The State of OT Cybersecurity From the Field

[00:00:00] Gerry: You gotta remember, these kinetic events have concurrent causalities, and those are simple as things.

[00:00:04] Gerry: Fire, have boiler explosions, this is all now at risk. By the way, that has absolutely nothing to do with cyber insurance. That's property insurance. The ensuing concussive things that fly and go flying through the air become workers compensation insurance. Those are the things that are absolutely not being talked about, and we have been saying, um, Everybody needs to slow down, take a look at insurance very holistically.

[00:00:28] Gerry: And what are we affecting with the ubiquity, what we call IT and OT risk.

[00:01:04] Dino: Hi, my name is Dino Boussalaki, and I'm the chief technology officer and a co founder of Delta Technology. And today we have Jerry Kennedy from Observatory from the cybersecurity insurance industry speaking with us today. Jerry, you want to introduce yourself to the group?

[00:01:19] Gerry: I'm Jerry Kennedy, CEO of Observatory.

[00:01:22] Gerry: How's that for a start there, Dino? Good to see you again.

[00:01:25] Dino: Yeah, it's been a bit. It's been a few minutes. So, I like your background back there. I guess you're enjoying the snowstorm

[00:01:30] Gerry: we can give a little backstory on that. so we obviously setting up for this thing today, we always pick the backgrounds, but I figured I'd do weather out the window.

[00:01:37] Gerry: And yeah, we're in the middle of a pretty heavy blizzard and blackout right now, but I didn't want to miss your podcast. So I, I strung up strings across the trees. I had birds carry stuff, wires over, you know, it's pretty good stuff. We're good. we're, we're plugged in. We went analog for you there, Dino.

[00:01:52] Dino: No, I'm wearing my Cardinal hat today because today's the home opener. So it's like a holiday here in St. Louis. So, so Jerry, tell us about your journey into insurance. Cause I know you've been doing it for a number of years, just in a general sense, but then cybersecurity insurance over these last few years, since we've bumped into each other.

[00:02:09] Dino: That's pretty cool.

[00:02:11] Gerry: about 15 years ago, we got involved with, stopping texting while driving. we have one of our, client's daughters got killed during just distracted driving. And we had a couple of smart people. we went to meet with, MIT type people, very, very intelligent people in Boston area, and, uh, we solved the problem for texting on driving.

[00:02:29] Gerry: it's a long story. I'm going to make short for you, Dino, but. We fixed it, but we found out, you feel very noble to get things out and utilizing insurance as a vector to, be a change agent, it seemed very commonsensical. It was common sense, but it was very, very hard.

[00:02:45] Gerry: when we have that unit called Kairos mobile, it uses a data diode of all things, you know, what you and I've talked about many times. Then we went forwarded into a the Bluetooth of the car. that's where we intersected with cyber because we were working so amazing people at AT& T and Verizon and a couple of other, the MSPs, out there.

[00:03:04] Gerry: And, we started looking at our own product as a threat vector by taking that unit, porting data in, where we're creating a new threat, in this case, into vehicles. well, the answer was possibly. this journey has been going from possibility to probability for the last, I don't know, I 15 years, do you know, and obviously I met you several years ago, spent some time with your CEO, Craig, and your team in Cleveland that I talked about some of the OT side, which is the stuff that keeps me up at night, frankly.

[00:03:30] Dino: Well, we recognize, talking to some of our clients that, even from prior to Delta, some of the very large corporations that I work for, they sell funding around cybersecurity insurance specifically. We have clients that can't get. Cyber security insurance, or they're starting to, receive requirements on what they need to provide to even, see what they can get.

[00:03:50] Dino: So they're used to what it would present from a technology standpoint from, the application being submitted. But now the insurance companies are starting asking other questions about your industrial environment and what you're doing. and so your industry, what do you guys see in because I go clients that just, self fund instead of going after trying to get cyber security insurance. It seems very complicated in my book.

[00:04:12] Gerry: It was as complicated as it needed to be, but my industry didn't do their job. We actually fostered the complication because we did not know what we were doing.

[00:04:19] Gerry: You got to remember the really first cyber security event, cyber event, let's call it, was Y2K, that's where we became familiar with it. That was in 1997 when we were writing Y2K coverage, just before the word cyber insurance ever was uttered. I was the underwriter on those things back in those days. And peers of mine, were out there selling it, very successfully.

