Walk the Floor: Why Your Asset Count Is Wrong

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep131/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ Kevin Kumpf started out strapping steel under gantry cranes, found the crane control systems had never been updated, and has worked in OT security ever since, including leading OT security at a large US utility. He and Aaron spend this episode on the things that do not show up in a tool: safety culture, knowing what good looks like, and walking the floor. Why an IT data center would never post a "days since last incident" sign, and why OT treats safety as the job. Two engineers at one plant who count 50 and 200 control cabinets. Ten engines on one ship, one running different. Why plants protect the most expensive asset instead of the most critical one, and the five-cent part nobody budgets for. Then data and AI: a boiler tube failure spreadsheet that decided outage plans without ever being on a critical asset list, why AI without context is just numbers, and why a human who can check the work still matters. Aaron's zip tie that left a core switch failed for months, the only backup server sitting next to a space heater, and how to sell OT security to the business: uptime, reliability and competitive advantage, done securely. Key takeaways Count it yourself. If two people at the same plant give you 50 and 200, you do not have an inventory, and a tool will not settle it. Know what good looks like. A baseline of temperatures, flows, RPMs and who talks to whom is what makes the odd one out visible. Criticality is not price. Ask what stops production, including the small part and the small site on the same network. Walk the floor and ask what the red light means. If nobody knows, find out or remove the light. AI needs context and a human who can check its answer. Lead with uptime and reliability. Security comes along with it. Chapters 0:00 Intro 0:22 Welcome and introduction 1:58 From strapping steel to crane controls 3:16 Hard hats and safety culture in OT 6:08 Days since last incident: IT vs OT 6:58 A sticker for every year without an incident 8:29 No shortcuts to safety 9:54 Teaching IT people the safety mindset 13:11 No-judgment zone: who knows their baseline? 15:39 50 cabinets or 200: asset counts that disagree 17:17 Who controls the plant, and knowing your baseline 21:17 You have to know what good looks like 22:41 Ten engines, one running different 23:49 The most expensive asset is not the most critical 25:03 The boiler tube failure spreadsheet 28:04 Excel, history and data in context 30:57 If the AI says 42 33:42 Data versus information 36:17 The cloud and trust but verify 40:47 Firewalls, passive monitoring, people and process 42:41 Enterprise IT tools in a plant, done the OT way 44:58 One zip tie and a failed core switch 48:03 The backup server next to the space heater 50:48 Protecting the device from the human 51:15 What Kevin is building ... Chapters (00:00:00) - Introduction and Guest Welcome(00:01:03) - Kevin's Origin Story in OT/Steel Plant(00:03:13) - Safety Culture in OT vs IT(00:08:30) - Safety Incident Stories and Lessons(00:10:24) - Building Safety Mindset in Teams and Conferences(00:13:06) - Not Knowing Your Asset Baseline(00:17:09) - The Refrigerator Hack and Monitoring Failures(00:21:17) - Knowing What Good Looks Like - Baselines(00:23:39) - Protecting the Wrong Assets - Critical vs Expensive(00:25:18) - Boiler Tube Failure Report - Hidden Critical Processes(00:27:51) - AI, Context, and Data vs Information(00:31:12) - Human in the Loop - Verifying AI and Data(00:33:39) - Data Monetization and Cloud Risks(00:37:16) - Trust But Verify in OT Practices(00:40:31) - Vendor Overpromises and Tool Limitations(00:42:42) - Enterprise IT Tools Applied to OT - War Stories(00:48:03) - Physical Safety and Device Protection Stories(00:51:20) - Safe Testing Environments - Chasm Platform Overview(00:53:31) - Teaching Lessons Through Mistakes(00:56:50) - Closing Thoughts - Selling Reliability Not Just Cybersecurity

