Bridging IT/OT & Securing ICS: Kevin Kumpf, Chief OT / ICS Security Strategist, Cyolo

[00:00:00] Kevin: okay, we're gonna put out beer. That's great. It slows down, but look further ahead, and then look further back. And you'll see that now you've got trucks showing up at the dock. If the material's not there, now you're paying them to sit there on idle, or it throws off their transportation routes.

[00:00:16] Kevin: And you see this in the airline industry where you're like, where's my flight coming in now? Because if it's not here yet, I know I'm gonna be late, or I'm gonna have to make a secondary plan. Let's look at the other side. if you take another beverage like milk and you say, my production line is down, I'm gonna be down for two or three days.

[00:00:35] Kevin: The farmer is producing the milk. The cows are going to be milked on a schedule. You're not gonna tell the cows hold up and wait, and then the tanker trucks show up to take that milk to you. And they're on a schedule too. Hi, I'm DIO Bus, and today I have with me Kevin Comp. Hi Kevin. Welcome to our

[00:01:23] Dino: podcast.

[00:01:25] Kevin: You pleasure

[00:01:26] Kevin: here.

[00:01:26] Dino: So, a lot of our podcasts are, focused on cybersecurity around OT in the industrial space. and I know that's how you and I met, it's almost been, is it been two years now?

[00:01:35] Kevin: It is been two years automation fair, and a little before that.

[00:01:39] Dino: so let's talk a little bit about Kevin's journey from today. Going as far back as you would like. 'cause I can tell by the gray hair you have on your head, like me, you've been at this for a while.

[00:01:51] Kevin: I have, and I'm one of the people that didn't start out wanting to go this path. had my own companies in the back and background in the back years. And then one day I got a call from a bank that said, do you want to come and do cybersecurity? And I was like, what is that? And it sounded extremely boring because it was like, well, you'll monitor, you'll detect, you'll do reports.

[00:02:10] Kevin: And as it grew from there, I sort of went into other areas on the vendor side because I knew what the bank was missing with their tools, like at that time was SSH. And as I evolved from there, it started to go more vendor. But then I pulled back and said, I have to go sit on the other side of the table because that's where we really need the knowledge from.

[00:02:30] Kevin: Fast forward to where we are today, I'm the chief OT strategist at Colo and I've probably worked for, a dozen companies that put tools in the OT space, and I've probably worked for about half a dozen energy manufacturing, agriculture, other companies out there that work in the sector. And that's what led me here, was really the passion now to take that knowledge and educate and help others in the space.

[00:02:56] Dino: So knowing the challenges, and we talk a lot about the challenges in our podcast, whether it's the IT OT convergence or the OT ecosystem, having to get better at, implementing, technologies within their environment to, to make 'em more cyber safe, to make 'em secure but also to improve their process integrity.

[00:03:15] Dino: And then there's the services wrapped around that, Because. There's not a lot of people in the field that really understand how to not only implement these technologies and why they're valuable and beneficial, but how do you learn what's going on inside your plant? it's like underwater cameras, You could see across the water, but do you really know what's going on underneath? and a lot of organizations don't, They don't have that level of visibility. so how do you see this, particular industry getting better? At, protecting and securing industrial control systems.

[00:03:45] Kevin: Well, I think it's gonna come through pain and I don't like to say that, but if you look at what we see every day out there, there's a lot of people running around doing consulting. We'll help you get through your 6, 2 4, 4 3. We'll help you get through nist. we'll even help you as some people have said, become Zero Trust certified, which there's no such thing.

[00:04:06] Kevin: But when they get to the plant door where the products have to be implemented, they try to go through the IT door, and that's like going through the side door into a house. it's not the entrance that you're welcomed in. It's the one where I'm here now, what do I do? And they don't have that path to meeting the plant managers.

[00:04:23] Kevin: They don't have that path to knowing the problems because many of them show up and say, I'm here because it purchased this. I'm on a contract to support this and we're now gonna put it into ot, and you see that all the time where it's, we just showed up, somebody paid us money and we're here to do something.

