The Blind Spots Putting Manufacturers at Risk: WEF 2026 Global Cybersecurity Outlook

Dino [00:00:00] anything new you bring in is gonna be highly sophisticated equipment.

Dino Right. It's gonna have mm-hmm. Technology in regards to operating systems and applications and firmware and networks, but we don't necessarily find a lot of cybersecurity wrapped up in a new stuff. Right. We always see the safety, the physical safety is usually always being approved upon, but not the cyber side, that's missing in, in my book.

LuRae Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

LuRae Hi, my name is Lura Lumpkin and I am the producer of the Industrial Cybersecurity Insider. And today I'm joined by Dino [00:01:00] Busi, an expert in the field who's gonna join me to talk about the World Economic Forum recent 2026 Global Cybersecurity Outlook Report. Welcome, Dino. Hi

Dino Lura. How you doing?

LuRae Good, good.

LuRae Excited to be talking with you about this. You have got so much experience having walked and lived this, walked the field, walked the trenches,

Dino still doing it.

LuRae And so I thought we'll start off with some of the, topics that were prevalent in that global report, which is they talk to over a thousand, almost a thousand people, CEOs, CIOs, CISOs, What are you seeing as far as the cyber resilience and, what's happening out in the field still today?

Dino I think the majority and the bulk of the funding and the resources and cybersecurity, if you wanna talk about that, is still wrapped up in the enterprise, in the IT space per se.

Dino Mm-hmm. the very large companies, which probably many of them would've attended an event like the World Economic Forum, are, are started [00:02:00] programs with how to deal with their OT cybersecurity. Mm-hmm. But it's been very limited. You know, the reach is, has not been to the, depth of what they should be chasing within their manufacturing environment.

Dino And some of them might sit and think, well, because I got technology that's out there, that's, you know, decades old, it's not connected. and so they may view that as not being a risk outside just because of the nature and the age of that stuff. but on the flip side of that, we don't typically find that's the case.

Dino There's most of that equipment. Is connected, and it's connected for various reasons, right? One is just simple support. Mm-hmm. Right? You got two choices. You can either wait for somebody to fly to your site and go out there and connect into that machine center and try to solve whatever problem or add whatever enhancement you're looking to have made.

Dino Or they got a remote in.

Dino So they aren't connected. Right. And we see various different types of technologies that are deployed inside these manufacturing environments to let these OEMs and system integrators gain access. So to sit and think that it's not connected is not true. [00:03:00] Right. Right.

Dino And so, and then, and then there's the, the other thing is the enterprise, the business is also after a lot of the data. Mm-hmm. As are the OEMs and system integrators responsible for maintaining and supporting that equipment. Want access to that data too. Maybe to improve their maintenance windows. Mm-hmm.

Dino uh, make improvements upon the machine itself, improve its safety, improve its operation. It it. It's a functionality. And so there's, constant communication going on. Mm-hmm. At some point with that equipment, it is not disconnected, you know? Mm-hmm. And then, you know, if you wanna talk about emerging technologies, well, anything new you bring in is gonna be highly sophisticated equipment.

Dino Right. It's gonna have mm-hmm. Technology in regards to operating systems and applications and firmware and networks, but we don't necessarily find a lot of cybersecurity wrapped up in a new stuff. Right. We always see the safety, the physical safety is usually always being approved upon, but not the cyber side, that's missing in, in my book. So, and I think it's because of how they spend their money. [00:04:00] We got capital CapEx, you got opex, which is usually where the IT folks live and breathe. That's how they get funded to get the money that they do. The OT side is, is generally CapEx driven, right?

LuRae Mm-hmm.

Dino Right. And we do have some OPEX money, but that OPEX money doesn't have cybersecurity. Line items. Right. And the budget for that. Mm-hmm. Because it's, it's pulled all the way back thinking that it is dealing with it and the fact that they're mm-hmm. They're either not doing it or they're doing it in a very limited fashion.

Dino Right.

LuRae Yeah, absolutely. One of the interesting things was how AI is getting so much attention, and it was like 94% of the people in the survey said that that was like one of the biggest concerns. I think the flip side of that, the bad actors also using ai. I'm curious what you're seeing mm-hmm. Or what your perspective on AI from kind of both angles would be.