[00:04:39] Gerry: We learned how to do it. And between now and then we forgot how to do it. So, we understood the policy input implications of. And we'll talk about OT heavily here on this thing, what I would call IT and OT and exfiltrations that cause the ensuing concurrent causalities.

[00:04:57] Gerry: Now that's a mouthful, I know that. What does all that mean? Well, if data flows in and out, I can make things go boom. I can make them catch fire. I can make them crash. I can make them operate wrong. I can make them crush. I can make them lift. I can make them, I can change everything. But it's amazing what else you can do.

[00:05:13] Gerry: And you look at the IT side of it. Something has to move on a certain date. I can change a calendar so it doesn't move on that date and causes concurrent causation.

[00:05:20] Gerry: we are also, getting worried about people who are quote unquote self funding on these things. That's not going to protect you. The allocation of, companies like yours, you are insurance insurance. This, you know, it's a transference of risk. That's all it is. It's not a policy.

[00:05:35] Gerry: It's not written word. It's not a premium. You purchase something. The premium is buying Delta many cases. That's a pre loss strategy. You're not talking about that many, many times. So the way you use yourself funding has been. Basically, 404 error for all you ITOT people out there. It's just an error.

[00:05:52] Gerry: Stop. You have to fix it. You have to back up. Relook at this thing and say, you know, if you're going to bow down to the, great Whopper, as I love to propose, you know, the church of the blinky lights. it's not getting it done. Only you as a customer know your business. Okay. You understand your P& L.

[00:06:09] Gerry: You understand your tech stack, but what you don't understand is your legal stack. That's what Observatory has been mastering for these years. And that's why we've got such a great brand out there as we are considering. So what happens is when somebody self insures, I think, you what they really need to really look at their budget for insurance, they need to rebrand that line item.

[00:06:29] Gerry: And then what, what is insurance? Is the cyber insurance going to stop the loss? No, it's a cashflow issue. That's all it is, the fines recoveries. But. You gotta remember, these kinetic events have concurrent causalities, and those are simple as things.

[00:06:42] Gerry: Fire, have boiler explosions, this is all now at risk. By the way, that has absolutely nothing to do with cyber insurance. That's property insurance. The ensuing concussive things that fly and go flying through the air become workers compensation insurance. Those are the things that are absolutely not being talked about, and we have been saying, um, Everybody needs to slow down, take a look at insurance very holistically.

[00:07:06] Gerry: And what are we affecting with the ubiquity, what we call IT and OT risk. that's a long winded answer for, the way that people are allocating money, but we've got to rethink this. That's why you guys are so important. You help the mapment of risk. Well, we in the insurance industry are not asking guys like you, I am, we're building products and around working with guys like you because it's considerate.

[00:07:28] Gerry: We don't know what, you know, we learned that didn't and

[00:07:30] Dino: we have clients, ask us to start down this process. I've heard this from 3 different technology companies over the past year. 1 of them just recently event in Charlotte. you would hear this from Cisco.

[00:07:41] Dino: You would hear this from Clarity. I heard this again from Armus. And these are, companies, everybody knows who Cisco System is, generally speaking, but they also have an industrial cybersecurity technology stack that they have. What they would say is 60 percent of manufacturers out there, OT organizations, are in the unaware to aware phase.

[00:08:01] Dino: Of beginning to do anything in regards to looking into their O. T. cybersecurity practice that they don't have you have 30 percent that have started doing something. They started scratching the service. The proof of value P. O. B. maybe they put it in a couple of plants. They're starting conversations.

[00:08:20] Dino: And you have 10 percent that are on the other side that are moving towards operationalizing these tool sets and integrating them. All in all, you've still got 90 percent of the manufacturers out there still kind of, I use this term, navel gazing, they're just not really engaged in how to get out of their own way to even go after this.

[00:08:37] Dino: Now, I have my own thoughts on that. I think a lot of it has to do with the misnomer that IT is leading this. In many cases, they are. But they can only get so far because once you move from that carpeted space to that concrete floor, there tends to be a pause, So that perspective, and they know they're trying to put cyber security policies together.

[00:08:58] Dino: That's part of their ask has come from the board. the risk that's there. So, what should they be focusing on? Yeah. In your mind,

[00:09:06] Gerry: the whole stack, all of them, if I don't know which model they're using, if it's a Purdue model or the OSI model, just pick one. Let's get started there.