[00:04:42] Kevin: But that something is nebulous.

[00:04:45] Dino: and they're not demonstrating the value or the benefit to them. heard OT professionals, plant floor peoples say cybersecurity just gets in the way of getting things done, right? Because they've witnessed it, they've lived it, right. It's been pain points for them and.

[00:04:57] Dino: I run into IT organizations all the time that, have spent little to no time inside their manufacturing facilities, nor are they building relationships with the OEMs or sis that, that their manufacturing teams are hiring. I. Or buying machines, where it is really engaged or involved in that discussion.

[00:05:16] Dino: So, is that something that's warranted? do you think that will, will change this dynamic? Do you think that those folks are ever going to take that leap of faith and go, I'm gonna have to go spend an, an exorbitant amount of time in my plants to figure out how those things run and tick.

[00:05:32] Kevin: they will, and I equate it in a microcosm way to restaurants now that are farm to table. And they say, I go out and I meet the farmers. I know where things come from that are going to my end products that I serve, to the public manufacturing, agriculture, transportation, e energy, you name any of the cities of critical infrastructures out there.

[00:05:54] Kevin: That has to be the approach. I need to know where these things come from, and they do it on the supply chain side with sourcing and other things where they drive down in detail. But when it comes to security, they're looking at safety, they're looking at uptime, they're looking at, nothing has happened, be before.

[00:06:12] Kevin: Why should it happen now? And they're also looking and saying, I need my vendors to be here when something happens and to not get in the way and try to help me run my business better because I know my business. They're just here to sell me technology. And that's really the approach that technology, we've got it in the door.

[00:06:31] Dino: and do you think there's anything missing from the technology or We have the tech. It's just not being implemented in a manner that's gaining benefit for the organization.

[00:06:42] Kevin: Let's talk about that one word implemented. You go out every day and of the products that a company has bought for their plant security focused, help desk improvement for them, monitoring anything and everything over there, not just security. How many of those have truly been implemented properly?

[00:06:59] Kevin: How many of them are shelfware?

[00:07:01] Dino: I find a lot of shelfware. When we go out there, Or tools that the client bought, somebody sold them, and nobody really taught 'em how to use or how to apply it to their specific use cases. Even across their plants, taking it into one plant, you're not necessarily gonna go through the same scenario that she might at another plant or, because there may not be, you might have one plant that's all Rockwell in a mix of other things, and you go to another plant that's primarily Siemens and a mix of other things those plants might make the same stuff, but they do it differently.

[00:07:31] Kevin: And that's exactly it. I've been there and this is the have not have and have not world where when I was over a major manufacturing company for agricultural equipment, off road and on road, or off highway, on highway, the big plant that produced the end product that would sell for millions of dollars, they were flush with money with what they wanted to do.

[00:07:52] Kevin: The little plant that was spinning out the widgets that went into that big product. It was patch the parking lot, fix the hole in the roof and deal with osha. If I don't do that or spend the money on cybersecurity, which who's gonna come up my door and say, you're gonna be fined and we're gonna be the boogeyman.

[00:08:08] Kevin: Nobody really at this juncture, so you have to treat the entire thing properly and in it of a buying group that buys for an organization. One department doesn't say, well, I'm gonna go with this AV software 'cause I like it. it comes in and says, here is the standard. And an ot, as you said, one plant's Rockwell, one plant's Yokogawa, one plant is basically Siemens or any other vendor out there.

[00:08:33] Kevin: And granted there are for different things on the production line, but when it comes down to certain areas, you have to have commonality.

[00:08:39] Dino: Well, and, to me, I look at cybersecurity tools because they're labeled as such, right? And cybersecurity is kind of a boiling ocean kind of term. But now I also look at that process of integrity because I come from a manufacturing background and we all know safety is job number one, but number two is reducing unplanned, unscheduled downtime, right?

[00:09:01] Dino: Because it's very costly. If these tools could help improve your efficiencies within your manufacturing environment, even if, if it could move it a few percentage points or several percentage points, that's big money. and when you're talking about cost, cause you know the budget's cut constraints.

