Understand threats, controls, and management decisions affecting operational technology and industrial control systems.
Maersk's whole recovery from NotPetya hung on one domain controller in Ghana that a blackout had switched off. Luck is not a backup design. A bench drill for one controller project, one HMI and one historian, timed lap by lap, with a strict pass line.
Read article
A CISA advisory describes a federal agency whose untested response plan left outside responders waiting on a change board, a log platform they could not reach, and no way to bring third parties in. Six injects that find the same roadblocks at an industrial site, before an incident does.
Read article
In April 2022, Industroyer2 was scheduled to hit a Ukrainian energy company's substations at 16:10 UTC. It never ran. CERT-UA and ESET published the record within days. Here it is as a seven-block tabletop: what your team knows, the decision it faces, and what the real defenders did.
Read article
Most OT tabletops open in someone's inbox, and the operators tune out by minute five. Here are three printable inject cards that open on what the plant sees instead: a setpoint nobody changed, a pump that will not stop, and screens that go dark. Timings, good responses and the escalation for each.
Read article
Most OT exercise reports are filed and forgotten, so the same finding comes back next year. A worked improvement plan with four rows, built on FEMA's HSEEP format, and the one rule that makes findings actually close: write the re-test before you write the fix.
Read article
Two Danish energy companies, the same attack, the same afternoon in May 2023. One cut its plant off the internet in about fifteen minutes, the other in close to two hours. A one-page disconnect decision block for your plan: who orders it, three triggers, a deadline, and who is told.
Read article
Molson Coors, Clorox and Brunswick each filed two numbers for their cyber incidents. The one labelled as the incident's cost was the small one. The big one was lost production days. A one-page worksheet prices a lost day at your own site, for the budget meeting where exercise time gets cut.
Read article
Part 2.1 of CIP-008-6 is 47 words, and every way to meet it ends on Reportable Cyber Security Incident. A close reading of R2 and R3, and the seven records a test should leave behind: what each must show, and who puts a name on it.
Read article
TSA's pipeline directive asks for at least two of four response plan objectives to be exercised each year, with the named positions taking part. It never says which two. A two-year rotation that covers all four, and who has to be in the room for each.
Read article
Twelve months, four outages, one calendar. A sample OT drill year filled in the order a plant actually works: outage dates first, then blackouts, compliance clocks, four quarterly events and a monthly call-list check on a different shift each time.
Read article
In every well-documented OT incident where the damage was limited, the limiting factor was operational: manual operation, tested offline backups, a human watching a screen, or the attacker's own bug. What that should change about the order you build controls in.
Read article
A Minnesota water plant got locked out of its own controls in July 2026, part of a 100+ facility campaign. The political fight over Iran's involvement is a distraction from the real, fixable problem: exposed industrial controllers and no dedicated security staff.
Read article