Measure Before You Fix

Measure Before You Fix

1 Sep 2026 | 2026

The recent water security incidents are leading to a number of efforts to address, or fix, “the problem”. Some are short term sprints, such as the 100-day Fragile Foundations Sprint or the six-month Project Watershed 250 in Texas. Others will take that...
But We Really Mean It This Time!

But We Really Mean It This Time!

25 Aug 2026 | 2026

Coverage and commentary of the US water utility cyber incidents continue to dominate OT security content, often with suggestions to address the problem (including mine). Most of the suggestions are logical. They aren’t “wrong”. And most have failed...
Perspective

Perspective

18 Aug 2026 | 2026

The power was out in our area of Maui for over 48 hours due to Hurricane Lala. This is the second time this year that we’ve experienced a multi-day outage due to storms, and this is a typical year. We’ve had similar multi-day and even multi-week outages in...
Accelerate Your OT Security Career & Personal Brand

Accelerate Your OT Security Career & Personal Brand

11 Aug 2026 | 2026

Contribute: New, Narrow, and Deep (see opportunity at the bottom of article) When I had an OT security consulting team from 2000 – 2020, I would tell every new member they should be recognized as best in world at something in OT security in less than three...
US Water Sector OT Security Plan(s)

US Water Sector OT Security Plan(s)

7 Aug 2026 | 2026

I was glad to be off playing cowboy last week. I missed the noise around the Minnesota, and other states, water sector security incidents, and it gave me time to think about what I wanted to write on the subject. First, there is not and should not be one plan to...
The Other AI Question In OT

The Other AI Question In OT

28 Jul 2026 | 2026

AI is dominating conversations in the OT security community. How are the attackers going to use AI? How will AI help in the SOC and other defenders’ tools? Important? Yes, and I’m afraid the OT security community is not working on an equally important issue. How is AI...
Accenture / Dragos Deal Analysis … Part 1

Accenture / Dragos Deal Analysis … Part 1

23 Jun 2026 | 2026

The Accenture / Dragos / runZero / NetRise deal may be the most significant single event in the OT Security Community & Market since Colonial Pipeline. I tackle this in 3 parts over the next 3 days. Part 1 – Accenture & Dragos Part 2 – The Dragos...
Absolute And Relative Risk Reduction

Absolute And Relative Risk Reduction

2 Jun 2026 | 2026

Deconstructing risk can help focus where we should be spending our time and money to reduce risk. Most security controls in OT reduce the likelihood of a cyber incident that causes an impact on operations. How much of a reduction of likelihood, and consequentially...