[00:09:13] Gerry: Look at the whole stack. Find your best people that actually understand the stack and what solution lies in the stack that you have figured out. We've done that, Matt, and we did it with you. we've had some successes recently, just talking just like this, bring in the experts that actually are not what you perceive to be your specialist because they're not getting it done.

[00:09:31] Gerry: It's not a moral hazard. Not getting them. They just don't know to know. So what's happening. We're seeing consistently is. Very often, Dino, we know too much, And then when we show up, they're like, Oh, I don't want to hear that. Because that's what we call a knowing to know liability. Now they really got to do something about it.

[00:09:47] Gerry: Who cares? That doesn't matter. If you hear what we tell you and you know about it and even attempt to mitigate it, that's creating reasonable care. what's going on right now is unreasonable care, it's persistent, it's constant, and when these things go kinetic, believe me, you're going to meet the rights of recovery very, very hard.

[00:10:05] Gerry: We're going to look at the business judgment rule on a post loss basis. Boards of directors, I hope you're listening, because we're going to find out, you don't need the business judgment, your DNO will not help you. You will be denied. I have plenty of my friends who are going to relentlessly, expressly tell you, you're going to be denied.

[00:10:20] Gerry: Going out to what I would call the new idea of insurance that companies like Belta, we have friends that that are doing stuff in entropy and all these wonderful areas, if you're not looking at tempting to rectify these situations by identifying the risk in the first place, when that's what you guys do so well.

[00:10:39] Gerry: How do you know where you're going? If you don't know where you are, it's as simple as that. But what we're seeing consistently, you know, is the good ones that are out there. And we have talked to them, you and I, they're embracing the risk, you know, they're holding on to what do we do with this? How can we tell our customers?

[00:10:55] Gerry: Yeah, we got this. That's the risk in and of itself. That's called disclosure. And number two, the embracement says, look, we're going to map this risk to the best of our ability, but we're also going to look at you. You may have the same problem we have. That is where the community, which have developed, a lot of us, you know, there are a lot more people on this feed that you know well on LinkedIn, other vestiges, that it's just stopped for a second and went, huh, you know what?

[00:11:17] Gerry: This is making a lot more sense. But the conveyance of this should have been done since day one was insurance. Our policies are broken, flat out broken. We have been fighting very hard to get that fixed, and now the plaintiff's attorneys are sniffing around. And they're rightly so sniffing around. But when your insurance company, who gets hacked, actually becomes a threat vector in and of themselves because the data they cough up, I think everybody is a nice, big, fat pause and say, hey, what are we doing?

[00:11:44] Gerry: Because here's what I do know, Dino, when, companies that you're dealing with, we talked about they go and they map their OT risk, which you guys do, and a lot of your friends, and you talk about it, you're the embodiment of taking that data. Basically what you're bringing in is effectively a Rosetta Stone from OT to it, and you're explaining what it means.

[00:12:05] Gerry: you and I both know that's one of the biggest problems because they don't speak the same language. They speak SCADA and these guys speak c plus plus. Well, it is not the same thing.

[00:12:14] Dino: Yeah. it to your point there, and we see this a lot it's been an interesting debate and it has to do with remote access.

[00:12:20] Dino: Into the OT environment. I cannot tell you how many clients that I've been into, and I've been into many, where I will listen to an IT person tell me that those, even internally in the plant, that these sets of machines are not remotely connected to anything.

[00:12:35] Gerry: I'm going to leave the screen for one second.

[00:12:36] Gerry: I'm going to bring a prop. be right back.

[00:12:38] Dino: I wonder what the remote access will be.

[00:12:40] Gerry: Well, it's as simple as this. It's an on off switch, just like this, see? Toggle. I have literally been in cases, right now, all this had to happen was, start there. So this is both, this is analog, okay? Well, we can make this happen digitally. And in the OT world, the fact that you can disconnect and know that's available, Dino, you know they can do this.

[00:13:02] Gerry: But

[00:13:02] Dino: they don't. Because you got to remember a lot of the machine centers they buy, they buy from third parties. They buy from an OE.

[00:13:07] Gerry: But that's third party risk. Okay. But okay, now we're getting into the contractual and extra contractual realms, which is what we are so good at. We have clients that we're working with people like you.