[00:09:17] Dino: If you're saving, if you're losing millions of dollars on your plant floor annually due to unplanned, unscheduled downtime, where a tool might, this tool might save you a million or two plus million dollars a year. Is that worth pursuing versus fighting through, buying a tool? Either one. 'cause we see it do this a lot just to check a box, but then they never share it with the OT teams who really are the recipients of that data that comes from that platform.

[00:09:42] Dino: and at the same time, can you get the OT guys to go ID this And these are the reasons why, right? I mean, that's one of the challenges that I see in my business is teaching the client facing engineering teams. On leveraging these tools to help with just project execution and startup and commissioning, Because they can't see, again, back to the underwater camera piece. They don't know what's going on underneath the surface.

[00:10:05] Kevin: is a term that is out in the IT world that I've used called left of boom. Left of boom means if you're looking through a Mitre attack framework or you're going through an X-D-R-E-D-R type tool, you're building analytical data to determine if something is bad or good and you're trying to stop it before it happens. If we take the security tools and say, we're doing more than security here, we're giving you visibility into your environment. And we're now pulling back data that is cyber physical. So that means, giant industrial turbines or things like that, natural gas equipment, for example. I've dealt with an entity that said, if we have to have a flare burn off of methane natural type gas products out there to get out of the landfill, if something's going on.

[00:10:55] Kevin: I need to know about it. Well, you can't know about it if it's in the middle of nowhere with no connectivity, you now give it connectivity. You can have a left of boom moment where you can say, I know pressure's building up. I know heat's building up. I know somebody is there from a door sensor. Now I can see what they're doing and now I can prevent it.

[00:11:12] Kevin: That's left of boom thinking. It doesn't matter if the security component is there because most of the people in the plants, as you said, it's safety first. It's get me in with. Any product the vendor has basically dropped in as part of their package and it's keeping uptime. So that is a left of boom moment is can you get analytical data, situational awareness outside of the facility to give you that advantage?

[00:11:36] Kevin: I.

[00:11:38] Dino: so who do you see as being the true leaders in this discussion, per se? I mean, as you mentioned, there's consultants, right? You got the technology vendors that are out there. I don't think the government is driving this narrative to that extent. for the majority of manufacturers out there are critical infrastructure organizations.

[00:11:57] Dino: so who's really got their finger on the pulse? I mean, if you're a CEO or a CFO plant manager, who would you recommend that they need to go talk to to get better at this? To get smarter at this?

[00:12:09] Kevin: Yep. So the plant manager or the operational lead at a facility. Is the person that runs things and you've met a bunch of these people, we know a bunch of 'em in common, and when you go and see 'em at a show, you can tell they're the guy that has their pulse on how the facility operates.

[00:12:26] Kevin: The problem is, is that their pulse is generally on the uptime production type things in the plant. It's not on the, how do I make it more secure because I'm fearful of something going wrong. Then you trickle down to the vendor that comes in, puts in an entire production line, an entire packaging or bottling process, and the plant manager and the company go, you own that.

[00:12:49] Kevin: You're responsible for it. And it's really at that point, contractually driven that if you have downtime, there's huge penalties. Look at the automotive industry, tens of thousands, if not hundreds of thousands, dollars a minute or hour for when you're down.

[00:13:02] Dino: It's like $22,000 a. Ended at least several years ago. That was the metric in automotive,

[00:13:08] Kevin: and now I hear people out there where it's 50, 60 for critical things. You know, a lot of people focus on manufacturing side. If you look at other areas that's in there, like the energy, like maritime, even financial is part of the CISA critical sectors. if you look at the New York Stock Exchange now, those were built, those computers and everything are right there on the floor.

[00:13:29] Kevin: They're dedicated links because those transactions have to be in a timed capacity. so all of these industries know what good looks like from a process communication process flow, and how to make it work at maximum efficiency. What they fail at then is, okay, now how do we wrap security around this?

