/ICS environments, from power plants and commuter rail to manufacturing facilities and refineries. As part of his community efforts, Michael founded the BSidesICS/OT with multiple events planned globally in 2026. He has his master’s degree in OT/ICS cybersecurity from the SANS Technology Institute. Additionally, he maintains cyber security and OT/ICS certifications such as the CISSP, GRID, GICSP, GCIP, GPEN, GCIH, ISA 62443, and more. He was awarded the SANS Difference Maker Award for Practitioner of the Year: ICS/OT Defender for 2025 and BEER-ISAC's Community Builder Award for 2026. He posts regularly on LinkedIn and YouTube to help others learn more about securing OT/ICS and critical infrastructure.  How to connect Mike:  Main Site: mikeholcomb.com LinkedIn: linkedin.com/in/mikeholcomb YouTube: youtube.com/@utilsec Instagram: instagram/_mikeholcomb/ Newsletter: utilsec.kit.com/95e31307f7 BSidesICS/OT: bsidesics.org Connect With Aaron Crow: Website: www.corvosec.com  LinkedIn: https://www.linkedin.com/in/aaronccrow Learn more about PrOTect IT All: Email: [email protected]  Website: https://protectitall.co/  X: https://twitter.com/protectitall  YouTube: https://www.youtube.com/@PrOTectITAll  FaceBook:  https://facebook.com/protectitallpodcast   To be a guest or suggest a guest/episode, please email us at [email protected] Please leave us a review on Apple/Spotify Podcasts: Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Casos de Ciberseguridad IndustrialEpisode: 3/4 Acciones en la Fragilidad Digital IndustrialPub date: 2026-04-20Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationEn este episodio se distingue entre las decisiones que reducen la fragilidad real y aquellas que solo proyectan una falsa sensación de control en sistemas críticos. Analiza el papel fundamental de la gobernanza y define las acciones mínimas que marcan la diferencia en la gestión de una cadena de suministro donde el control es limitado.The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)Episode: Tiffany Wilson on the Security Crisis of Consumer Tech in HealthcarePub date: 2026-04-19Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationTiffany Wilson, the founder of Wilson Inclusive Solutions (WINS), a disability accessibility consulting firm, joins the Nexus Podcast to discuss the proliferation of consumer technology into healthcare infrastructure. This technology—smart speakers that help manage medications or cameras that monitor vulnerable individuals—often handles patient data and safety, and operates in a regulatory void. Wilson advocates for frameworks that manufacturers and distributors can use to protect patient information and safety, given that most of this assistive technology functions as healthcare infrastructure without existing oversight and protection given healthcare technology. Subscribe and listen to the Nexus Podcast here. The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Exploited: The Cyber Truth Episode: The Invisible Attack Surface: Cybersecurity for Embedded SystemsPub date: 2026-04-16Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationEmbedded systems power everything from critical infrastructure to defense systems, yet vulnerabilities in those systems often go unseen and unaddressed. In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and special guests Mario Zuniga and Matt Janson of MITRE to discuss the “invisible attack surface” lurking within embedded and cyber-physical systems. Drawing on their frontline experience in cyber operations and resiliency engineering, Mario and Matt explain why embedded systems demand a fundamentally different approach to cybersecurity. From limited patching capabilities and long system lifecycles to unique hardware and firmware attack vectors, traditional IT security models fall short in these environments. Together, they discuss: Why embedded systems are often overlooked in cybersecurity strategiesHow attackers exploit firmware, hardware interfaces, and air-gapped environmentsThe challenges of securing systems that must remain operational for decadesThe role of MITRE’s embedded threat matrix (ESTEEM) in mapping adversary behaviorWhy resilience—not just prevention—is key to defending critical infrastructure From industrial control systems to national defense, this episode reveals what it takes to secure the technologies that quietly underpin modern society and why the time to act is now.The podcast and artwork embedded on this page are from RunSafe Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Today with ISSSourceEpisode: Securing Packaged SystemsPub date: 2026-04-16Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationIt is easy to think a main control system is secure in a brownfield or greenfield facility. After all, with all the design requirements and connections coming into the DCS, vendors have that all figured out way ahead of time. But what about the packaged systems – or skids – that connect to main system? How secure are they?The podcast and artwork embedded on this page are from Gregory Hale, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Error Code (LS 27 · TOP 10% what is this?)Episode: EP 84: Airports as Critical Infrastructure: OT Security and Operational DisruptionPub date: 2026-04-15Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationAirports illustrate the potential impact of OT attacks that disrupt functionality. Dan Gunter, CEO of Insane Cyber, talks about how industrial environments differ from traditional IT, particularly in their reliance on availability and safety, where disruptions can have significant real-world and financial consequences.The podcast and artwork embedded on this page are from Robert Vamosi, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Industrial Cybersecurity InsiderEpisode: OT Patching vs IT Patching: What's Commonly MisunderstoodPub date: 2026-04-14Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationMost cybersecurity teams treat patching like a universal fix. In manufacturing, that assumption can take down a production line, trigger a safety event, or void the warranty on a $2 million piece of equipment.In this episode, Dino Busalachi and Craig Duckworth break down why patching in operational technology environments is a fundamentally different problem than patching enterprise IT — and why closing that gap requires more than just pushing an update.The bottom line: A firewall is not a patching strategy. Neither is hoping your systems are isolated. Organizations that get this right use risk-based prioritization, lab testing, virtual patching, and real collaboration between IT and OT teams.If you are responsible for a plant floor — or for the people who are — this conversation is for you.