Why Manufacturing Plants Still Get Hacked Despite Cybersecurity Tool Investment

Why Manufacturing Plants Still Get Hacked Despite Cybersecurity Tool Investment

by Craig Duckworth and Dino Buswalki

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Craig Duckworth and Dino Buswalki 👥 192 📅 October 15, 2025 ⏱ 33 min 👁 24 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

OT securityICSmanufacturingcybersecurityasset visibility

Summary

In this episode, Craig Duckworth and Dino Buswalki discuss why manufacturing plants still suffer cyber incidents despite significant investments in OT security tools. They argue that organizations often underutilize their security technologies, using only a fraction of their capabilities, and suffer from alert fatigue due to overwhelming volumes of alerts. A key issue is the lack of clear ownership and collaboration among IT, OT, and plant operations, with CISOs, CIOs, OEMs, and system integrators often working in silos. They highlight that many OT networks are flat Layer 2 with unmanaged switches, lacking proper segmentation and visibility. Change management and patching are often neglected due to fears of disrupting production, leading to massive technical debt and unpatched vulnerabilities. The human factor is also critical: there is a shortage of skilled personnel, and those responsible often lack training and are overworked. Incident response plans are rarely in place, and operators are the first responders but are not prepared. The hosts emphasize the need for a coalition of all stakeholders—plant managers, engineering, OEMs, SOC—to align on security goals and validate asset visibility through floor walkthroughs. They conclude that buying tools is not a strategy; organizations must operationalize them with proper processes and collaboration.

200 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information lies in its practical, field-based insights into common pitfalls in OT security. The hosts draw on extensive experience visiting hundreds of plants, providing concrete examples of network misconfigurations, lack of incident response, and staffing challenges. The argumentation is coherent and persuasive, emphasizing that technology alone is insufficient without proper use, ownership, and collaboration. However, the discussion is largely anecdotal and lacks empirical data or references to specific studies, which limits its scientific rigor. The hosts make strong claims (e.g., ‘80% of OT security capabilities go unused’) without providing sources, but these are presented as general observations rather than precise statistics.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite specific sources or studies, relying instead on the hosts’ professional experience. The title accurately reflects the content, which focuses on why OT security investments fail to prevent incidents. The discussion is well-structured, following a logical progression from tool underutilization to network issues, human factors, and the need for collaboration. While the lack of external references reduces the scientific rigor, the practical insights are valuable for practitioners. The hosts do not provide data or case studies to support their claims, but their credibility as industry insiders adds weight to their observations.

215 words

Title / Content Match

The title accurately reflects the content, which focuses on why OT security investments fail to prevent incidents.

Quality & Reliability

7/10

The hosts are experienced practitioners in industrial cybersecurity, providing practical insights based on field experience. However, the discussion is largely anecdotal and lacks empirical data or references to specific studies, which limits its scientific rigor.

Chapters

Contribution & Novelties

The video provides a practitioner’s perspective on why OT security investments often fail, highlighting underutilization of tools, lack of ownership, and the importance of floor-level validation. It offers actionable advice such as conducting floor walkthroughs to validate asset visibility and building a coalition of stakeholders. The discussion of alert fatigue and the ‘jack of all trades’ staffing issue is particularly relevant.

Pour aller plus loin :

  • IEC 62443 — International standards for industrial automation and control systems security, providing a framework for OT security.
  • NIST SP 800-82 — Guide to Industrial Control Systems (ICS) Security, offering best practices for securing OT environments.
  • MITRE ATT&CK for ICS — A knowledge base of adversary tactics and techniques specific to industrial control systems, useful for understanding threats.

124 words

Radar Profile

The radar profile shows moderate scores across all dimensions, with slightly higher scores in information quantity and quality, reflecting the practical insights provided. The lower technical depth and reliability scores indicate a lack of detailed technical explanations and external references.

Reliability 6/10

💬 No comments were provided for analysis.