[00:13:48] Kevin: Because they view security as it's going to slow things down. It's going to cause delays. It's going to cause outages. And we've seen those sadly. And so really now it's not selling. You're going to be more secure. You're really selling to the plant manager. We promise we're not gonna break anything.

[00:14:07] Dino: see, to me, that gets to the point of where you have to have, just like your operations team, your engineering team, your production teams who know how to run that equipment pretty optimally, Generally speaking, they do. but again, they don't know what's going on from the data streams underneath, within that machine center.

[00:14:28] Dino: It could be impeding or impacting that, right? Whether it's to somebody stealing IP or somebody just trying to do their due diligence and they're being disruptive because back to your point, even on, the stock exchange floor, a filler, putting liquid in a can or a bottle has to have very timely communications between those industrial assets, And anything that delays that, all of a sudden I got a filler that's slowing or stopping and then all of a sudden I got a jam that's going all the way back, to the feeds of now. Now my line is down and I used to work for a very large beer manufacturer back in the day, and that was 80 grand an hour for one packaging line, not putting liquid in a bottle or a can.

[00:15:06] Kevin: and the ripple effect to downstream. When we look at it, we say, okay, we're gonna put out beer. That's great. It slows down, but look further ahead, and then look further back. And you'll see that now you've got trucks showing up at the dock. If the material's not there, now you're paying them to sit there on idle, or it throws off their transportation routes.

[00:15:27] Kevin: And you see this in the airline industry where you're like, where's my flight coming in now? Because if it's not here yet, I know I'm gonna be late, or I'm gonna have to make a secondary plan. Let's look at the other side. if you take another beverage like milk and you say, my production line is down, I'm gonna be down for two or three days.

[00:15:46] Kevin: The farmer is producing the milk. The cows are going to be milked on a schedule. You're not gonna tell the cows hold up and wait, and then the tanker trucks show up to take that milk to you. And they're on a schedule too. we see this all the time, where if you want to get really simple about it.

[00:16:04] Kevin: I worked with the state of Vermont for a couple years, with their ciso, and he had people on his team that would say, if there's an incident in this time, don't call me because I'm out making maple syrup because the SAP is running at that time. So there's all these factors that say that where's the priority?

[00:16:22] Kevin: And is 80 grand a minute, an hour really a priority? Or is security a priority? and you know which one they're gonna choose.

[00:16:29] Dino: Without a doubt. Unquestionably they will. So, to me it's how do you get teams in tune to what's going on from that digital perspective, right Outside mechanical activity going on. But from a digital perspective, right? 'cause you got data pushing physical outcomes, And D, OT world versus it, which is data producing data outcomes.

[00:16:50] Dino: Is being able to really study that and understand it. So when you're putting those control points in place, these cybersecurity control points in place, recognizing which levers that if that switch goes, somebody puts as a patch, somebody makes a config change, the new protocol is introduced into the environment.

[00:17:08] Dino: Somebody turns on a new service, whatever that is seen and is dealt with in a pretty, Timely manner to keep it from becoming a bigger problem.

[00:17:17] Kevin: Yeah. And that's where, you and I have talked, the platform that your company's offering and, this isn't a plug about the platform or a plug about, BW or anything like that. This is about a factual I. technology and your DG 360 platform, that really says it right in the name.

[00:17:33] Kevin: It's gonna give you that 360 degree view of everything going on in your facility, your people, your process, your technology. Because as you go down, we talked about who's the most important person in the operations, the plant manager. But as you start to go down now, your chain of command and say.

[00:17:50] Kevin: We've talked about data here a minute, You mentioned the data in the plant and the data, being available. Who is that data important to the plant manager? It's not really that important to, but as you go down that chain of ownership, that data now, especially with AI and other things that are out there now, that data is critical information that a competitor can steal, and we've seen that, or that you can look at and find defects in your process that can improve it.

