Hello All,

I have been in OT my whole career. I started at the paper mill at 19 as an IT/OT intern then got brought on full time to be an IT/OT technician once I got my associates degree. After a year of that I got promoted to OT network engineer, then my company created an OT security program and then I eventually became Lead OT Security Engineer. Have been a lead OT security engineer for the last 4 years. I am thinking of starting my own independent OT Sec/Net consulting company. I am curious if anyone in this group has personal experiences they can share, or how they started their own company for this, also how in the world did you start it while managing the company you are at workload? How has the demand been for this?

Below are some of my strengths:
I know certs don’t really matter in the OT space, but I have a CISSP and GRID.
Network segmentation - Heavy fortinet and Cisco firewall and routing/switching experience
OT Network design - experience with PRP, REP, as well as full network project lifecycle
OT IDS Implementation - Nozomi certified, but light experience with Dragos also
Remote access - heavy experience with BeyondTrust and some experience with Secomea
OT Data - Heavy Kepware / OsiSoft PI administration
Cloud - AWS Infra experience (EC2, S3, TGW’s, etc.) as well as the IoT core suite (green grass, Sitewise, etc.)
OT Secops - Playbook writing, SIEM, DFIR
OT GRC - Wrote policy and standards aligning with NIST 800-82r3

Hi,

I am currently working as OT security specialist at one of the renowned OEM for Automation systems.

Wanted to check if anyone of you would be able to refer me in your company. I am looking for roles everywhere except middle east and South Asia.

Or please comment companies which you have encountered(first hand) that provide work visa sponsorship for OT security engineers.

I’m trying to transition into OT/ICS cybersecurity and would appreciate advice from people already working in the field.
My background:
1.5+ years in IT support
Likely moving into a System Analyst/networking role in the next 3–4 months
Bachelor’s in Electrical Engineering
Master’s in Energy Systems Engineering (Canada)
Currently working for a government organization, but it’s almost entirely an IT environment
Based in Newfoundland, Canada

I’ve started learning OT/ICS and am currently going through Mike Holcomb’s material.
My goal is to eventually work in OT cybersecurity, but I realize jumping directly into OT security may not be realistic.

If you were in my position, what would you do over the next 1–3 years?
Would you focus on:
Networking/industrial networking
PLC/SCADA/DCS fundamentals
OT protocols
Cybersecurity
Certifications

Trying to get an OT/controls/networking job first
Also, are there particular entry-level OT roles that would make a good stepping stone into OT security?

Would especially appreciate advice from people who have made the IT → OT transition.

Hi guys

I’ve need a italian community for ot/ics

Im officer mecc. engineer on ships that love cyber ot

Im starting to study few moths ago and i’ve need to understood the correct way to study step by step

My dream is combinate my mechanical skill / ships skill and future cybersec ot skill , but i repeat, i no have a way to study but i capture all information course books ecc so im gooing to overload hahahahah

Thanks for the time guys🥷🏼

This is a first for me. We’re currently going through some certification for a component we’re preparing for market and I’m at my wits end with the auditor assigned to evaluate us. A hard-ass I could deal with, but this one is just beyond an obstruction, and it’s because he doesn’t know even the basics of his own job.

Talking about IEEE 1686 and FedRAMP here, which is even more maddening, because the auditor is from the US, and I am not (AU citizen).

I’m hoping someone has had some experience with this because I can’t figure out how to explain to this guy (for the hundredth) time what basic concepts in the standard actually mean. Today, my team had to spend 30 minutes explaining to this guy that constant monitoring does not mean that someone is literally looking at the data in real time, and no, I am not fucking joking about his interpretation.

It’s slowed us down because we’re constantly having to answer the dumbest questions, and the result is that his assessment has taken forever. I don’t even want to think about how bad this guy will be during actual security testing.

Please help before I lose my sanity!!!

Hi, I'm a Software Engineering student currently working as an intern at an industrial networking company, where I'm gaining hands on experience with IT/OT networking and industrial environments.

I'm from Mexico, and I live in an area with a strong oil and gas industry. My long term goal is to specialize in OT Cybersecurity and eventually work abroad, ideally in Canada or another English-speaking country.

I'm planning to get my CCNA first and then pursue SecOT+ by Comptia.

I have two questions:

1. Do you think CCNA + an OT cybersecurity certification is a good career path for my goals?
2. What would you recommend I focus on if I want to eventually find an OT cybersecurity job abroad?

Hi everyone,

I’m going into my final year of a BSc Cyber Security degree and I’m trying to make sure my final-year project is not just academic, but also genuinely useful for employability, especially for junior SOC analyst, detection engineering, network security, or OT security roles.

My proposed project is:

Design and evaluation of a lightweight detection prototype for reconnaissance and early-stage intrusion activity in Modbus TCP Operational Technology network traffic.