[00:13:17] Gerry: we leave all of a sudden the eyes and the ones and the zeros, and we start getting on to the legal stack. Well, that's what we're really smoking in my friend. You just nailed it. So if you elevate your duty care to go back to something like this, You're starting to get what reasonable care is, moving away from negligence, God forbid, kinetic gross negligence, those types things.

[00:13:38] Gerry: This is what the D's and O's. If I was walking in one of your guys right now, and I was walking in the director's office, I've had 15 of these in my pocket and I'd throw them around like chum.

[00:13:46] Dino: Yeah, what we witness is there's a lot of folks that don't even realize what they have in their environment. Right? I mean, if you look at any of the security frameworks, the number 1 tenant is asset inventories identification. What do you got? And even though visually they can see that they have this equipment on the plant floor, they don't know what's underneath the hood and they don't know how it's connected, Into the environment, whether it's, we find cellular modems in these things, We find Wi Fi in these things. We find it connected to the plant network, but nobody can see it because they don't have the right tools in place to surface it up. And we'll hear executives on the IT say, those machines aren't connected.

[00:14:18] Dino: We'll hear people in the plant say, no, those machines aren't connected. But what'd you do during COVID? COVID kicked this door wide open. People couldn't travel. You couldn't get inside. We're gonna let your plant just shut down, you know, because you're having problems with your machine. You provided remote access into that space, and it is still there.

[00:14:34] Dino: and when we uncover it, for a lot of them, it's like, we show it every single time. It's been a challenge.

[00:14:40] Gerry: ask you and your audience a question? most of these are manufacturers in your world, predominantly manufacturer or in that pipeline supply chain. When they start talking inventory, Every December, they bring in a company that comes in and inventories their stock for tax purposes.

[00:14:56] Gerry: They inventory, they catalog it, they actually process it as part of generally accounted, generally accepted accounting principles to do so. How is this any different? Wouldn't that same logic be applied that on a given date, you have to do this? Inventory and put the report in. Because here's what's going to happen, Dino, and we've talked about this.

[00:15:15] Gerry: Once this inventory happens and something triggers it, I'm gonna leave OEMX. We all know who they are and they've got that great PLC on the box and it's coded 1 5 1 1 2, but those boxes are 40,000 p places across the globe, but the one in Cincinnati gets hit. well, the guy in Tucson hasn't been hit by the operative yet, but he goes to his inventory and says, Oh, my God, we just got a public notification that, OEM, a bottler in Cincinnati got hit.

[00:15:43] Gerry: We don't want the bottlers getting hit because the people that our beers and we hang out the next time that we want to make sure it's on the table. But I'm kind of making a light joke of this because what's going to happen by inventory, you get an early warning system, you know, and that is very plausible.

[00:15:55] Gerry: It's a great technology out there to do this. It's called Google Earth. I know a few people I can call that do work in the GIS field, and this can be done. No one is paying attention to the reporting side of it, and that is pre reporting. Inventory is so important for reporting.

[00:16:11] Dino: But it's like they operate in two dimensions,

[00:16:13] Dino: Between IT and OT. they're not in the same dimension, we see that, Because when you really put a spotlight on your manufacturing environment, most IT organizations don't want to own that. even when we talk about what it takes to secure that I've heard these questions.

[00:16:28] Dino: It's like, you know, if you're exercising the same amount of due diligence to secure, protect your enterprise, aren't you applying that to the plant floor? the same amount of due diligence. response I get is, do you know how much that's going to cost? And it's like, yeah, I got a pretty good idea what it's going to

[00:16:41] Gerry: cost.

[00:16:41] Gerry: That's where I was going. So, I knew the cost was coming and that's why I asked you to stop. So, okay. Why did they connect these things? It wasn't a function of IT or two. It's a function of accounting. Reporting. So the very information, right? Right. But well, they're not mapping their risk from the generally accounted accepted accounting principle side.

[00:17:01] Gerry: But they can't go around and say, hey, I don't understand this. And I'm going to sit in the room and say, really, Mr. CFO. Are you sure? Do you inventory the inventory that's out there on the floor right now? And you do it every day. Please explain to me how that is any different from when someone else comes in and inventories your risk.

[00:17:19] Gerry: It's the exact same thing. You know, what happens is there's the community. There's not a community. I gotcha. It's that's where everybody needs to stop. You're already doing this. Let us show you how to apply it over here. And that is where it has to go. And then your insurance companies, me, are going to go where you're going to look really good.

