Episode 134: Engineers Belong at the Table: Cyber-Informed Engineering and the End of the OT/IT Boundary

Podcast: Industrial Cybersecurity InsiderEpisode: The Air Gap Myth: Why Your Plant Is More Exposed Than You ThinkPub date: 2026-09-30Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationDino sits down with Matt Pike of Rockwell Automation for an honest conversation about why industrial cybersecurity still stalls out inside so many plants, and it has very little to do with technology. Matt walks through his path from onsite IT support at a large automotive manufacturer into OT security, and explains why modern security principles keep colliding with legacy systems that were built to run untouched for fifteen or twenty years. The two dig into the real reason the IT and OT gap has not closed, why CISOs often reach for a familiar tool instead of a strategy, and how Rockwell approaches visibility in a fully vendor agnostic way across Siemens, Honeywell, Emerson and everything else sitting on a plant floor. They also get practical about the pieces most teams skip: secure by design language inside RFQs and integrator contracts, response and recovery plans that almost nobody has written, and the funding question of who actually pays for security when a capital project lands. Matt shares what he is seeing from attackers using AI to speed up reconnaissance and rewrite ransomware around detection, and why the air gap most plants believe in disappears the moment data reaches a historian. His closing advice cuts through the noise: stop buying tools and start with an asset visibility strategy, because you cannot secure what you have never actually seen.Chapters:(00:00:00) Matt Pike's path from IT support into OT security(00:03:00) Why the IT and OT gap still has not closed(00:06:00) When leadership thinks a tool will fix a people problem(00:09:30) Vendor agnostic visibility down to the asset layer(00:11:00) Secure by design on greenfield and brownfield projects(00:14:00) The incident response plan nobody wrote(00:17:30) AI on the plant floor and what it actually requires(00:20:00) How attackers are already using AI(00:22:30) The air gap myth and east/west blind spots(00:27:30) Funding security through the capital projectLinks And Resources:Want to Sponsor an episode or be a Guest? Reach out here.Industrial Cybersecurity Insider on LinkedInCybersecurity & Digital Safety on LinkedInBW Design Group CybersecurityDino Busalachi on LinkedInCraig Duckworth on LinkedInThanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!The podcast and artwork embedded on this page are from Industrial Cybersecurity Insider, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Digital Transformation ViewpointsEpisode: Robert Jackson of Moxa Talks CRA Regulations and OT CybersecurityPub date: 2026-09-29Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationIn this episode, ARC Advisory Group Vice President of Research Larry O'Brien sits down with Robert Jackson, Manager of Corporate Strategic Marketing at Moxa, to examine the rapidly changing landscape of operational technology (OT) cybersecurity and industrial network security. Their conversation centers on the European Union's Cyber Resilience Act (CRA) and what its connection to CE marking could mean for automation suppliers, OEMs, system integrators, and industrial end users worldwide. Jackson breaks down key expectations, including secure-by-design product development, the elimination of default usernames and passwords, software bills of materials (SBOMs), vulnerability management, and long-term security patch support.The episode also explores how Moxa has expanded its cybersecurity strategy beyond individual networking products to an organization-wide approach. We discuss IEC 62443 certification, industrial firewalls, secure routers, deep packet inspection, microsegmentation, vulnerability management, and the challenge of protecting legacy protocols such as Modbus. We also consider the shortage of OT cybersecurity talent and how secure-by-design architectures, automation, AI-assisted operations, and continuous lifecycle governance are turning industrial cybersecurity from a discretionary investment into a business and regulatory imperative.For more information about Moxa, check out their page here: https://www.moxa.com/enFor more info about ARC, contact us here: https://www.arcweb.com/about/contact-usWould you like to be a guest on our growing podcast?Do you have an intriguing or thought provoking topic you'd like to discuss on our podcast? Please contact Our Producer Tom Cabot [email protected] all the episodes here: https://thedigitaltransformationpodcast.buzzsprout.comThe podcast and artwork embedded on this page are from ARC Advisory Group, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: (CS)²AI Podcast Show: Control System Cyber SecurityEpisode: Episode 134: Engineers Belong at the Table: Cyber-Informed Engineering and the End of the OT/IT BoundaryPub date: 2026-09-29Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationThree veterans of critical infrastructure security trace how the field went from arguing that infrastructure was even a target to treating digital risk as an engineering hazard. Ginger Wright, Sarah Freeman, and Marc Sachs define cyber-informed engineering in plain terms, share real examples of consequences engineered out of a system, explain why adversaries already read your engineering documentation, and make the case that engineers don't need to become