Dino Well, you know, from an AI perspective, If you get enough folks that start really focused on industrial [00:05:00] control systems in regards to ai, it's gonna be a catastrophic problem in my view. Mm-hmm. Meaning that right now most of the, attacks that happen come through the it ranks.

Dino Now that doesn't mean that somebody walking into a plant floor, 'cause we've seen this too, an engineer walking into a plant floor with their laptop, and plugs it in the environment, has something in it that gets out in the environment and it makes, its. Way around Right. To through the business. Right.

Dino So it can happen at the IT or the OT level. Mm-hmm. And it does a lot of times though it's coming in through the it mm-hmm. You know, ranks to create, to be able to drop these payloads in, right? Mm-hmm. If that's the intent, I think with ai, people are gonna start being able to use AI as a way to determine, well, how can I cripple a control system?

LuRae Right,

Dino right,

LuRae right.

Dino and when you have control systems that haven't been patched in years

LuRae mm-hmm.

Dino Have hundreds of vulnerabilities and risks associated with them. And we find this every single day. Right. Which is different with it 'cause it [00:06:00] patches on a pretty consistent basis.

Dino Right, right. That's. That's why you see Patch Tuesday, they, they're constantly patching and updating on their side. Mm-hmm. It doesn't happen on the plant floor.

LuRae Mm-hmm. And

Dino we go in there and do our visibility studies assessments, if you will, and we're looking at those risks and looking at the thousands of vulnerabilities that we find in just.

Dino One plant Right. By thousands of them. Mm-hmm. Things that have been patched in a decade from your PLCs, your network switches, your hmis that are running Windows operating systems, your, application servers. In a lot of cases, the robots that are out there, they've not been touched. Mm-hmm. And don't have vulnerabilities that are pretty significant.

LuRae Right.

Dino You know, if AI is ever leveraged to go, you know, to create remote code execution or something that mm-hmm. can denial of service attacks or, you know, something that can mess with the memory on a, a control system. it's gonna be bad days for folks if it gets to that level that AI is driving that.

LuRae Yeah. And I know that the other thing I've seen and read some [00:07:00] about is. AI now being put in the solutions for the, you know, companies who are trying to alleviate cyber events from happening. But the risk I could see happening, and maybe you've seen some of this already, is people relying too much on, oh, AI's in this new solution we just put in place.

LuRae So it's gonna catch everything, but you still need a human right

Dino in the loop. Right. That's what we call it. You know? And to your point, when it makes, comes to that. You know, anything that that can have a kinetic change, ideally you want a human in the loop to be able to determine whether that needs to be allowed to happen or not.

Dino Right. Right now when you don't have visibility into the assets that you have, nor have a good understanding of what the risks are with those assets based on the current operating system or firmware version that they're running, or what remote access actually looks like, and they're, They're kind of wide open. Right. How do you, you know, how do you put a score on that? Right. Right. And the enterprise, they probably do. I'm probably, I, I gotta [00:08:00] believe that there's metrics and targets that are presented to the leadership of the company. Yeah. Of all the things that they're doing to trying to close these doors.

Dino All the things they're trying to do to thwart these attacks. You know, all these denial of service attacks, anything that's coming at 'em, all the things that they're doing to, to, to shield from it.

Dino What are you doing on the plant floor? And it's like crickets. Because if anybody says they're doing anything, my next question would be, well, let's talk to the OEMs and system integrators that are working in your plant today.

Dino Right. And see what, who's giving them targets on how to help solve some of these problems. And I know what the answer's gonna be. It's gonna be zero.

LuRae Right.

Dino Right. I work in that space and I don't have CISOs and CIOs or security people calling us up about what's we're doing inside their manufacturing environment and whether we're designing and building and deploying equipment,

LuRae right?

Dino Or maintaining and supporting the equipment that they have today and gaining access to that environment.

LuRae Well, it's interesting 'cause that's a good segue into one of the other topics that emerged as one of the bigger concerns. Almost half of them, 46% are [00:09:00] concerned about third party and supply chain vulnerabilities.

LuRae I think with what's happening with, other countries getting parts and buying things. Material.