🎙️ Industrial Cybersecurity Insider is where C-suite leaders, plant managers, engineers, and security teams come to close the gap between IT and OT.🔔 Subscribe so you never miss an episode.Chapters:(00:00:00) Why assessing OT cybersecurity posture and asset visibility is hard(00:01:00) IT patches constantly, OT rarely does, and why that gap matters(00:03:00) Downtime costs: a broken patch in OT can stop the entire plant(00:05:00) OEM “don’t touch it” policies and warranty pressure(00:08:00) M&A due diligence: buying plants without knowing the cyber condition(00:09:00) CrowdStrike outage example and why agent-based tools are risky in OT(00:10:00) Virtual patching: protecting PLCs and legacy assets you cannot patch(00:14:00) Vendor guidance, upgrade rewrites, and “acceptable risk” decisions(00:17:00) Hidden exposure: guest Wi‑Fi, tablets, remote access, and “air gaps”(00:20:00) Best practices: inventory, continuous monitoring, vulnerability metrics, and cross-team alignmentLinks And Resources:Want to Sponsor an episode or be a Guest? Reach out here.Industrial Cybersecurity Insider on LinkedInCybersecurity & Digital Safety on LinkedInBW Design Group CybersecurityDino Busalachi on LinkedInCraig Duckworth on LinkedInThanks so much for joining us this week. Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!The podcast and artwork embedded on this page are from Industrial Cybersecurity Insider, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: OT Security Made SimpleEpisode: Ferrari ohne Führerschein? Die richtige Reihenfolge zur OT-Sicherheit für CEOs | OT Security Made SimplePub date: 2026-04-14Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationKlaus Mochalski & Erwin Kruschitz (anapur AG) diskutieren den Wert von NIS2. Erfahren Sie, warum Angriffserkennung nicht der erste Schritt ist, wie Sie Compliance-Blindleistung vermeiden und weshalb OT-Security zwingend bei der Geschäftsführung beginnen muss. Mehr zum Thema OT Security Made simple findet Ihr auf rhebo.com oder schreibt uns mit Euren Ideen, Fragen oder Gastvorschlägen an [email protected].  The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: ICS Arabia PodcastEpisode: Digital Twins in ICS/OT (Arabic)Pub date: 2026-04-12Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarization🎙️ Just had an interesting chat with Nebras ALQURASHI on our YouTube podcast: "Digital Twins in ICS/OT". Nebras, an OT cybersecurity book author, course author and creator of Neuro Twin, shared his expertise on leveraging digital twins for industrial security. Dive into the discussion now !The podcast and artwork embedded on this page are from ICS ARABIA PODCAST, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: PrOTect It All (LS 27 · TOP 10% what is this?)Episode: OT Risk Management That Works: Asset Visibility, Risk Quantification & CISO-Level StrategyPub date: 2026-04-13Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationYou can’t manage risk you can’t measure - or even see. In this episode of Protect It All, host Aaron Crow sits down with Nicholas Friedman to explore how organizations can move beyond compliance and build real, measurable cybersecurity programs across IT and OT environments. With experience spanning banking, aerospace, and critical infrastructure, Nicholas shares how risk management principles translate across industries - and why understanding business context is critical to protecting operational systems. This conversation dives into one of the biggest challenges in OT today: asset visibility and risk quantification. From outdated spreadsheets to modern automation, Aaron and Nicholas break down what it actually takes to understand exposure, justify investment, and communicate risk at the board level. You’ll learn: Why asset inventory is the foundation of OT security How to move from compliance checklists to real risk reduction The importance of risk quantification for CISOs and executives How to communicate cybersecurity in business and financial terms The role of automation and knowledge transfer in scaling security programs Lessons from banking and aerospace applied to utilities and critical infrastructure Whether you’re leading a cybersecurity program, managing OT environments, or presenting to the board, this episode delivers practical strategies to align security with business value and measurable outcomes. Tune in to learn how to turn cybersecurity into a risk-driven, business-aligned strategy - only on Protect It All. Key Moments:  05:14 Understanding business risk basics 08:40 Building effective OT cybersecurity teams 13:26 Challenges with aging IT and OT systems 14:19 Organizing IT and OT assets 18:31 Understanding OT and IT risks 21:53 Evaluating security risks and priorities 25:31 Improving asset deployment and management 29:14 Evaluating and prioritizing risks 31:12 Shifting focus to success plans 35:59 Selling tech that delivers results 37:22 Hands-on approach to cybersecurity 42:39 Challenges with NERC audit processes 44:47 Balancing compliance and security 49:45 Challenges in power utility operations 51:55 AI, OT, and risk management 56:31 Importance of early compliance planning About the guest :  Nicholas Friedman is an enterprise risk and governance leader with 25+ years of experience across Fortune 500 companies and government sectors. He specializes in integrated risk management, compliance, and AI governance - helping organizations build scalable frameworks that align security, risk, and business resilience. How to connect Nicholas Friedman :  Linkedin :  https://www.linkedin.com/in/nicholasfriedman/ Website : https://www.templarshield.com/ Connect With Aaron Crow: Website: www.corvosec.com  LinkedIn: https://www.linkedin.com/in/aaronccrow Learn more about PrOTect IT All: Email: [email protected]  Website: https://protectitall.co/  X: https://twitter.com/protectitall  YouTube: https://www.youtube.com/@PrOTectITAll  FaceBook:  https://facebook.com/protectitallpodcast To be a guest or suggest a guest/episode, please email us at [email protected] Please leave us a review on Apple/Spotify Podcasts: Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4The podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.