-
ICS Tabletop Exercises: Why the Lessons Never Transfer to the Plant Floor
An IT tabletop finds a process gap and the team rewrites the runbook. An ICS tabletop finds the same gap and the team can do nothing with it, because the person who would have to act on the gap is two floors down, on a different shift, under a different chain of command.
-
What a Good ICS Detection Looks Like in Practice
There is a lot of advice about ICS detection that talks about MODBUS, DNP3, and the protocol layers. This is the part that comes after the protocol talk: what a good detection actually looks like in the SIEM, and what the SOC analyst does with it
-
The 7 Most Pointless Findings in OT Pen Tests
If you run enough OT pen tests, you start to notice a pattern. The report arrives, the client is confused, and the findings have a peculiar quality: technically correct, operationally impossible to remediate, and…
-
Purple Teaming OT: Why \"We Can't Test That\" Is No Longer Acceptable
I keep hearing the same thing in conversations about operational technology security