hackers to belong in this conversation. They close with why engineers should come to Level Zero.Guests: Sarah Freeman (MITRE); Marc Sachs (Center for Internet Security) Host / moderator: Ginger Wright (Idaho National Laboratory)Chapters: 00:00 Welcome and panel introductions 02:52 Why engineering is up first at Level Zero 04:24 From 'not a target' to target du jour 08:03 Y2K to WannaCry: when the OT/IT boundary became fiction 12:28 Engineering out the consequence (NIST 800-82 Rev. 3) 14:31 Why engineers belong at the table 19:01 Digital risk and defining CIE / CCE 22:13 Real examples of designed-out consequences 28:34 Where CIE runs into regulation 32:40 Engineer pushback and 'fighting the scenario' 37:01 Digital risk is just another hazard 40:01 The five whys, and why come to Level ZeroRecorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections."Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back.Questions: [email protected] · Sponsorship: [email protected] Produced by CS²AI (Control System Cyber Security Association International).The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: OT Security Made SimpleEpisode: Cybersicherheit im Krankenhaus: Zwischen Medizintechnik und RestrisikoPub date: 2026-09-29Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationKlaus Mochalski und Silvia Seeger (Cyber Risk Managerin bei Relyens) beleuchten die spezifischen Herausforderungen der Cybersicherheit im Gesundheitswesen. Erfahren Sie, warum Medizintechnik eine Sonderrolle zwischen IT und OT einnimmt und weshalb starre Herstellerzulassungen das Patchen von Altgeräten erschweren.Mehr zum Thema OT Security Made simple findet Ihr auf rhebo.com oder schreibt uns mit Euren Ideen, Fragen oder Gastvorschlägen an [email protected].  The podcast and artwork embedded on this page are from Klaus Mochalski, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: PrOTect It All (LS 27 · TOP 10% what is this?)Episode: Own Your Industrial Airspace: Wireless, Vendors, and the Parking Lot Crane Hack with Scott McNeilPub date: 2026-09-28Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationWork with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep125/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ A wireless engineer sat in a parking lot, connected to a plant's crane anti-collision network, and had everything he needed to stop the cranes inside 20 minutes. Nobody inside the fence ever knew he was there. In this episode of Protect It All, host Aaron Crow talks with Scott McNeil, Industrial Network and Security Architect II at Global Process Automation (GPA), about the part of the OT network most plants never look at: the airspace. Scott has spent more than 20 years in networking and wireless, the last ten of them entirely in OT, and he sits in the integrator's seat, working across every manufacturer's gear without a product to sell. The conversation starts where most plants actually are: one flat network, off the shelf gear on the floor, and no budget. Scott's argument is that the low hanging fruit costs time and effort, not money, and that a stable network is the foundation for everything security asks for later: segmentation, inventory, monitoring, then a firewall between OT and IT. He walks through war driving your own plant, why a hidden SSID is not security, the wild west of industrial wireless protocols, wireless that was abandoned in power plants years ago and is still on the air, and where wireless earns its place. The second half is about vendors and access. Do not take the vendor's word for it, ask the questions before the gear ships, and treat every third party connection as your own exposure. Scott's rule for remote access is simple: this is my house, vendors connect on my terms, every session logged, with an approve or deny button before anyone gets in. Aaron adds the zip tie in the fan story, a backup switch that had silently failed months earlier and nobody knew until monitoring went on, and the two close on shrinking the wireless footprint that leaves your site and on Scott's podcast, The Industrial Wi-Fi Shop. In this episode, you'll learn: Why a stable network comes before any security project, and what to fix first How to war drive your own plant and what a passive scan of your airspace tells an attacker Why hiding the SSID and relying on obscurity is not a control Which industrial wireless protocols are standards based and which are proprietary risk The questions to ask a wireless vendor before you sign How to run vendor remote access on your terms: logged sessions, approve or deny, no standing tunnels Why monitoring finds failures you did not know you had Tune in to hear why your industrial airspace deserves the same design, monitoring, and ownership as any wired connection. About the guest: Scott McNeil is an Industrial Network and Security Architect II at Global Process Automation (GPA), where he helps manufacturers design, secure, and modernize the OT networks that keep critical processes running: architecture, IT/OT convergence, segmentation, resilient connectivity, and industrial wireless. A longtime wireless engineer, he created and co-hosts The Industrial WiFi Shop Podcast with Jeremy Baker, speaks regularly at OT and industrial cybersecurity events, holds a bachelor's degree in Industrial Technology from East Carolina University with multiple wireless and network certifications, and serves on the UNC Wilmington Cybersecurity Advisory Board. Important Links: LinkedIn of Scott McNeil: https://www.linkedin.com/in/americanmcneil/ The Industrial Wi-Fi Shop Podcast: https://industrialwifishop.com/ The Industrial Wi-Fi Shop on YouTube: https://www.youtube.com/@IndustrialWi-FiShop Scott on X: https://x.com/americanmcneil Global Process Automation (GPA): https://www.globalprocessautomation.com/ Learn more about PrOTect IT All: Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep125/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ YouTube: https://www.youtube.com/@PrOTectITAll Email: [email protected] X: https://twitter.com/protectitall Facebook: https://facebook.com/protectitallpodcast To be a guest or suggest a guest or episode, email [email protected]. Please leave us a review on Apple or Spotify: Apple: https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify: https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4The podcast and artwork embedded on this page are from Aaron Crow | Operational Technology & Cybersecurity Host, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: mnemonic security podcastEpisode: Kiss of DeathPub date: 2026-09-28Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationWhat does a 30-year-old timekeeping protocol have to do with taking down a phone network? In this episode of the mnemonic security podcast, Robby welcomes OT security specialist Mikael Vingaard back to the podcast to share some war stories from the world of industrial security. They start off talking about the Network Time Protocol (NTP), a decades-old protocol that still plays a fundamental role in keeping systems synchronised. Mikael shares the story of how renting three servers in Albania accidentally made him one of the country's main sources of NTP traffic, and how shutting them down disrupted an ISP's IP telephony. They discuss what the story reveals about dependencies we may not even know exist, and what incorrect time can mean for industrial systems.They also explore configuration drift in OT environments, where small and often undocumented changes accumulate over long device lifecycles. Mikael shares findings from passive network assessments, including supposedly air-gapped networks that turned out to be connected and discusses how periodic verification can help organisations understand what is actually running in their environments.Finally, they discuss approaches to securely scanning OT environments, testing guardrails around AI and Denmark's push for digital sovereignty.Send us Fan MailThe podcast and artwork embedded on this page are from mnemonic, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Industrial Cybersecurity InsiderEpisode: When Cyber Stops the Line, Safety Is on the LinePub date: 2026-09-23Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationSafety starts with a goal. So should cybersecurity.Craig Duckworth sits down with Shankar Somasundaram, CEO of Asimily and former head of Symantec's IoT business, to explain why plant floor cybersecurity is a safety issue, not an IT expense. They cover why industrial cybersecurity programs stall after the tool is purchased, how to start with a goal instead of a solution, and why fixing the biggest risks first beats trying to secure everything at once.The conversation also covers network segmentation mistakes, AI as both a helper and a new threat to critical infrastructure, protecting legacy OT and IoT equipment without disrupting production, watching traffic inside the plant, what drives cybersecurity maturity, and what OT security market consolidation means for manufacturers.Shankar's three takeaways for your next budget cycle:Cyber risk is safety riskStart with the goalVisibility and fixing the problem are one program, not twoChapters:(00:00:00) Cybersecurity is patient safety, operational safety, plant safety(00:00:45) Meet Shankar and the four pillars behind Asimily(00:03:50) Why OT security projects stall after the tool is purchased(00:06:20) Start with a goal, not a solution(00:09:20) Exposure management and the segmentation myths that slow teams down(00:11:45) AI as enabler and attacker inside critical infrastructure(00:15:40) Collecting data on legacy OT and IoT without disrupting operations(00:18:20) North south, east west, and the flow data most teams skip(00:20:00) Does maturity come from size, budget, or management(00:24:20) Consolidation in the OT market and the advice Shankar leaves behindLinks And Resources:Want to Sponsor an episode or be a Guest? Reach out here.Industrial Cybersecurity Insider on LinkedInCybersecurity & Digital Safety on LinkedInBW Design Group CybersecurityShankar Somasundaram on LinkedInAsimilyDino Busalachi on LinkedInCraig Duckworth on LinkedInThanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!The podcast and artwork embedded on this page are from Industrial Cybersecurity Insider, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: PrOTect It All (LS 27 · TOP 10% what is this?)Episode: Regulation Is the Budget Unlock OT Has Been Waiting For: NIS2, the CRA, and Getting the Basics Right with Tobias NitzschePub date: 2026-09-21Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationWork with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep124/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ NIS2, the EU Cyber Resilience Act, and CIRCIA are converging between now and 2027, and for the first time the law is pushing cybersecurity requirements upstream into product design and supply chain. What does that actually change on the plant floor? In this episode of Protect