Aligning OT Security With How Attacks Really Unfold

What You'll Learn

OT security programs across critical infrastructure keep passing audits while incidents keep happening. Clean reports. Documented risks. Leadership sign-off. Then the Poland grid goes down. The pattern is consistent, and the reason isn't technical failure. It's a structural one: organizations are testing the wrong thing.

Traditional OT pen tests validate exploits. Real industrial attacks exploit operations. Those are not the same thing. Attackers don't wait for an unpatched vulnerability. They move through trusted access paths from IT into OT, riding relationships and permissions that were never designed to be questioned. Most OT security programs have no visibility into that movement at all.

The Poland grid incident isn't an outlier. It's a preview. Energy grids, manufacturing lines, transit systems, industrial campuses: all share the same structural weakness. When an attacker with trusted access decides to move, the question isn't whether your controls pass a test. It's whether your team can see it, contain it, and do it without shutting down production.

Organizations that have built real OT security maturity have flipped the model entirely. They test for adversarial behavior, not just vulnerability. They validate detection and response against the way attackers actually move, not against a compliance checklist. Terry McCorkle brings the offensive perspective on how attackers pivot from IT to OT at the executive level. Chris Weule brings hands-on experience modeling adversary behavior and validating detection in live industrial environments.

This session answers the question that actually matters: if an attacker moved into your OT environment tonight, would you see it? Watch the replay to find out what real OT security maturity looks like, why traditional testing misses operational risk, and what it takes to close the gap before it costs you production.