Dino That's right. what are they doing? you know, and we went through this exercise in Y 2K. Right, where not only did you have to determine that you were gonna be able to operate on January 1st, 2000, but the people who supply you.

Dino Right. With goods, indoor services, are they prepared for Y 2K? Right. Right. And, and, and there was, you know, evaluations and assessments that were done to make sure that when that clock turned over to January 1st, 2000 that you were still able to run your applications, able to run your systems.

Dino Were you able to run me working in a very large adult beverage manufacturing environment to make sure we were still making beer?

LuRae Right.

Dino Right. So, but yeah, to, to your point, that supply chain, same thing I'm saying about the OS and system integrators, they're not really looking to see. What chemicals, what raw goods that are [00:10:00] supplying them to make whatever product that they're making, whether they're gonna be able to continue to do so because they're doing, uh, best practices in regards to, you know, cybersecurity and their industrial control system and automation environment.

LuRae Yeah, so I think that the lack of supply chain visibility, that was also one of the, you know, top concerns of even knowing where's everything coming from, and is it even secure the, the. Parts that they're getting and putting into the plant floor. So I don't know what you,

Dino well, you make sure that you can still get the goods you need to be able to, to make the goods you're supplying to your end customer, right?

LuRae Right

Dino there, there's no metric out there. There's nothing that, that's being looked at to say, do you do incident response?

Dino You know, what kind of cybersecurity technology are you using in your plant floor today? You know, and what does that look like? How would we score you on that based on, you know, on a scale of one to 10, you know, 10 being the best, one being the worst, are you a one or a two, or are you a nine or a [00:11:00] 10?

Dino Right. You know, and I can tell you where most manufacturers are gonna fall and it's, it's gonna be less than five.

LuRae Right. Right.

Dino You know? Well if one's depending on the scale, right. So 10 being the best they're gonna be less than five.

LuRae Right, right, right. Well, and I think it's, the other thing I think of is also like secure remote access.

LuRae Going back to even like the COVID days where, you know, people, it was more difficult to go out into the plants. But even now, what companies are buying products? They're still buying products from. Other countries where if you want the warranty to be in place, you need to give them access to your plant floor.

LuRae But how do you manage that in a safe way?

Dino It depends on the, on the vertical, depends on the organization. Some not very well, you know, 'cause I, we've talked to a lot of it folks that have recognized that there's a lot of, variable ways to get onto that plant floor to provide support, you know, and on average we find a hand.

Dino You know, in a medium sized manufacturer, medium size, meaning, you know, half a [00:12:00] million square feet, you know, maybe generating, you know, a couple hundred million to a billion dollars worth of revenue a year, at that plant that they will have several different remote access. The access to technology is deployed within their manufacturing environment.

Dino Some they're aware of, some they're not. Even in the ones that they're aware of, once that connectivity has been provided, they don't know what goes on once they get in there. Right. Do whatever it is they're being asked to do. Right. Right. You know, in a lot of cases you're still finding large layer two flat networks on the control system side.

Dino So if you're being tasked with working on my filler on line seven, and we provide you access to that, and you land on that control system network for that, all of a sudden you can see not only that. filler, but the entire packaging line for that filler and the other packaging lines, and oh, by the way, you can get the utilities or you can get the mixing and blending because they're all sitting on the layer layer two network.

Dino Now, it is not a, a good enough job [00:13:00] in recognizing a. the segmentation is, is lax in that environment, right? Mm-hmm. But the problem for them is, well, how do I design and build a network for control systems that I don't have any knowledge of? I don't understand how it's supposed to work, what's supposed to communicate with what I don't know what the applications are.

Dino And so. what they do is they just try to build a wall between them and IT and ot, you know, the whole IT OT convergence conversation turns into an an it OT kind of a blockade, right, if you will, where it is just trying to protect themselves from the OT side of the house and whatever happens down there on the OT side's, not their problem.

LuRae there was another point made that was a concern of overdependence on certain critical suppliers. So what's your take on, you know, I know there's a mix and match of what people, companies decide to put on the plant floor, whether it's. To make the goods or to secure the goods

Dino or, well, it's very decentralized, you know, compared, again, comparing it [00:14:00] to an IT strategy where you would centralize everything, standardize

Dino know on equipment and technology.