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep130/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ You do not need to scare anyone to get OT security funded. Shaun Six, President of UTSI International, makes the case for selling the value instead of the fear. Shaun spent about a decade on the operator side before his company fell into cybersecurity, and he and Aaron cover the ground in between: who is leaving the OT workforce and who is coming in, losing engineers to venture-funded apps, where to put the X and what OT expertise is actually worth, a one-page budget the board will read, and why a water district's cyber budget competes with a police cruiser. The last third is post-quantum readiness for long-lived control systems: pair the retiring expert with a junior, and build the inventories, including a cryptographic bill of materials, while you are out in the plant. Key takeaway You do not need to scare anyone to get OT security funded or understood. Put what you spent, what you got and what you are asking for on one page. Pair the people who are about to retire with the people who are just arriving and have them do the inventory together. And while you are out there, build the lists (including cryptographic) that tell you what is actually in the plant. Chapters 0:00 Intro 0:19 Welcome and introduction 0:55 From oil and gas operator to CEO: how UTSI fell into cybersecurity 2:16 Deploying connected equipment, and learning the exposures later 3:54 Aaron: learning from the intern, and "stop when unsure" 7:34 Why OT people are humbler: the risk profile starts with people 9:33 The workforce gap: who is leaving and who is coming in 11:12 Quantum at the conference: a myth on one side, a research team on the other 12:46 Losing engineers to venture-funded apps 13:42 Getting people into OT: Mike Holcomb, ICS Village and community colleges 15:49 Entry level with five years of experience 17:00 Physical I/O on the show floor, and the pay problem 18:22 Maslow's hierarchy and the 16 critical infrastructure sectors 20:33 The value gap: the expert with the hammer, and the five-day assessment 24:38 Where to put the X, fixed price, and the three-day fix 26:57 Quantifying the value: a trusted advisor, not selling fear 28:42 The one-page budget for the board 29:42 Water districts and city council budgets 31:08 Selling availability and reliability, not "cyber" 33:09 Cyber safety is physical safety: educating the board 34:30 Water: a lower-cost assessment for utilities 36:07 How Shaun got into quantum: the box he could not test 37:29 A book for CISOs: quantum and cryptography for non-specialists 38:51 Why AI and quantum are accelerating each other 41:59 Timelines for post-quantum plans 43:47 "Moore's law is dead" and the book behind the term 44:06 Aaron: what should listeners ask their boards this budget season 45:01 Insurance, assessments and standard frame... Chapters (00:00:00) - Introduction to Sean and UTSI(00:00:56) - Sean's Background in OT and Cybersecurity Origins(00:03:46) - Lifelong Learning and Valuing All Voices(00:06:30) - OT Safety Culture and Questioning Attitude(00:07:11) - Knowledge Gap and Aging Workforce in OT(00:11:03) - Quantum Readiness Awareness Gap in Industry(00:12:52) - Attracting Talent and Competing with Tech Salaries(00:14:09) - Training Programs and Bridging Entry-Level Gaps(00:18:04) - Maslow's Hierarchy and the Value of Critical Infrastructure(00:20:21) - Quantifying Expert Value - The X Marks the Spot(00:24:40) - Fixed Pricing, ROI, and Justifying Cyber Spend(00:28:20) - Building a One-Page Budget for the Board(00:29:32) - Water Utilities and Underfunded Infrastructure Risk(00:35:37) - Deep Dive into Quantum Computing Risks(00:38:34) - AI Acceleration of Quantum and Cryptographic Attacks(00:44:09) - Practical Steps: Assessments, Bills of Material, and Frameworks(00:48:02) - Resources, Talks, and Closing Thoughts

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep129/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ The small water utility down the road cannot afford a big consultancy, and it still has to be defended. Erin Burns is building a company around that problem. Erin is an Army veteran with roughly two decades in cyber operations and the founder of EVR:RDY Defensive Operations Group. He and Aaron take on the question every transitioning veteran asks, how do I get into OT, and the problem behind it: automation is closing the entry-level door just as small utilities need defenders most. They get into hiring troubleshooters instead of job reqs, engineering a low-cost data diode, why a tool nobody runs is worse than no tool, the air gap myth, and how Erin's team weaponized sneaker net to get packet capture out of sites that will never allow remote access. Key takeaway The utilities that cannot afford a big consultancy still have to be defended. If you mandate a standard, fund it, and build the people pipeline the same way you build the product: with problem solvers, hands-on apprenticeship