[00:18:15] Kevin: So everybody has a stake in the game, and I think what we're really talking about here is who do we need at the table and what role and lens do they look at to say, if I want this plant to be more safe, more secure, and more uptime available. Who do we need at the table to make that happen? And that's your vendors, that's the plant staff, that's your IT staff, your analytical teams with them.

[00:18:41] Kevin: And that's management that's gonna give full backing, at least those four.

[00:18:45] Dino: Yeah.

[00:18:46] Kevin: We never see them all at the table

[00:18:48] Kevin: together.

[00:18:48] Dino: No, we rarely do, you know, when we're being asked to, scope a job for a new packaging line or even, a brownfield expansion or lifecycle replacement of assets where you have the people that you just mentioned at the table. paying attention to what are we trying to accomplish?

[00:19:07] Dino: What are you gonna, what technologies are you gonna apply to this? the safety conversation is kind of a non-negotiable thing, Those vendors come in with the intent, but those machines are gonna be safe, They build safety measures into that machine center, people don't lose their fingers or their hearing or their eyes or or cause, electrocution, whatever the case may be. But then the next stage is what technologies are you putting in there? What are you doing to be proactive to assist me in my cybersecurity digital safety journey?

[00:19:36] Kevin: While this now brings up the other point that in it. you can look and say you're gonna get the latest and greatest update tomorrow automatically for your laptop or system, or even phone, because that's the way we do it. thank God for, patch Tuesday and other things out there that, have made life easier for them, not

[00:19:57] Dino: Right.

[00:19:58] Kevin: exactly. And that came out of people not knowing what their systems were vulnerable for and for people getting whacked all the time. I mean, it became an efficiency thing. Now we're trying to take efficiency of an operational environment and flip it around and say, add security. How do you do that To Windows three to one.

[00:20:17] Kevin: One Windows 95 paper Tape Systems, even systems out there that are old four wire telecom in the, utility sector. How do you do

[00:20:27] Kevin: that?

[00:20:28] Dino: Yeah. And that, that's an important step point that you bring up in regards to the patching, right? Because every single person listening to this podcast is, has gone through a patching activity. The, that's messed up their meeting for several minutes because they were getting ready to kick off a meeting and they couldn't because their machine was booting.

[00:20:46] Dino: Right. And taking these patches, or the patches that would've applied, changed something about their compute platform. Right. It either move things around or broke some things. Which is why we don't see that on the plant floor. We don't, we just don't randomly patch and I think. Most organizations know that, right?

[00:21:03] Dino: Even the IT organizations will say, yeah, they never patched down there. but at the same time, there's ways to solve that problem. It's just that you're not taking the time to go through the due diligence to determine what's it take to put that patch in. is it gonna break my, SCADA application, for example?

[00:21:20] Dino: If it does, how do I back out of that? Which is why when I started working with Rockwell, a number of years ago, the virtual machines coming in were relevant, Get rid of the bare metal. Because when you took a patch, it could take you all day or two days to rebuild that machine. If the patch didn't take or if it broke something, for you to rewind it out and rebuild the machine versus a vm, you just go back to the previous image and load it back up and you're back up and running.

[00:21:45] Dino: But at the same time, a lot of organizations are not going through some type of strategy on how, stay consistent, even if it's a couple times a year. but how are you doing that? What does it take? You do that, whether it's the PLCs that need to be updated, whether it's the hmis that need to be updated, your D Cs, whatever the case may be, working with your OEM 'cause if they're still supporting you.

[00:22:06] Dino: you can't just fall back and say, well, they won't support me if we do these updates. Or I wanna put this, cybersecurity collector in there so I can collect this metadata within this environment just to see, what the vulnerabilities and risks are around this machine. I've seen OEMs flat out tell their client, no, you can't do that.

[00:22:21] Dino: Right.

[00:22:22] Kevin: that is, that is the point. And now I factually know people that walk around with seven or eight different VMs on their laptop because they don't know what version of the product they're gonna run in, at, what plant that they're called into. Basically, fight a fire on a platform that's down.

