IT SOC vs OT SOC How & Why They’re Different

IT SOC vs OT SOC How & Why They’re Different

by Craig Duckworth and Dino Busalachi

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Craig Duckworth and Dino Busalachi 👥 192 📅 February 25, 2026 ⏱ 26 min 👁 30 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

OT SOCIT SOCasset visibilityincident responselocalization

Summary

In this episode, Craig Duckworth and Dino Busalachi discuss the critical differences between IT and OT Security Operations Centers (SOCs). They highlight that traditional IT-centric SOCs often fail to protect manufacturing environments due to a lack of visibility into OT assets. A case study of a global beverage company reveals that they were only monitoring one-third of their OT assets, illustrating the common problem of incomplete asset inventory. The hosts explain why IT SOCs struggle with OT visibility, citing factors such as the dynamic nature of manufacturing environments, line changeovers, and the lack of operational context. They emphasize the importance of localization, where IT teams must embed themselves in plant operations to understand the unique context of manufacturing assets. The discussion covers practical barriers like PLC modifications, remote access vulnerabilities, and the need for OT-specific incident response protocols. They also address organizational accountability, noting that often no one takes responsibility for OT security. The hosts advocate for a collaborative approach, where IT and OT teams work together, and suggest that greenfield projects offer opportunities for standardization. They conclude by stressing the need for IT teams to become part of the plant community and for organizations to leverage external expertise when needed.

201 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information is high for practitioners in industrial cybersecurity, as it provides real-world insights and practical advice. The hosts draw from their extensive experience, offering concrete examples and highlighting common pitfalls. The argumentation is solid, built on logical reasoning and case studies, though it relies heavily on anecdotal evidence rather than empirical data. The discussion is persuasive, emphasizing the need for OT-specific SOC approaches and the importance of localization.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the hosts are credible experts, but they do not cite formal sources or studies. The quality of sources is limited to their own experience and references to industry practices. The title accurately reflects the content, which is a focused comparison of IT and OT SOCs. No comments were provided, so no analysis of public trends is included.

149 words

Title / Content Match

The title accurately reflects the content, which focuses on the differences between IT and OT SOCs.

Quality & Reliability

7/10

The hosts are experienced professionals in industrial cybersecurity, providing practical insights and real-world examples. However, the discussion is largely anecdotal and lacks formal citations or data, limiting its scientific rigor.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Concurring Sources

  • IEC 62443 — International standards for industrial cybersecurity, aligning with the need for OT-specific security approaches.
  • NIST SP 800-82 — Guide to Industrial Control Systems (ICS) Security, supporting the importance of asset inventory and visibility.

Dissenting Sources

  • No discordant sources found — The video does not contradict established sources; it aligns with common industry knowledge.

Contribution & Novelties

The video provides a practical, experience-based perspective on the differences between IT and OT SOCs, highlighting common pitfalls and offering actionable advice for organizations. It emphasizes the importance of localization and embedding IT teams in plant operations, which is a nuanced viewpoint not often discussed in formal literature.

Pour aller plus loin :

  • IEC 62443 — International standards for industrial cybersecurity, relevant to OT security frameworks.
  • NIST SP 800-82 — Guide to Industrial Control Systems (ICS) Security, providing foundational guidance.
  • MITRE ATT&CK for ICS — Knowledge base of adversary tactics and techniques specific to industrial control systems.

97 words

Radar Profile

The radar profile shows moderate to high scores across all dimensions, with the highest in quantity of information and the lowest in technical level, indicating a balanced but not deeply technical discussion. The overall profile suggests a practical, experience-based resource suitable for professionals seeking insights rather than academic depth.

Reliability 6/10