It All, host Aaron Crow talks with Tobias Nitzsche, Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, about the shift regulation is driving in OT: responsibility moving from the server rooms into the boardrooms, and from the operator to the manufacturer. Tobias makes the case that what gets regulated are fundamentally the basics: risk assessment, asset inventory, cyber hygiene, and detection. The industry has preached these for a decade. Now the law demands them, which makes compliance the business case that finally unlocks long-overdue modernization budget. His advice: do not treat legislation as a paper exercise. Treat it as a utility. The second half is about recovery, the foundation most plants skip. Aaron and Tobias dig into the vendor-install backup that has never been tested, recovery targets that ignore how long a plant really takes to come back, retain values operators tuned for years that live nowhere else, redundant controllers that are not cyber resilience, and vendor SLAs that send a system engineer when you needed a cyber expert. Tobias's practical pattern: keep a replica of your critical systems, restore into the bubble, and be as intrusive as you like there, scanners and all, without touching production. Also in this one: NIS2 Article 20 and personal liability for executives, why a cyber incident does not need a nation state (bad firmware counts), where AI belongs in the Purdue model and where it does not, AI as the daily brief for the one-person water utility, Aaron's Exchange 5.5 story about the week the executives lost their email, borrowing the safety engineers' hazard studies as risk input, and why you should never fire up a wireless pineapple on an airplane. In this episode, you'll learn: How NIS2, the Cyber Resilience Act, and CIRCIA move accountability to executives and manufacturers Why 24-hour incident reporting starts with detection, and why you can't wing it How to reframe your next modernization budget ask around compliance What a real recovery plan needs: tested backups, plant-realistic RPO and RTO, and captured retain values Why redundant controllers protect against failure, not compromise How to test restores and run scanners safely in a replica instead of production Where AI helps an understaffed operator and where it should never take control Tune in to hear how the biggest regulatory wave in industrial cybersecurity history can become the budget unlock OT has been waiting for. About the guest: Tobias Nitzsche is Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, where he translates the fast-moving regulatory landscape, including NIS2, the EU Cyber Resilience Act, and CIRCIA, into how products are designed and projects are delivered for critical infrastructure. Before this role he was ABB's Global Cyber Security Practice Lead, capping more than 20 years across IT and OT security. Having sat on both sides of the table, first delivering cybersecurity services to critical infrastructure operators and now shaping how legislation lands in engineering practice, he brings a combined view of policy, technology, and plant-floor reality that few in the industry carry. Tobias is based in Germany. Important Links: LinkedIn of Tobias Nitzsche: https://www.linkedin.com/in/tobias-nitzsche-37339735/ ABB Energy Industries: https://global.abb/group/en/organization/energy-industries Learn more about PrOTect IT All: Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep124/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ YouTube: https://www.youtube.com/@PrOTectITAll Email: [email protected] X: https://twitter.com/protectitall Facebook: https://facebook.com/protectitallpodcast To be a guest or suggest a guest or episode, email [email protected]. Please leave us a review on Apple or Spotify: Apple: https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify: https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4The podcast and artwork embedded on this page are from Aaron Crow | Operational Technology & Cybersecurity Host, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Casos de Ciberseguridad IndustrialEpisode: 3/4 Acciones de Gobierno y coordinación de la seguridad OT en el sector eléctricoPub date: 2026-09-21Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationEn este episodio se detallan las capacidades clave que se consideran necesarias hoy en día para reducir el riesgo en instalaciones eléctricas industriales. A través de este bloque, examinaremos cómo se toman las decisiones de mitigación en aquellos casos donde no es viable intervenir o parchear determinados activos, analizando el papel que juegan tanto la […]The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Nexus: A Claroty Podcast (LS 32 · TOP 5% what is this?)Episode: Tatyana Bolton on the OTCC and OT CybersecurityPub date: 2026-09-20Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationTatyana Bolton, Executive Director of the Operational Technology Cybersecurity Coalition (OTCC), joins the Nexus Podcast to discuss a new partnership between OTCC and the International Society of Automation (ISA), alongside a joint position paper advocating for the ISA/IEC 62443 standard as the definitive global benchmark for operational technology (OT) cybersecurity.Read more about the partnershipRead the position paper on a unified approach to OT cybersecuritySubscribe and listen to the Nexus Podcast here. The podcast and artwork embedded on this page are from Claroty, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.