[00:22:39] Kevin: And it's almost like walking around with that, old skeleton key chain and saying, which one of these fits? And yet, they're all look the same, but they're all a little different. And now you get to the point of, okay, if I'm gonna patch things, how do I patch things? Because in some environments a system might be a 15 minute cycle, and then you've got some time.

[00:22:58] Kevin: know, they'll run for 15 minutes, do something, and then you've got, an hour till the next batch has to run. But other ones, you can't take a production line of, let's say, in a bakery that's, mixing the batter, putting the bread into the pans, and that's 24 hours a day that they're doing that and saying, let's shut down for two or three hours.

[00:23:18] Kevin: what do you do now if you've got mixers? You have to shut them down. I've even worked in plants that. One of the plastic machines for injection broke a $2 part on it broke that was never supposed to break, and all the liquid plastic that was in the pipes basically turned solid. And they had to get out the sawzalls and cut those pipes apart and clean them all out.

[00:23:40] Kevin: you look and you say, what's that cost to an organization? And so a risk.

[00:23:46] Dino: Plan, you know, so I'm gonna shift gears a little bit here and talk about something that you're currently working on, and let's talk about remote access. Space and the types of remote access that we still find out there compared to technologies that are more geared for the industrial environment.

[00:24:04] Kevin: So I don't know if the audience is old enough to remember PC anywhere, but. and I think a lot of people don't understand the difference between outbound connectivity, VPNs, and tools that are basically, collaboration type tools in an environment that let you and somebody else get in, but securities out the window.

[00:24:29] Kevin: And then you have on that spectrum as well, little dongle boxes that, you know, I'm not gonna name a manufacturer, but the size of a cigarette pack. You zip it to a din rail in a cabinet that even has the two little zip tie holes in it that you can tie it to, and that's got a web server on it. And now you've got a web server facing the outside world.

[00:24:49] Kevin: so when you look at all these technologies. They come in with a platform most times the vendor because he has to service it and it's in a contract, he picks that product. So if I walk into a facility, any type of plant out there, in North America, in anywhere in the world, you're gonna have that vendor consistently putting on the same product.

[00:25:10] Kevin: Another vendor's gonna put in a different product. There's no unified technology in these plants that says everybody is gonna come in this way because the vendors push back and say, Nope, my contract says this. You want the money? If you have downtime, you're gonna do it my way.

[00:25:26] Dino: Well, and, back that up by saying, through our discovery efforts, we find several different remote access technologies in a single plan. And if you have 30 plants in your fleet, you're gonna find, maybe a dozen or more different types of remote access technologies being used by various groups to gain access to your plant floor.

[00:25:46] Dino: That, really nobody knows what they're doing once they get in there because somebody's watching 'em, plant wants get back up and running. That's all they care about. There's a conduit that allows them to get in there and do that. And so nobody knows if they're, that they're, taking IP.

[00:26:01] Dino: Leaving something behind, bouncing from one machine to the next machine in that environment, talk, communicating with machines they shouldn't be communicating with at all. wide range of activity. And, of course we have both know Covid really kicked that door open for remote access when people couldn't travel to provide support inside these manufacturing facilities.

[00:26:18] Dino: it hasn't reeled back in my view. Right.

[00:26:22] Kevin: it hasn't. What it did shift was, well, we can talk about this in a later episode, but I've been talking at conferences over the past, you know, I. Six, eight months about peak 65, where the people that had the knowledge, the brain drain has left as people with our gray hair have retired.

[00:26:36] Kevin: Covid sort of pushed a lot of 'em out the door. They had the retirement. They said, Hey, I've got the years. I'm not going back. Company said, great. Took the money and ran that knowledge. Never went with

[00:26:46] Kevin: people. Now.

[00:26:47] Dino: Yeah, and Acquisi being another thing. Thing, right? Plants, other plants, and you don't know what's out there with the stuff that they bought.

[00:26:54] Kevin: And so now you look and say secure mode access needs to be a part of this. To tie the cyber physical together to tie the vision together. 'cause that's your conduit to get data out and you need to control that. And that leads to the five pillars and everything else that, you know, the OT people should understand at this point.