and tools small operators will actually use. A tool nobody uses is worse than no tool. Chapters 0:00 Cold open 0:25 Intro 0:46 Meet Erin Burns 2:26 The question every transitioning vet asks 3:23 Hard hats and factory floors 5:43 Automation is closing the entry-level door 8:03 Ignore the job req 11:06 A pilot with local water sites 12:17 Automate to lower the noise floor 14:19 No juniors means no seniors 16:36 The operator wearing every hat 17:55 Engineering a low-cost data diode 19:28 Dave's network and the XP box 21:44 School lunches, police cruisers and cyber 26:19 A tool nobody runs 27:11 Why investors hate this model 28:53 The cellular modem nobody questioned 30:51 How many air gaps have you seen? 34:38 The historian under the tablecloth 36:31 What do you do with packet capture? 39:50 The air gap myth 46:04 Two different runbooks 49:50 Who defends the sites that can't pay? 53:57 Where to find Erin and EVR:RDY 55:20 Outro About the guest Erin Burns is an Army veteran with roughly two decades in cyber operations and defensive work, and the founder of EVR:RDY Defensive Operations Group, a company focused on affordable OT/ICS defense for critical infrastructure operators with limited budgets and resources. He came up through special forces support and early military cyber, became a cyber warrant officer, and by his account spent five years on an Army cyber team defending OT environments, on factory floors and in hard hats. He is now building EVR:RDY around that experience, with a focus on water utilities and other sites that cannot afford commercial tooling. EVR:RDY: https://evrrdy.com EVR:RDY pilot program: https://evrrdy.com/pilots Erin on LinkedIn: https://ww... Chapters (00:00:00) - Cold open: they deserve to be defended(00:00:25) - Intro(00:00:47) - Meet Erin Burns(00:02:26) - The question every transitioning vet asks(00:03:23) - Hard hats and factory floors(00:05:43) - Automation is closing the entry-level door(00:08:03) - Ignore the job req(00:11:06) - A pilot with local water sites(00:12:17) - Automate to lower the noise floor(00:14:19) - No juniors means no seniors(00:16:36) - The operator wearing every hat(00:17:55) - Engineering a low-cost data diode(00:19:28) - Dave's network and the XP box(00:21:44) - School lunches, police cruisers and cyber(00:26:19) - A tool nobody runs(00:27:11) - Why investors hate this model(00:28:53) - The cellular modem nobody questioned(00:30:51) - How many air gaps have you seen?(00:34:38) - The historian under the tablecloth(00:36:31) - What do you do with packet capture?(00:39:50) - The air gap myth(00:46:04) - Two different runbooks(00:49:50) - Who defends the sites that can't pay?(00:53:57) - Where to find Erin and EVR:RDY(00:55:20) - Outro

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep128/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go? Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework. He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell. What you will take away Why trust is something you delegate, not a security control, and how to put a limit on it What Zach's blast radius framework measures: reach, scope crossing, standing privilege, human concentration, automation visibility and recoverability Why the same PLC with the same vulnerabilities is not the same risk on a turbine as it is on an ice machine Why attacks now look like a normal workday from a cloud address, not a foreign IP in the logs Why one any-any rule undoes 477 good ones, and why a firewall starts from deny Why you verify every piece of work an AI agent hands back, however good the prompt was In this episode 5:03 Sleeping under the conference table 8:30 The open proxy everyone borrowed 10:24 From K-12 to defense contracting 12:59 How careers really get built 16:36 Where is the puck going? 23:22 A heat map for the smoker 25:41 Verify everything the agent does 32:31 Attacks that look like a normal workday 34:33 The work laptop on the home network 39:15 Security is never done 41:39 Where the word firewall comes from 43:33 The same failure, five years apart 44:21 What blast radius measures 46:28 The turbine and the ice machine 49:43 When the right account does the wrong thing 51:53 A firewall with one any-any rule 54:08 Where to find Zach's research About the guest Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks. Blast Radius white paper and scoring workbook: https://github.com/ridgestoneco/blast-radius LOLMgmt white paper: https://zenodo.org/records/21255394 Zach on LinkedIn: https://www.linkedin...

