The CISO's Impossible Task: Protecting Plant Floors They've Never Seen

The CISO's Impossible Task: Protecting Plant Floors They've Never Seen

by Craig Duckworth and Dino Busalaki

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Craig Duckworth and Dino Busalaki 👥 192 📅 January 6, 2026 ⏱ 26 min 👁 239 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

CISOOT securityplant floorIT/OT convergencecyber risk

Summary

In this episode of Industrial Cybersecurity Insider, hosts Craig Duckworth and Dino Busalaki discuss the challenges CISOs face when securing operational technology (OT) environments, particularly manufacturing plant floors. They highlight the disconnect between IT and OT teams, noting that CISOs often lack understanding of the plant floor’s priorities: safety and uptime. The hosts argue that traditional security approaches, such as removing legacy systems like Windows 7, are impractical in OT settings where such actions could halt production and incur significant costs. They emphasize the need for CISOs to collaborate with OT engineers and external experts, and to adopt a risk-based approach that balances security with operational continuity. The conversation also touches on the limited time CISOs have to present to boards (averaging 17 minutes per quarter), the inadequacy of cyber insurance for covering business disruption, and the importance of ‘secure by design’ and ‘secure by demand’ in vendor relationships. The hosts conclude by urging organizations to start the journey of understanding their OT environments and to seek external support, as adversaries only need to get lucky once.

177 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information lies in its practical, experience-based insights into the often-overlooked challenges of OT security. The hosts provide concrete examples, such as the cost of downtime and the impracticality of patching legacy systems, which illustrate the unique constraints of industrial environments. The argumentation is coherent and persuasive, emphasizing the need for collaboration and a shift in mindset from pure security to risk management. However, the discussion is largely anecdotal, lacking empirical data or case studies to support claims, which weakens the overall argumentation.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the hosts rely on personal experience and industry anecdotes rather than citing specific studies or reports. No external sources are mentioned, and the description provides no links. The title accurately reflects the content, focusing on the CISO’s challenge in securing unfamiliar plant floors. The discussion is well-structured, but the lack of verifiable sources limits its credibility as a scientific reference.

166 words

Title / Content Match

The title accurately reflects the core theme: the challenges CISOs face in securing OT environments they are unfamiliar with.

Quality & Reliability

7/10

The hosts are experienced practitioners in industrial cybersecurity, providing practical insights and real-world examples. However, the discussion is largely anecdotal and lacks formal citations or data sources, limiting its scientific rigor.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Contribution & Novelties

The podcast provides a practitioner’s perspective on the challenges of OT security, emphasizing the need for collaboration and external expertise. It highlights the limited time CISOs have to present to boards and the inadequacy of cyber insurance, which are often overlooked. The discussion on ‘secure by demand’ is a novel concept that encourages organizations to demand security features from vendors.

Pour aller plus loin :

  • NIST SP 800-82 Rev.3 Guide to Operational Technology (OT) Security — Official guide for OT security best practices.
  • ISA/IEC 62443 Standards — International standards for industrial automation and control systems security.
  • SANS ICS Security Resources — Training and resources for industrial control systems security.

109 words

Radar Profile

The radar profile shows moderate scores across all dimensions, with slightly higher scores in information quantity and quality, reflecting the podcast's practical insights but limited scientific rigor. The technical level is moderate, suitable for a professional audience, and the overall reliability is moderate due to the lack of cited sources.

Reliability 6/10