[00:27:09] Kevin: But where the real delta, I think is now, as you mentioned about how do we do this, is we don't have enough people that walk the plant floor. And I remember we were sitting at dinner one night with a steel manufacturer that by the time we just did some calculations on the back of a napkin, for him to walk his facilities would've been four and a half years.

[00:27:28] Kevin: And he was retiring in what three. You think he was gonna start that project? No,

[00:27:33] Dino: No.

[00:27:34] Kevin: that's it is do I want to take, and we know others that out there we know are on the short timers, spectrum.

[00:27:41] Dino: I've seen that, that exact same knowledge, lived it myself. Just moving operating systems on the plant floor from, windows 95 to Windows seven. And, and you know, and then wanting to skip an entire generation of Windows operating systems. 'cause it was too much of a pain years and millions of dollars.

[00:27:59] Dino: Let's just wait for the next OS to come out. That might be 10 years down the road. and we still find those old OSS in pockets. And a lot of these plants, in some instances, a lot of assets are still running old windows unsupported end of life operating systems.

[00:28:15] Kevin: Well, as I tell people this year, windows 95 is alive and. Well, and it turns 30 years old this year.

[00:28:24] Dino: Yeah.

[00:28:25] Kevin: And you look at that and you say, how many cell phones have you had in a year with updates and things and a new model coming out. And then you look and you saying, 30 years, nothing has changed on this platform. 'cause they stopped patching it eons ago.

[00:28:41] Dino: Decade.

[00:28:42] Kevin: Yeah. and you're sitting here going, it's still running.

[00:28:45] Kevin: And the people are like, yeah, it's running. Doesn't cost me a penny. It works great. And don't touch it.

[00:28:51] Dino: And forget the vulnerabilities associated with it and the risk that it places in my environment. I mean, I've had, CISOs, CIOs who will flat out say, get that off the network. You know, and well, you can't take that off because it'll shut down this piece of the plant or all of the plant at some point, and to replace it costs maybe millions of dollars to replace a piece of equipment or due the recon control effort that can cost hundreds of thousands of dollars and they just don't have the stomach for the capital spend to go do that work.

[00:29:19] Kevin: and let's not forget the opex that's on the side of that because you have plants out there that you put in the CapEx. But then they don't look at the total opex of what it's gonna cost to implement that new, basically process line production and keep it going because software is a great one where it's like, we'll make our money on the maintenance and we'll give you the software.

[00:29:42] Kevin: Yep.

[00:29:43] Dino: I blame a lot of that on Wall Street. on the capital spend. Right. Trying to get, because they're trying to poise these companies to be bought. Or trying to get this particular type of manufacturing stuff offshore, you know, so instead of investing back into sinking capital into the ground, I, I lived through that working for the beer manufacturer where Wall Street, because they were being poised to be bought and so they didn't want them spending money to squeeze out additional capacity and or to upgrade to get rid of the technologies that were, end the lifeing and becoming into support.

[00:30:15] Dino: They didn't care. that was pressure being applied by Wall Street that was keeping them from spending that money to solve some of these problems we're talking about, especially with these older assets, because we both know the lifecycle out. There's much different on the OT side than is on the IT side.

[00:30:29] Dino: Right.

[00:30:30] Kevin: Yeah, and it's not just the projects, the capital spends like that, but if your company's getting acquired, which I've been through numerous ones, they wanna end any projects dealing with compliance or security that aren't mandated or required because you might just find something and if you find something, it might just decrease the value or push the people away.

[00:30:50] Kevin: So it's, nope, we never started that. Hey, that's a great thing for you to do after you buy the organization.

[00:30:55] Dino: Yep. Plausible deniability, right. Well, Kevin, this has been great. I know you and I we'll always catch up. we do on a pretty regular basis. I appreciate you taking the time to do this, podcast with us.

[00:31:08] Kevin: Absolutely Dino, it was a pleasure and Luray, it was great that you invited me on the guest and, uh, be happy to come back and do more of them with you.