The Real Cost of Delaying OT Cybersecurity Investment

The Real Cost of Delaying OT Cybersecurity Investment

by Craig Duckworth and Jim Cook

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Craig Duckworth and Jim Cook 👥 192 📅 July 7, 2026 ⏱ 35 min 👁 14 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

OT cybersecuritybudgetbusiness caseriskliability

Summary

In this episode of Industrial Cybersecurity Insider, hosts Craig Duckworth and Jim Cook discuss the challenges of securing budget for OT (Operational Technology) cybersecurity. They highlight the common IT/OT ownership gap, where neither side takes responsibility for securing industrial control systems. The conversation focuses on how to build a compelling business case for executives by framing the risks in terms of liability, physical safety, and financial impact. They emphasize the importance of starting with basic questions about ownership and visibility, and recommend conducting proof-of-concept pilots to gather quantifiable data. The hosts also discuss the role of cybersecurity insurance, the need to include OT in the company’s risk register, and the concept of technology debt as a way to explain the cost of deferred investments. They outline several options for organizations, from doing nothing to replacing legacy equipment, and argue that the most realistic path is to move forward with a risk-based approach, prioritizing top risks and creating a long-term roadmap. The episode provides a practical framework for initiating budget conversations before a breach forces them.

175 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information lies in its practical, experience-based advice for professionals trying to secure OT cybersecurity budgets. The hosts provide a clear framework for building a business case, including specific talking points (liability, physical risk, financial impact) and strategies (proof-of-concept, risk register, technology debt). The argumentation is coherent and persuasive, grounded in real-world scenarios and common industry challenges. However, the discussion is largely anecdotal, lacking references to specific studies or standards, which limits its scientific rigor. The hosts’ credibility is established through their professional backgrounds, but the lack of external evidence weakens the overall argument.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate: the hosts are experienced practitioners, but they do not cite specific sources or standards, relying instead on anecdotal evidence and general industry knowledge. The sources provided in the description are mostly LinkedIn profiles and company pages, which are not scientific references. The title accurately reflects the content, which focuses on the costs and risks of delaying OT cybersecurity investments. The discussion is practical and actionable, but it would benefit from references to industry frameworks (e.g., NIST, ISA/IEC 62443) to enhance credibility. No comments were provided for analysis.

204 words

Title / Content Match

The title accurately reflects the content, which focuses on the costs and risks of delaying OT cybersecurity investments and how to build a business case.

Quality & Reliability

7/10

The hosts are experienced professionals in OT cybersecurity, providing practical advice based on field experience. However, the discussion is largely anecdotal and lacks citations to specific studies or standards, limiting its scientific rigor.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Concurring Sources

  • NIST Cybersecurity Framework — Provides a structured approach to managing cybersecurity risk, aligning with the episode's emphasis on risk-based prioritization.
  • IEC 62443 — International standards for industrial automation and control systems security, directly relevant to OT cybersecurity.

Contribution & Novelties

The episode provides a practical, experience-based framework for building a business case for OT cybersecurity investments, emphasizing the importance of framing risks in terms of liability, physical safety, and financial impact. It offers actionable steps, such as conducting proof-of-concept pilots and using technology debt as a communication tool. The discussion is particularly valuable for professionals navigating the IT/OT divide and seeking executive buy-in.

Pour aller plus loin :

  • NIST Cybersecurity Framework — A widely used framework for improving cybersecurity posture, relevant to OT environments.
  • IEC 62443 — International standards for industrial automation and control systems security, directly applicable to OT cybersecurity.
  • OT Cybersecurity: A Practical Guide — CISA resources on OT security, providing guidance and best practices.

117 words

Radar Profile

The radar profile shows a balanced approach with moderate scores across all dimensions, indicating a practical and accessible discussion. The highest scores are in information quantity and reliability, reflecting the hosts' experience, while technical depth is slightly lower, suggesting the content is more strategic than technical.

Reliability 7/10