Dino The plant floor, not so much.

LuRae Mm-hmm.

Dino Now they buy equipment potentially from all over the world. That are built and designed by organizations that are all over the world. And, I've, I've never, and I've been in, you know, if I've been in a thousand plants, I've been in almost 2000 plants in almost four decades.

Dino Nobody's got the same singular. Homogeneous automation technology product in the plant. Mm-hmm. There's usually a handful.

LuRae Mm-hmm.

Dino Just like there's a handful of remote access technologies. There's a handful of automation vendors, and there's Rockwell, Siemens, Anderson, Emerson, Schneider, ge, you know, Mitubishi yoga, you know, stuff that's.

Dino Proprietary made out of Italy or Switzerland or Germany, you know, south America that just comes in and wow. Whatever they bolted together, you know, to make this machine do whatever it needs to do. Right. You know? Right.

LuRae Well, I know another area that was [00:15:00] highlighted was the lack of cybersecurity skills and expertise on the plant floor and in the organizations to be able to even do cybersecurity effectively.

LuRae So what's your take on that?

Dino Yeah, there's not a lot of out there. We've had to grow ours, right? I mean, generally speaking, we had to get people, you know, we've been cutting right outta school. You know, most of them have industrial backgrounds, meaning they're electrical engineers, chemical engineers, process guys, and some IT people.

Dino and getting them into the manufacturing environment, meaning that part of their job is working in the plants, right? Mm-hmm. As far as their day-to-day work, the technologies they work with outside of just doing the analysis and designing and deployment, part of their job is to work in the field, right?

Dino We find a lot of IT organizations, they don't like to spend a lot of time on the plant floor. In a lot of cases they've never been to their, their company's, plant floor. Mm-hmm. Working on it specifically, you know, or if they have, they haven't been there in a year or two, maybe they go every other year.

Dino [00:16:00] So finding the skill sets 'cause the schools aren't teaching it. They're not teaching industrial cybersecurity per se. Mm-hmm. I mean, I haven't seen many programs. There might be a few out there now, but there's not been Right. A plethora of them that are putting, you know, thousands of students mm-hmm. Are coming out into the workforce with a background with industrial cybersecurity.

Dino It just, a lot of them out there, our clients don't even have a Right.

LuRae Right.

Dino You know, they're trying to get people and, you know, put the round peg in the square hole. It's like, well, Joe's got an industrial background. He's been working on the plant floor and some of the computers and you know, Susie over here has been working in the IT stuff on the network.

Dino Let's see if we can't get those two together to go figure this out.

LuRae Right.

Dino Okay, you got two people, but you got 50 plants. Right. Right. Tell me how you scale that.

LuRae Right, exactly.

Dino Is that something you wanna do in the next decade? You know? Right. Or you're looking at 20 years, or you looking at growing a practice.

LuRae Right.

Dino You know, that could literally cost you, you know, $10 million to grow a practice, to be able to have the skillsets [00:17:00] and the resources you need to go do this.

Dino that's why a lot of it organizations outsource. Why do they outsource? 'cause they don't want to try to chase and find and keep talent that they got high technical, skilled individuals and, and try to keep 'em happy and, and have 'em work for a dog food company or for a brewery.

Dino You know, I mean, why would they. Right. What are you gonna get with that? Right.

LuRae Exactly.

Dino For a couple years. And they realize that they're much more marketable working for a, an organization that does this every day, all day. And they can make a heck of a lot more money doing that than they can working in some field in Iowa.

Dino That's, you know, running a. Food plant, you know?

LuRae Right, right. Which is why, yeah. I think you are, you know, such a great solution for so many companies because you've got the expertise. You live and breathe it every day, and you're not just fitting it in with, you know, 50 other things in your day, which is typically what's happening, I think, out on the plant floor.

LuRae It's like they've got other priorities, and this is just one more thing on the to-do list,

Dino again, it's following the IT model [00:18:00] for

LuRae services, right.

Dino Right. What's the most effective, efficient way to get something that I need that's beneficial to my business, but I really, it, it's not my core competency.

Dino I'm not an it, IT shop, you know?