[00:17:37] Gerry: By the way, that's going to affect your pricing, not only on cyber, but on everything. Everything, and it's coming. probably saw my post on workers compensation. OSHA laws have started coming

[00:17:46] Dino: have been hit, right? The ones that make the news. a lot of people say, well, you know, they all started in IT, began in IT, but yet made its way to your plant floor.

[00:17:54] Dino: And the reason why you had to shut down Clorox, Colonial Pipeline, take your pick of those that had to shut down, In abundance of safety because they didn't have any visibility of this, hack, how far it had gotten within the organization. They didn't know if the control systems. Yeah, it may not be a PLC hit, but there's windows operating systems controlling those PLCs.

[00:18:13] Dino: the hack was on Windows, so you're getting hacked over here on the right, on the IT side, Windows. It's also made its way to your plant floor, it's Windows. And so they have to shut down to go through clean scrub to see if they remove any malware that may have made its way down in there because they can't sit there and unequivocally say, I can operate because I don't have the same problem going over there in IT, so I can keep running the plant.

[00:18:36] Gerry: You know, I'm going to bring it back to one of your original questions, because you just hit on it. You know, they went to the product, you said it was Microsoft in this case. So everybody's so concerned, can I get coverage? In some cases, you don't need coverage of your own. You have coverage of common law, If someone causes a loss to you, a third party, I always use the term digital pinto, you have the right for recourse. These CEOs in the aggregate, these people, the CFOs, the risk managers, are not using the common law leverage that they have, which is a form of insurance, okay, that's what it is, transference of risk to the laws.

[00:19:10] Gerry: They are not doing that, using their rights of recovery, which is what we are teaching them how to do. Plaintiffs attorneys are not all ambulance chasers. many, many of them are advocates, okay, and some are quite good. The defense attorneys are starting to realize that this stuff is coming down and because of these concurrent causalities that they know about, done nothing to mitigate, is where all these problems are to come back to haunt them.

[00:19:33] Gerry: Those are very, very important things people need to relook at what insurance actually is. Stop looking as a policy, a paper that comes from the usual customers. Question everything. And I'm questioning everything. We've got cases of cyber case are getting denied and we're helping customers get it denied because they don't understand the construct of the policies.

[00:19:51] Gerry: That's what we do. Just like people in the manufacturing world, don't understand that the mapment of every little gray box is along that way. On the beer line or it's a paper line or whatever. what does it do? Right? You know,

[00:20:03] Dino: right. I mean, again, strategy, what we do is O. T. Specific intrusion detection system, cybersecurity, That's what we do. And that's going out there and mapping out all the interactivity going on within that environment. Asset inventory. Showing you what your vulnerabilities are, doing, threat hunting, tracking down all your remote access in and out of this environment, stuff that you may be aware of, stuff that you're unaware of, that's our focus, is how you can get better.

[00:20:27] Dino: How can you improve your cybersecurity posture, reduce your tax service, and that's game we play every day.

[00:20:33] Gerry: can I add one thing to your, this is a give back to your clients. Let me explain what VELTA does through my eyes, Steve. And people like you, clarity, all the rest of it.

[00:20:41] Gerry: What you're doing is you're giving a better underwriting file. I'm an underwriter. So when you fill out your application, you know, brick or frame, what's your name? This is the description of risk of what I do. but then all of a sudden you come up with a nice report that says, Hey, we've gone the extra mile to do that work.

[00:20:59] Gerry: I cannot tell you or any CEO, any board member that you're about to meet. Cause if I'm in the room, this is what I'm going to be telling them. You can't not take these guys. This is not a shameless plug. This is just the way the world is. For you to do a statement of where you are today puts you in a better position to post loss, and I'll give you a perfect example.

[00:21:20] Gerry: When you have a, what we call an HO 61 or a personal floater, do you map your jewelry, your china, all these other things? Those are very, very important because on a pre loss basis, they can't question it. Yeah, these guys did map that forward. Because here's what I do know everybody on this feed. If it's listed, it's covered.

[00:21:38] Gerry: They can't fight you on it. You are giving them what we call, and some of the lawyers we're talking to, listment. Listing things, the list of things. you do a lot more than you're just stating, but the obvious it's in all your websites and things like that, do you know, in many ways you guys are insurance.