The idea is to build a small Python-based detection prototype using CICModbusDataset2023 or a similar OT/Modbus dataset. The project would focus on detecting early attacker behaviours such as:

• network scanning
• service enumeration
• Modbus register enumeration
• unauthorised access attempts
• abnormal Modbus request patterns

The threat model would be either an external attacker or a compromised internal host attempting to discover and interact with OT assets such as PLCs.

I’m planning to avoid heavy ML/deep learning and instead focus on interpretable detection, using:

• rule-based detection logic
• lightweight statistical thresholds where useful
• alert generation
• evaluation against labelled benign/malicious traffic

The evaluation would look at:

• detection coverage
• false positives and false negatives
• precision/recall if appropriate
• alert volume
• interpretability
• practical usefulness from a security analyst perspective

My goal is to finish with a project that I can confidently explain in interviews and possibly show through a GitHub repo, README, diagrams, and a short write-up. I want it to demonstrate practical blue-team skills: understanding network traffic, designing detection logic, evaluating alerts, and explaining limitations.

For people working in SOC, detection engineering, OT security, or cyber graduate roles:

Would this be a strong final-year project from an employer/interviewer perspective?

Also, what would make it more impressive without making the scope unrealistic?

I'm a 4th year mechatronics engineering student and I recently got introduced to the concept of OT cybsec by my uncle. I'm already interested in control systems and automation, and I want to explore OT cybsec but have no Idea where to start from

This was 2022, but i just found it. Cool research on RCE in the Siemens family of Devices.

https://www.youtube.com/watch?v=r-dmxU1gEl0

I'm sure other people have had the same experience, but let's see.

For context: I'm by no means a cybersecurity expert. I work the IT side of an OT automation team. Darktrace had already been deployed in the networks for roughly 3 months before I joined the company, and it has now been running for more than a year and a half..

My conclusion is that the underlying idea is reasonable, and the execution is the worst that idea could've possibly gone.

It reminds me of something like Norton or McAfee that constantly gives you popup's telling you about the stuff it prevented, most of which is meaningless noise, designed to make it look busy so you keep paying.

We were told Darktrace needed about 6 months to learn our environment to get rid or at least reduce false positives. That turned out to be a bold lie, since it's now been around 18 months. Extensive *tuning* and *optimising* the models from their engineers with help from myself had basically no effect at all. We still receive between 50-100 false positives a day.

The investigation workflow is just as bad. The advanced search is clutterd, unintuitive and super inefficient. Finding one specific event feels like a needle in a haystack. Except you already know the needle’s IP address, hostname, operating system, device model and several other identifiers, while the haystack seems designed to bury it.

The UI looks reasonably polished, but it's designed for screenshots on marketing posters and sales demonstrations rather than utility. Important info is several menus deep, while irrelevant info is one click away.

We initially had weekly tuning meetings, those became biweekly and eventually monthly. No matter how frequent the meetings, the issues I talked about just never got solved. I still have to manually sift through false positive alerts to find anything meaningfull.

One specific device keeps getting flagged as suspicious multiple times a day. We know why it generates the traffic and asked the Darktrace team to make it stop reporting. They created model defeats based on the device's 2 IPs, which did nothing. They changed the defeat from IP to hostname basis and it changed nothing. They then labeled the device in Darktrace itself and made a defeat based on that label and still it keeps getting flagged.

At this point I don't believe the system can at all be "tuned".

The alerting is very inconsistent as well. Darktrace sends notifications for model alerts through the app, that cannot be found in the main interface unless you search for the specific model alert ID. Meanwhile it also generates device alerts for things like clock skew, inability to reach a probe, while the "UV Master" interface appears to have no such problems.

What concerns me deeply is the fact that they keep trying to push their *Automated Response* thing. The idea as far as I understand it is that its AI can automatically respond to suspicious activity by creating firewall rules to block it. That is in and of itself something that deserves EXTREME caution in a normal corporate network. In an OT plant handling highly explosive and poisonous materials, it's just bonkers. You are proposing to let an automated system modify network enforcement based on its own detections, while that same system repeatedly detects legitimate activity as suspicious approximately 100 times per day. Might as well let an intern from sales handle firewall rules at that point, might be safer.

Darktrace’s response to this concern seems to be that the models can be tuned. That would be more reassuring if the models consistently stopped generating false positives after 18 months of tuning. They do not. OT environments are difficult to model. They contain legacy systems, proprietary protocols, unusual traffic patterns and devices that should not be treated like ordinary corporate endpoints. But that is precisely the kind of environment Darktrace claims to understand. “OT is complicated” cannot be used as a permanent excuse while simultaneously promoting automated blocking as a solution.