LuRae Yeah.

Dino And even companies that have large IT organizations, I've seen that pendulum shift, you know, depending on which CIO and the board changes that are made, or chairman, CEO. Mm-hmm. And they want outsource everything and then they move everything right to the other side of the equation for several years and it's like right.

Dino Else comes in, they come move it back in. It's, or there's a blend sometimes right? Between, you know, your own, professional IT group and your services organization that are there to help you, you know?

LuRae Right. Well, I know

Dino we, it's easier to manage a contract some cases than it is trying to hire a bunch of highly skilled individuals.

Dino And this stuff here is just that because you got equipment that's been out there for, couple of decades,

LuRae right? Number

Dino one. and the technology's not even well, very well understood. You take a company like Rockwell, you know, and look at some of [00:19:00] these foundation field bus networks as we used to call 'em, you know, the data highways and the control net networks, and it's hard.

Dino It's, and there's still a lot of that stuff out there,

LuRae right? But

Dino it's becoming very hard to find people that know how to work with that technology,

Dino cause if you're rock, what Rockwell will tell you is like, yeah, you need to get rid of that, and it might cost you a few million dollars to do that.

Dino But that's what their position is. You need to get rid of that stuff. We're not, we're not taking care of it anymore. We're not supporting it anymore. We're not making cards for it anymore. You should get rid of it.

LuRae Yeah, absolutely. So I know one of the other things highlighted, which really was a surprise, like surprised me as long as this has been now become such a visible to us, it's visible anyway, that there's a need to do something, to be proactive.

LuRae Don't just wait until you're a victim that only 27% simulate cyber incidents or conduct recovery exercises like we're they doing tabletop exercises only. 27% do that. what's your take on companies who've never done like a tabletop? Yeah. I

Dino don't [00:20:00] believe that number. At least not to the extent that it's making its way down to the plant.

LuRae Right.

Dino Right. Because we're, we don't get involved with tho those types of activities. 'cause if they were, we'd be, be doing that.

LuRae Right.

Dino Not coming out to your plant. And I've been working there for several years and been working on doing tens of millions of dollars worth of automation work. No, but we are not sitting down, going through some IR plan that they put together.

Dino Right. You know, as part of that, they're not asking us to participate in it or, you know, help them, put something together or to, you know, add that into our contract for ir. They're not, none of them's doing it, so whatever they're doing it, whatever level they're doing in it, they're definitely not doing it at the plant level.

LuRae No. No. Well, I think that the. Almost the point only one in four. So that's like three fourths of them aren't doing anything. The other point was that only a third are mapping their supply chain ecosystem. So they didn't even have that mapped out.

Dino Yeah, and even, even if they're working with a plant, they're just doing it, cloak and dagger, meaning that they're doing it [00:21:00] just an internal exercise.

Dino It's not including their supply chain. Right. Whether it's their OT ecosystem, that's a part of the activity to go inside that plant. Day in and day out every day. Right? Because we don't see 'em, you know, if I'm talking to our client facing, partners and directors who are working out there, and you start asking those questions, like, yeah, we never get, and it's not in the RFPs, right?

Dino It's, it's not part of the, the weekly calls on support. It's not on any strategy. You know, you've got a shutdown coming up, you know, next month, here's what we're gonna be doing. This is we're gonna add an IR plan, you know, activity in there. That stuff doesn't exist. Right.

LuRae Right. You

Dino know, and we work in, you know, 25 or 30, 35% of the largest manufacturers in, in the United States.

LuRae it seems like until someone gets hit, it doesn't become a priority then they're in recovery mode. Like, so we talked about the Jaguar Land Rover that was highlighted in the, report. The impact of [00:22:00] that.

Dino Yeah. It impacted the country's GDP. Right.

LuRae Exactly.

Dino Right. And then we've seen big hits to large manufacturers here, and I, most of 'em just sweep, try to sweep it under the rug.

Dino Right. Keep it as quiet as possible, you know? Right. I try to minimize the noise, to the fact that they're losing hundreds of millions of dollars, if not a billion or two, depending on how big they are, and

LuRae right,

Dino how far and wide this thing got. And, and just live through it and say, if it happens again in 10 years, we'll call it a win, I guess.