[00:21:55] Gerry: So don't sell yourself short, my friend.

[00:21:57] Dino: Thank you. was asking you about this sec ruling that came out last year regards to, if you get hacked and you're a publicly traded company, you have X amount of days, I think it was just two or four days to let your investors know. That this is going on.

[00:22:13] Dino: have you been drug into anything along those lines? Because that's why I got to believe it happens every day. I know some people well,

[00:22:19] Gerry: I'm going to keep my hat off to a very specific company who did get hacked. Everybody's getting hack is what you do after that defines relationship with a guy like me, our friends at Equifax.

[00:22:28] Gerry: Francia, who is their CISA. He and Mark Baigler actually, came out with the statement of the state prior to any losses. This is how bad we are right now. We can't get any better. I thought that was genius because when you have the second hack, because you can only do so much because you can only attain cyber maturity.

[00:22:46] Gerry: You actually did that beforehand. You can't say, Hey, investors, you didn't know how bad the market was. We told you. I think the FCC hasn't gone far enough. They should take lessons from Mark Vagor and Jamil. Start there. Make it an 8k plus, Make those filings, make it its own filing, their cyber filing, the statement of the state, and you should be part of it.

[00:23:04] Gerry: If you got OT exposures, just did you map your risk? Fine. Submit the map. That's kind of feels kind of Sarbanes Ockley, doesn't it?

[00:23:11] Dino: Yeah. I mean

[00:23:12] Gerry: again, this is not foreign to that. So the answer, I mean answer your question. Yes, we are getting brought in on SEC situations that I do understand. It's a notification to investors.

[00:23:20] Gerry: It's basically an additional risk disclosure statement to the 10k. That's just a compliance issue, but there's an ethics issue here because disclosure can't just happen. Only to the investors. What about the people that are under your roof? You need to notify your employees I'm going to tell you every union in the world is going to be grabbing onto these words Because this is going to be a negotiating for every union contract coming it's not just unions This is just common courtesy.

[00:23:47] Gerry: Hey, look on the systems that you're operating We call them our digital premises liability that we're operating. We cause some problems. It's affecting our stock price For you employees, HR people, listen up, this is something you need to report to your employees because the second somebody gets hit because this OSHA is going to be coming down on you like a ton of bricks.

[00:24:06] Gerry: It's not just the SEC.

[00:24:07] Dino: I've been waiting for that one on OSHA, Digital safety as we call it, but we're talking about things, right? You know, when will OSHA and CISA be working together? Or will they work together? They are with TSA, And what they're doing in, critical infrastructure.

[00:24:23] Dino: But at what point think that you'll see some type of OSHA regulations related to digital safety? Just like we look at from physical safety.

[00:24:31] Gerry: So, this is a particular hot button with me and you know that. So for you listeners, he knew exactly what he was doing. so on the OSHA front, you have to look at your digital premises liability.

[00:24:43] Gerry: Let's use a law firm, or a grocery store. It doesn't matter agnostic. So you go in a grocery store and there's water and they have that yellow cone out front, the area is wet. That is elevation of duty of care to prevent what? Somebody from slipping and falling, having physical loss, physical, So what is stopping you from doing the exact same thing to cause agita, Stress things that happen because your digital premises, I use the law firm because it's easy because they have their names on it.

[00:25:12] Gerry: You know, Smith, Smith and Smith. com that transitory of all that information on there is on your digital premises. That is absolutely 100 subject to premises liability on our general liability policies, we have specific limits premises liability. But no one's talking about that lovely workers compensation capability.

[00:25:31] Gerry: It's called employer's life. and workers compensation. If someone actually is injured and they can file a matter of fact, the files have violence have to be in April 30. That's the end of the month. I would highly recommend that they put any 100 percent HR departments look very seriously in the event of a cyber event that you document this on your OSHA 300 logs and the HR people will be very familiar with these because if someone has to go all they have to do to have a workers compensation claim as have first aid.

[00:26:03] Gerry: And that is in a non prescriptive basis. They go to Dr. Fieldgood saying, this is really stressing me out. they can prescribe Tylenol to you. As long as they got that prescription, you got a complaint, you don't have to sue your employer. Now you got medical coverage and indemnity and employer's liability.