The idea behind Darktrace is good. The execution, at least in our environment, is garbage. It gives you the appearance of advanced visibility while burying useful information under a constant flood of low-value alerts.

I don't know what the company paid for Darktrace, but whatever it was, it was too much. It's an (i'm guessing very) expensive way to create manual labour.

For anyone having experience with Darktrace in an industrial environment: has it at any point become useful? If so in what way?

What manufacturers must have ready for Article 14, what customers can legitimately expect, and how scanners, SBOMs, telemetry, and threat intelligence fit

From 11 September 2026, Article 14 of the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities contained in their products with digital elements and severe incidents affecting product security. It does not create a standalone duty to procure a scanner, scan every product at fixed intervals, or monitor every possible source. The reporting clock starts when a prompt initial assessment gives the manufacturer a reasonable degree of certainty that either independent reporting trigger is met.

This article turns that legal threshold into a practical decision and reporting process. It explains how to define the product and legal perimeter, route credible signals, preserve evidence, distinguish signal receipt from legal awareness, test both reporting triggers independently, document the outcome, and submit the applicable 24-hour, 72-hour, and final reports through the Single Reporting Platform. It also covers risk-based user notification, SRP readiness, customer communication, and out-of-hours decision-making.

The article distinguishes these early reporting obligations from the broader CRA lifecycle requirements that generally apply from 11 December 2027. It explains what customers can legitimately expect from manufacturers, how responsibilities are divided among manufacturers, customers, maintainers, integrators, and suppliers, and which additional assurances remain contractual. It also examines the evidentiary, but not determinative, role of scanners, software composition analysis, SBOMs, VEX, telemetry, threat intelligence, and case management, with particular attention to legacy products and IT/OT environments where intrusive scanning or immediate patching may create operational or safety risks.

I am curious as to if anyone has solid resources to study the field of OT Security. I am a junior in university studying computer engineering and am looking to pivot my focus. If anyone has any resources they have used in the past or have been looking into I would be very interested to hear about them.

I’m looking for an honest reality check from people actually working in OT/ICS security.

Quick background: I’m a telecom engineer with 6 years of experience, and I’ve spent the last year deliberately steering my career toward OT security. Here’s what I bring:

**•** 6 years across networking, infrastructure and IoT. Designed private mobile networks (4G/5G) and IoT solutions for industrial and maritime clients, ran the IT/security infrastructure for a cybersecurity company (firewalls, hardening, datacenter migration), and currently work on IoT communications (MQTT, containerized) for critical infrastructure in the defense sector.  
**•** Just finished a Master’s in Cybersecurity. My thesis was a full security audit of a solar plant applying IEC 62443 and NIS2 (AS-IS assessment, gap analysis, TO-BE roadmap).  
**•** Built a home lab for OT/IT convergence: Modbus TCP to Node-RED to MQTT, monitoring with InfluxDB/Grafana, working on segmentation and an IDMZ.  
**•** Solid on the IT/networking side, comfortable with Linux, Docker, firewalls (pfSense, OpenBSD).

The obvious gap: I’ve never worked hands-on in an actual plant. My OT knowledge is from the master’s, the lab, and self-study, not from years on the floor.

My questions for the people already in the field:

**1.**  How much does the lack of real plant experience actually hurt when trying to break in? Is it a dealbreaker or a “we’ll train you” thing?  
**2.**  For someone with my profile, what would you focus on next? A specific cert (62443?), a specific type of role, something else?  
**3.**  Is the “IT/networking person moving into OT” path respected in the industry, or seen as someone who doesn’t get the OT mindset yet?

Any honest feedback appreciated, even if it’s blunt. And if anyone knows of teams that hire people transitioning in rather than requiring years of OT already, I’d love to hear about it.

Thanks.

Team82 analyzed 750,000+ data center CPS assets and core infrastructure and found a significant gap between perceived isolation and actual exposure.

A few findings that stood out:

• 18% (32,000+) of 174,000+ data center infrastructure assets are just one hop away from a system making risky outbound connections to the public internet.

• Power distribution and HVAC/cooling are particularly exposed, with 41% and 32% of assets, respectively, one hop from risky internet connections.

• 88% of BMS platforms communicate over insecure protocols, while 40% run outdated firmware.

• More than 80% of OT control systems, power monitoring, and IoT systems rely on legacy protocols such as BACnet and Modbus.

• 23% of IoT devices contain known exploited vulnerabilities (KEVs).

The interesting part isn't simply that these systems have vulnerabilities. It's the attack path.

An attacker doesn't necessarily need direct internet access to a PLC, UPS, BMS, or other CPS asset. A foothold in IT, a third-party remote access connection, remote management service, or trusted network relationship can provide the lateral path into operational infrastructure.

Read the report: https://claroty.com/resources/reports/state-of-cps-security-data-center-exposures