LuRae Well, it was interesting. There was even a conflict or, and priorities even between what the CEOs had as the number one concern that they had versus the ciso, you know, the CEOs worried about like cyber fraud and things happening with, with, you know, data. And then the CISO is concerned with ransomware and so that's their focus and it's like OT just.

LuRae Fall, the T cybersecurity seems like just fall right through the cracks in their [00:23:00] priorities. I dunno. What is your experience with that in getting the attention of either the CEO or the CISO to make this a priority?

Dino one, you don't have the skill sets you need. Within the OT organization on the client side to be able to drive this narrative above and beyond what it has been doing for the last 20 years.

Dino and at the same time, when it comes to ot, all the decision making when it comes to technologies that are chosen to be inside these plants, 90 plus percent of the time it's being decided purely by an OT group. Again, CapEx. I don't think that the CISOs and the CIOs, you know, I've seen, I've tell me I don't wanna be the SC a cop.

Dino I wanna keep it and OT separated, and if that's their position, that's fine. that's okay. But somebody needs to be leading the OT charge of this, and that's where, that's where it's fallen down, right? Because you don't have the skillset within the OT environment. to wrangle this in and try to get your arms around it, right?

Dino Mm-hmm. Build [00:24:00] a budget, look at your partner, supply chain ecosystem to find out who are the capable organizations that can really help me with this and start building and moving on down your own path.

LuRae Mm-hmm.

Dino Doesn't mean that it can't participate. Like I always say, you want 'em in the huddle, right?

Dino You want 'em on the field.

LuRae Right.

Dino It just can't be the quarterback.

LuRae Right. Right.

Dino You know, and I'm sure there's some IT executives out there listening to me say that though, that's a bunch of, you know, bull and it's like, well then pick up the phone and talk to your top sis and OEMs out there and start building a bridge to find out what they're doing inside your environment.

Dino Mm-hmm. Do you see how you can prove that cybersecurity posture? 'cause if you're not doing that, then I'm not full of full of it. You are.

LuRae Oh, well. Any other final thoughts that you have on all of these topics or what you've seen work successfully For someone trying to run the football down the down the field, that's worked well.

Dino I use the term, you gotta get all liars in the same room, right?

Dino Mm-hmm. And it, [00:25:00] it's one of those where you gotta get the IT leadership, the OT leadership, and their trusted partners in the room to figure out where are we and where do we want to go, you know? Yep. A lot of them do it. They, they, some of them, you know, they're working with the high dollar consulting organizations, they'll sit down with and get a nice flowery report that they spend a half a million dollars for telling you what you should do.

LuRae Right.

Dino Not how to do it. Mm-hmm. Not how to get there, what you should be doing. Right.

LuRae Right.

Dino and that's what, you know, that's what they'll get put in front of the board, in front of the chairman of the, of the company, the CEO, and say, yep, here's what we need to do and what's it gonna cost? And that's a thing.

Dino And that's where they don't really know what it's gonna cost.

LuRae Mm-hmm.

Dino They have no idea because they don't even have a really good asset inventory, number one.

LuRae Right.

Dino Number two, they don't know what the risk and vulnerabilities are associated with those assets they have out there to determine how do I prioritize which ones I wanna do this year versus next year versus five years.

Dino Right. Right. and then pair down that the microsegmentation of the network, which requires that you're gonna have to [00:26:00] get the OT community involved if you're gonna start making changes to do comms pass around control systems.

LuRae Mm-hmm.

Dino Yeah. You need to work with controls people to do that.

LuRae Mm-hmm.

Dino It's not like something an IT person come in and do independently.

Dino They have to work with those engineers that understand those applications of those machines to be able to determine what, what path and comms make sense versus which ones don't.

LuRae Right. Well, and I know I've, I've seen you from the outside. I've not been in the trenches with you, but where one plant steps up, you go out and do one plant to give them an idea and a sense for what's happening.

LuRae What does it look like? Where are they vulnerable? And that can open the door for them to realize, wow, we are, we are exposed. If we're exposed here, what do the other plants look like?

