The Blind Spot Between IT and OT Isn't Where or What You Think

The Blind Spot Between IT and OT Isn't Where or What You Think

by Dino Busalachi and Craig Taylor

Humanities, Social Sciences & Thought Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Dino Busalachi and Craig Taylor 👥 196 📅 September 1, 2026 ⏱ 35 min 👁 0 📄 expert opinion 🧭 2026-09-01
Available in: English (current) Français

Keywords

IT/OT collaborationcybersecurity trainingpositive reinforcementsystem integratorsair gap myth

Summary

In this episode of Industrial Cybersecurity Insider, host Dino Busalachi and guest Craig Taylor, founder of CyberHoot, discuss the persistent cybersecurity challenges in manufacturing environments, focusing on the cultural and operational divide between IT and OT. Taylor argues that traditional punitive security awareness programs, such as simulated phishing emails, create resistance and fail to change behavior. Instead, he advocates for positive reinforcement, gamification, and short, practical training sessions that empower employees to recognize and report threats. The conversation highlights the often-overlooked role of system integrators and machine builders, who frequently connect unmanaged laptops directly to plant networks without oversight. They debunk the myth of air-gapped systems, noting that remote access and cellular modems compromise isolation. The discussion also addresses the growing threat of AI-driven attacks targeting aging industrial equipment and the need for cybersecurity to be treated as a core plant metric alongside safety and uptime. Taylor introduces the PAR framework (Pause, Assess, Report) as a simple tool for employees to handle suspicious emails. The episode concludes with a call for leadership to incentivize cyber preparedness and foster a culture where reporting mistakes is rewarded, not punished.

187 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information lies in its practical, experience-based insights into the human and cultural aspects of OT cybersecurity, which are often overshadowed by technical solutions. The argumentation is coherent and persuasive, using analogies (e.g., dog training) to illustrate the ineffectiveness of punishment-based approaches. However, the claims are largely anecdotal, lacking empirical evidence or case studies with measurable outcomes. The discussion is more opinion-driven than data-driven, which limits its scientific weight but enhances its accessibility and practical relevance.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the speakers rely on personal experience and industry anecdotes rather than citing specific studies or reports. The quality of sources is limited to the speakers’ own expertise and the company’s website, with no external references provided. The title accurately reflects the content, emphasizing the cultural blind spot rather than technical vulnerabilities. The adéquation between title and content is strong, as the episode consistently addresses the IT/OT collaboration gap.

167 words

Title / Content Match

The title effectively captures the core message that the main cybersecurity gap lies in the cultural and collaborative divide between IT and OT, rather than purely technical issues.

Quality & Reliability

6/10

The discussion is based on practical experience and anecdotal evidence rather than peer-reviewed research. While the speakers are credible practitioners, the lack of empirical data and reliance on personal anecdotes limits the scientific rigor.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • CyberHoot — Craig Taylor's company, offering cybersecurity training and awareness solutions.
  • Industrial Cybersecurity Insider on LinkedIn — Official LinkedIn page for the podcast and related content.
  • Cybersecurity & Digital Safety on LinkedIn — LinkedIn group for cybersecurity discussions.
  • BW Design Group Cybersecurity — Dino Busalachi's company, offering cybersecurity services for industrial environments.
  • Craig Taylor on LinkedIn — Craig Taylor's professional profile.
  • Dino Busalachi on LinkedIn — Dino Busalachi's professional profile.
  • Craig Duckworth on LinkedIn — Craig Duckworth's professional profile, possibly a team member.

Concurring Sources

  • NIST Cybersecurity Framework — Provides a structured approach to managing cybersecurity risks, aligning with the episode's call for a collaborative and systematic approach.
  • IEC 62443 — International standards for industrial automation and control systems security, relevant to the discussion on OT security.

Dissenting Sources

  • Punishment-based security awareness programs — The episode criticizes punitive approaches, but some studies suggest that simulated phishing can be effective when combined with training. This represents a contrasting viewpoint.

External References

Contribution & Novelties

The episode provides a fresh perspective on OT cybersecurity by emphasizing the cultural and human factors over purely technical solutions. It introduces the PAR framework (Pause, Assess, Report) as a simple, actionable tool for employees. The discussion also highlights the often-neglected role of system integrators and machine builders in the security posture of manufacturing plants, advocating for their inclusion in cybersecurity planning. The emphasis on positive reinforcement and gamification as alternatives to punitive training is a valuable contribution to the field.

Pour aller plus loin :

  • NIST Cybersecurity Framework — A widely adopted framework for improving cybersecurity posture, relevant to aligning IT and OT security practices.
  • IEC 62443 — International standards for industrial automation and control systems security, providing guidance for OT environments.
  • Social engineering — The psychological manipulation of people to divulge confidential information, central to the phishing attacks discussed.
  • Human factors in cybersecurity — Research on human behavior and security, supporting the argument for positive reinforcement.

158 words

Radar Profile

The radar profile shows moderate scores across all dimensions, with a slight emphasis on information quantity and technical level. This reflects a balanced discussion that is informative but not deeply technical, focusing on practical insights rather than rigorous data.

Reliability 6/10