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep127/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity. Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table. His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do. What you will take away Why agent sprawl is already here, and why the real question is who owns an agent when the person who built it leaves How to say no to a risky request and still give the business a path, so the work does not go to shadow AI Why you fork a community MCP server and keep only the 20 of its 107 tools you actually need The vendor due diligence question the questionnaire never asks: who can read the key, and can you get the log Why physical segmentation is coming back for truly critical systems, and why OT never left it How security review can finally run at the speed AI-built code is written In this episode 2:42 Plan for when something breaks 6:31 The risks people are ignoring 10:03 Build it yourself and you support it forever 12:51 200 agents to 900 in three months 20:40 Defending at machine speed 21:46 Physical segmentation is coming back 24:06 107 tools and you only need 20 26:46 How the conversation changes by industry 30:11 Still working on the fundamentals 31:17 Third parties and the weakest link 36:25 A guardrail, not a stop sign 41:46 Bring only the data you need 49:30 Did AI write the book? 51:20 Security finally at development speed About the guest Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, a global technology consulting and services firm specializing in cybersecurity, cloud, data and AI, and software development. With more than 25 years of experience in technology, Ben has led enterprise architecture, cybersecurity strategy, regulatory compliance, incident response and large-scale business transformation initiatives. In his dual CTO and CISO role, he helps organizations balance innovation with security, evaluating emerging technologies from both a business and a risk perspective. ProArch: https://www.proarch.com Ben on LinkedIn: https://www.linkedin.com/in/ben-wilcox/ Learn more about PrOTect IT All: Work with Aaron: https://protectitallpod.com/work/

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep126/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ Shadow IT used to be a server in a closet. Today it is Linda from sales uploading confidential quotes to whatever AI tool she found first, and your corporate data leaving with it. Jack Smith has spent more than 25 years in enterprise IT, across infrastructure, networks, datacenters, cloud and incident management, and he hosts the IT Horror Stories podcast. His argument is that AI is not a new problem, it is the latest version of an old one, and that the reflex to block it at the firewall has never worked and will not work now. Aaron and Jack get into where AI genuinely helps, where it quietly does not, and the question of what happens when a system that gives a different answer every time is asked to make a decision that has to be the same every time. What you will take away Why blocking AI tools fails the same way blocking USB sticks and webmail failed The difference between a tool that optimises your work and a tool you hand your work to Why analytics and diagnosis are the strong case for AI, and treatment is not The training gap: staff get GDPR training and security training, and no AI training at all A one question test anyone can apply before pasting company data anywhere In this episode 1:19 Twenty five years, from floppy disks to AI 10:45 Shadow IT used to be a box in a closet 12:31 Why blocking it never works 19:53 You cannot throw people in the deep end 21:48 When a wrong answer can kill someone 25:40 The answer everybody hates: training 27:54 Never give AI your production environment 41:20 Ask who owns your AI policy 44:38 Who actually gets rich 47:08 The Times Square test About the guest Jack Smith has spent more than 25 years working in enterprise IT across infrastructure, networks, datacenters, cloud and incident management. He hosts IT Horror Stories, a weekly podcast about real-world IT incidents, what went wrong, how they were fixed, and what we can learn from them. IT Horror Stories podcast: https://ithorrorstories.eu/ "AI Is The New Shadow IT": https://ithorrorstories.eu/#rant07 Jack on LinkedIn: https://www.linkedin.com/in/franky/ Learn more about PrOTect IT All: Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep126/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ Support the show: https://protectitallpod.com/go/support/podcast YouTube: https://www.youtube.com/@PrOTectITAll Email: [email protected] X: https://twitter.com/protectitall Faceboo...

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep125/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ A wireless engineer sat in a parking lot, connected to a plant's crane anti-collision network, and had everything he needed to stop the cranes inside 20 minutes. Nobody inside the fence ever knew he was there. In this episode of Protect It All, host Aaron Crow talks with Scott McNeil, Industrial Network and Security Architect II at Global Process Automation (GPA), about the part of the OT network most plants never look at: the airspace. Scott has spent more than 20 years in networking and wireless, the last ten of them entirely in OT, and he sits in the integrator's seat, working across every manufacturer's gear without a product to sell. The conversation starts where most plants actually are: one flat network, off the shelf gear on the floor, and no budget. Scott's argument is that the low hanging fruit costs time and effort, not money, and that a stable network is the foundation for everything security asks for later: segmentation, inventory, monitoring, then a firewall between OT and IT. He walks through war driving your own plant, why a hidden SSID is not security, the wild west of industrial wireless protocols, wireless that was abandoned in power plants years ago and is still on the air, and where wireless earns its place. The second half is about vendors and access. Do not take the vendor's word for it, ask the questions before the gear ships, and treat every third party connection as your own exposure. Scott's rule for remote access is simple: this is my house, vendors connect on my terms, every session logged, with an approve or deny button before anyone gets in. Aaron adds the zip tie in the fan story, a backup switch that had silently failed months earlier and nobody knew until monitoring went on, and the two close on shrinking the wireless footprint that leaves your site and on Scott's podcast, The Industrial Wi-Fi Shop. In this episode, you'll learn: Why a stable network comes before any security project, and what to fix first How to war drive your own plant and what a passive scan of your airspace tells an attacker Why hiding the SSID and relying on obscurity is not a control Which industrial wireless protocols are standards based and which are proprietary risk The questions to ask a wireless vendor before you sign How to run vendor remote access on your terms: logged sessions, approve or deny, no standing tunnels Why monitoring finds failures you did not know you had Tune in to hear why your industrial airspace deserves the same design, monitoring, and ownership as any wired connection. About the guest: Scott McNeil is an Industrial Network and Security Architect II at Global Process Automation (GPA), where he helps manufacturers design, secure, and modernize the OT networks that keep critical processes running: architecture, IT/OT convergence, segmentation, resilient connectivity, and industrial wireless. A longtime wireless engineer, he created and co-hosts The Industrial WiFi Shop Podcast with Jeremy Baker, speaks regularly at OT and industrial cybersecurity events, holds a bachelor's degree in Industrial Technology from East Carolina University with multiple wireless and network certifications, and serves on the UNC Wilmington Cybersecurity Advisory Board. Important Links: LinkedIn of Scott McNeil:

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep124/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ NIS2, the EU Cyber Resilience Act, and CIRCIA are converging between now and 2027, and for the first time the law is pushing cybersecurity requirements upstream into product design and supply chain. What does that actually change on the plant floor? In this episode of Protect It All, host Aaron Crow talks with Tobias Nitzsche, Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, about the shift regulation is driving in OT: responsibility moving from the server rooms into the boardrooms, and from the operator to the manufacturer. Tobias makes the case that what gets regulated are fundamentally the basics: risk assessment, asset inventory, cyber hygiene, and detection. The industry has preached these for a decade. Now the law demands them, which makes compliance the business case that finally unlocks long-overdue modernization budget. His advice: do not treat legislation as a paper exercise. Treat it as a utility. The second half is about recovery, the foundation most plants skip. Aaron and Tobias dig into the vendor-install backup that has never been tested, recovery targets that ignore how long a plant really takes to come back, retain values operators tuned for years that live nowhere else, redundant controllers that are not cyber resilience, and vendor SLAs that send a system engineer when you needed a cyber expert. Tobias's practical pattern: keep a replica of your critical systems, restore into the bubble, and be as intrusive as you like there, scanners and all, without touching production. Also in this one: NIS2 Article 20 and personal liability for executives, why a cyber incident does not need a nation state (bad firmware counts), where AI belongs in the Purdue model and where it does not, AI as the daily brief for the one-person water utility, Aaron's Exchange 5.5 story about the week the executives lost their email, borrowing the safety engineers' hazard studies as risk input, and why you should never fire up a wireless pineapple on an airplane. In this episode, you'll learn: How NIS2, the Cyber Resilience Act, and CIRCIA move accountability to executives and manufacturers Why 24-hour incident reporting starts with detection, and why you can't wing it How to reframe your next modernization budget ask around compliance What a real recovery plan needs: tested backups, plant-realistic RPO and RTO, and captured retain values Why redundant controllers protect against failure, not compromise How to test restores and run scanners safely in a replica instead of production Where AI helps an understaffed operator and where it should never take control Tune in to hear how the biggest regulatory wave in industrial cybersecurity history can become the budget unlock OT has been waiting for. About the guest: Tobias Nitzsche is Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, where he translates the fast-moving regulatory landscape, including NIS2, the EU Cyber Resilience Act, and CIRCIA, into how products are designed and projects are delivered for critical infrastructure. Before this role he was ABB's Global Cyber Security Practice Lead, capping more than 20 years across IT and OT security. Having sat on both sides of the table, first delivering cybersecurity services to critical infrastructure operators and now shaping...