Dino Yeah. Well, and you have to almost get that your mind wrapped around the same way you pay for insurance, right? Mm-hmm. You spend $5 million a year for insurance, and you may never have to use it, but it's there,

LuRae right?

Dino [00:27:00] For a reason. Why wouldn't you spend a million dollars or, you know, for a couple of plants to be able to prevent things that can cause that $5 million insurance policy to, to have to be used. Right. Right. Because a lot of 'em depend on that. It's like, well, we got insurance. That's how we get our money back.

Dino Remember, that's just to pay for remediation.

LuRae Right.

Dino That doesn't pay for the, the, the business loss of operational loss of your plans being down for a week, two a month.

LuRae Right.

Dino that's just money that's gone.

LuRae Yeah. Let alone, as I always say, the brand impact, the consumer impact if it gets out in the press.

Dino Mm-hmm.

LuRae It can affect stock price. Just we sell with the Jaguar Land Rover.

Dino Right. We've seen that where, manufacturers of loft shelf space, 'cause they couldn't put goods out there.

LuRae Right.

Dino Shelf space was given to a competitor,

LuRae So I would just say anyone who hasn't done something, I mean, this World Economic Forum report reinforced to me for sure that there's such a need out there and people still aren't taking as proactive [00:28:00] action as much as they should to protect themselves, their organization, their employees, the people in the community, all the potential impacts.

Dino Yeah. But it's almost like growing A-A-C-I-O or a ciso, you know, the question becomes. you can either have your own for the OT side, right? And then, and that way you end up with two. Mm-hmm. You have one for the IT and one for the ot. Mm-hmm. Or you, you're gonna have to get somebody that comes from the OT world and have them become that CIO for the organization, right?

Dino Mm-hmm. So that way they're looking back at it from, this is where we generate our revenue.

LuRae Mm-hmm.

Dino And I'm coming at it from a manufacturing experience with the technologies we use there. And I, I need to see how I can map as closely as I can and budget and resource. Right, right. Leverage resources that don't have internally.

Dino Mm-hmm. Where I find partners to come help where we, we see fit. I mean, every single client we go into, nobody, I haven't yet to meet a, a [00:29:00] manufacturer that's taken one of these, cybersecurity, solution sets and ran with it well.

LuRae Hmm.

Dino You know? Right. They, I, I just haven't, and I've seen hundreds over the last 10 years it's just not the case.

Dino It's because of that disconnect between 19 ot, I keep going back to that. Right. Again, I'm not saying it's right, but that's just the nature of the world. It's like oil and water, night and day.

LuRae Right, right.

Dino They're very different organizations with very different charters and priorities. Trying to make this work to get the OT world to be as sufficient and as capable as the IT world.

Dino How are you gonna do that? Right. You know, I am all ears. Explain it to me. Right, right. 'cause the only way I see it right now is they have to work with their supply chain, their ecosystem with people who understand that equipment and how it works mm-hmm. And why it operates the way it does.

LuRae Right? Yep.

Dino Able to wrap things around it to protect it, right?

LuRae Mm-hmm. Yeah, because I mean, I even think, as you've said [00:30:00] many times, people can make the investments so that it can buy something. They check the box, they tell the board, yes, we have this in place, and it's shelfware. It's not even fully utilized or operationalized to do what it's meant to do. So they still get attacked.

Dino and when they get attacked, the question is what's been impacted? Right. In most cases, everybody sees it through the lens of my business systems and Windows environment is the one that's being disrupted.

LuRae Mm-hmm.

Dino Yeah, but so is your plant. not putting it in that bucket because it has Windows operating systems and it has networks in it, and it's also impacted, but you're lumping it in with your IT stuff, even though it has little to nothing to do with a lot of those Windows machines on your plan floor, right.

Dino That have been out there for 10 years.

LuRae Right. Well, this, I, i is a great report. If, anyone out there hasn't taken a look at it, definitely I'll put a link to it in the show notes and thank you so much, Dino. You're always a wealth of knowledge. [00:31:00] For anyone out there wanting to get up to speed, I would reach out to you in a heartbeat.

LuRae Thanks,

Dino Leray.

LuRae Thanks for tuning in to the Industrial Cybersecurity Insider to stay up to date with our latest episodes. Be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening.

LuRae See you next time.