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep123/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ AI is a consensus engine, and consensus on the internet is frequently wrong. So what does that mean for the people defending power plants, water systems, and factories with it? In this episode of Protect It All, host Aaron Crow welcomes back Jori VanAntwerp, CEO and founder of EmberOT, for a completely unscripted conversation on AI in OT. Two practitioners who use AI aggressively every day make the case for restraint in exactly the places that matter. Jori explains why human in the loop is non-negotiable: AI shapes a junior's output to look senior without the understanding underneath, so you have to be able to interrogate it. Aaron walks through his own sandbox discipline, where AI gets a folder and not the keys, and nothing goes in that he would not publish on the internet. The conversation then turns to the OT reality behind AI-found vulnerabilities, why an attacker who can reach your HMI or PLC does not need your unpatched CVE, teaching AI your voice with markdown primers, the build-versus-buy MVP trap, the submarine principle for modular defense, and why an operator flipping to manual is still the save of last resort. Underneath all of it is the workforce math nobody is doing on air: if one person plus AI does the work of five, nobody is training juniors, and no juniors today means no seniors in ten years. OT's aging-out workforce is the preview. In this episode, you'll learn: Why AI is a consensus engine, and why that framing predicts where it fails Why human in the loop is not optional for anything that matters How to sandbox AI in real workflows: a folder, not the keys How to rank AI-found vulnerabilities against what an attacker in your OT network can actually do How primers teach AI your voice, brand, and rules The build versus buy trap: if a power company builds its own software, it is now a software company The submarine principle: compartments, modular tooling, and swapping tools without ripping out the estate Why analog fallbacks and operators keep saving critical infrastructure The junior pipeline problem: no juniors today means no seniors in ten years Why the entry-level job for OT cybersecurity is IT Tune in for the most honest AI conversation the show has had, from the people who actually run it in OT. About the guest: Jori VanAntwerp is a two-time cybersecurity founder and CEO who has spent over two decades helping industrial and IT/OT organizations reduce risk, strengthen compliance, and mature the way they defend critical infrastructure. He has held executive and leadership roles at McAfee, FireEye, CrowdStrike, Dragos, and Gravwell before stepping into the founder seat, first at SynSaber and now as the Founder and CEO at EmberOT. The result is a vantage point that runs from the boardroom to the packet capture, from silicon to the cloud. At EmberOT, he is focused on bringing visibility, security, and risk quantification to the critical infrastructure the rest of the world takes for granted. From EmberOT: Want to see what is really happening in your OT environment? EmberOT provides flow-first, passive OT visibility and threat detection without requiring proprietary hardware. Learn more about EmberOT...

Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep122/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ Get your tickets for CYBR.SEC.CON., a two-day cybersecurity conference, here: https://www.cybrseccon.com/ What started with 120 people and a homemade Word flyer has grown into a cybersecurity community of more than 3,000. So what does it take to build a community that can scale without losing its personal connection? In this episode of Protect It All, host Aaron Crow sits down with Michael Farnum, CEO and co-founder of CYBR.SEC.Community, and Sam Van Ryder, co-founder and an OT sales expert, to explore the story behind the growth of CYBR.SEC.CON and the community surrounding it. Michael and Sam share how they went from a grassroots cybersecurity gathering to a thriving community while keeping the relationships and sense of connection that made the event special in the first place. The conversation goes beyond conferences. Aaron, Michael, and Sam discuss the challenges facing people trying to break into cybersecurity and OT, why entry-level opportunities can be difficult to find, and what experienced professionals can do to help develop the next generation of cyber defenders. They also share their hands-on efforts to introduce young people to cybersecurity, including bringing 75 high school students into the community, with plans to reach 150. From hiring and firing lessons to career advice, community building, and the future of OT cybersecurity, this episode offers practical insight for anyone looking to grow their career, build meaningful connections, or help strengthen the cybersecurity workforce. In this episode, you'll learn: How CYBR.SEC.Community grew from 120 people to more than 3,000 What it takes to scale a cybersecurity community without losing its personal feel Why conferences can play an important role in cybersecurity careers How to break into OT and cybersecurity when you're just starting out The challenges surrounding entry-level cybersecurity jobs How community and mentorship can help develop the next generation of cyber professionals What CYBR.SEC.Community is doing to engage high school students in cybersecurity Coming September 15 and 16, 2026 CYBR.SEC.CON 2026 brings the cybersecurity community together again on September 15 and 16 at the George R. Brown Convention Center in Houston, Texas. If you're looking to connect with cybersecurity professionals, expand your network, learn from practitioners, discover career opportunities, and be part of a growing cyber community, CYBR.SEC.CON 2026 is an event worth checking out. Tune in to hear the story behind CYBR.SEC.CON, the people building the community, and why the future of cybersecurity depends on bringing more people into the conversation. About the guests: Michael Farnum is the CEO and co-founder of CYBR.SEC.Community and has worked in IT and cybersecurity since 1994. He founded HOU.SEC.CON. in 2010, which evolved into CYBR.SEC.CON., now attracting more than 3,000 cybersecurity professionals annually. Michael is passionate about cybersecurity community building, workforce development, education, and career development, and is a frequent speaker and podcaster on security leadership and industry trends....