[00:26:17] Gerry: If they push back on you, that brings up a real problem. That pushback will be third party overactions. Gee, Jerry, what are those? Well, that is where the right to recovery of workers compensation carries to come back on your general liability policy. You will note that I've not mentioned cyber insurance here.

[00:26:37] Gerry: These are all concurrent causalities that reside in the legal stack. They're there now. The plaintiff's attorneys are looking at them. So if any of your clients are not elevating their care, are looking at multiple threat factors, and they think their insurance is expensive now, you ain't seen nothing yet.

[00:26:57] Gerry: So this is why when I tell all of our friends in the tech stack where they address things, they map it, they affect the assigned risk, whatever that risk may be, whether it be Jackware or malware, whatever they're doing, there's some amazing garage bands out there that are not getting the voices either.

[00:27:14] Gerry: And we know a lot of them, you know, and they need to out there. Our industry. This is a person to the people that should be out there saying, Hey, listen, let's give them a chance. There's a lot of talk, need to get this stuff done. So mapping your risk is basic one on one. We do it every day.

[00:27:28] Gerry: It's called insurance application. That's called mapping of risk. There's no different. I mean, I can see your face. I can see the smoke coming out of your ears. This is some pretty heady stuff, but everybody's got to know. we led the field on this, you know, for 10 years. Now it's all manifested.

[00:27:42] Gerry: Now the book is going to be awesome, but I don't want to, I want to write what happened is good. Not what happened is bad. We're fourth and inches right now.

[00:27:49] Dino: Yeah. I mean, that's kind of why we put that index together, right? Or connect the device index. It was our way of creating a FICA score, if you will, in regards to the situation within your environment.

[00:27:59] Dino: would at least have a baseline.

[00:28:00] Gerry: which is your path to maturity. Let's just be honest. There's nobody out. There's going to be cyber hygienically, 100 percent because the surface, the game constantly changes, but if you are literally living in the land of compliance, you're in the land of recovery.

[00:28:15] Gerry: You have no idea what you're doing. I'm talking to heads of state of insurance companies that they say, Oh, we're compliant. I said, well, let me know when you get to security. I'll be, I'll be impressed. Cause they're not. They still hide behind those non compliance issues, which are what? 1997.

[00:28:29] Dino: Pre Y2K. New fact.

[00:28:31] Dino: a wrap up here, what was one piece of advice you would give as a takeaway for our listeners? One thing that should consider right now in regards to cybersecurity insurance related to their operational technologies.

[00:28:45] Gerry: Well, first of all, admit you have risk, start there, know that you don't know everything, you need third parties.

[00:28:52] Gerry: And once you start to begin, open up an idea of becoming a community, community of your suppliers, Community of your IT guy. Don't put your IT guy who you currently have, you have all the chips in their basket. You're being unreasonable to them that they think they're going to make it all go away.

[00:29:07] Gerry: Don't give them threat that, you know, we're going to turn you into the pre made scapegoat. Have them say, listen, we're going to spend extra money. We're not trying to push you out. We're trying to make you better. If people come back in a sense of community on this and have a sense of civil defense for their entire supply chain, I don't care where that lands in your chart of accounts.

[00:29:24] Gerry: talk to your lawyers. Hey, are you looking at your cyber hygiene? Are you pushing my ip across your stuff? And if you're not, we'd like you to stop and just tell me you really are We'll take it from here because i'm going to tell you right now The cyber hygienic firm that can prove it is going to be one that's going to get hired very shortly very shortly

[00:29:40] Dino: well, the insurance companies they bring and the firms bring their Cyber forensics teams to the table when these events happen, right?

[00:29:47] Dino: But what I haven't witnessed and seen is that same practice for the OT side.

[00:29:52] Gerry: I haven't seen it either. there is going to be a massive push to that on a post loss basis. We don't want to be in a boat all India situation. That's what we are looking at. Let's just be honest.

[00:30:01] Gerry: what we're worried about in our world right now are, what we would call a co catastrophes where you're going to have multiple catastrophes where it's going to overwhelm resources, it's actually really from the regulatory side. That's where they're failing. They're failing significantly, not seeing that risk.

[00:30:17] Gerry: You know, the lawmakers, they dabble in the stuff they don't know anything about. not their job, frankly. called common courtesy. But, if you create the community that will also be the people there. And let me tell you what else will happen to your community. And you do get hit.

[00:30:30] Gerry: Those are the people that are going to show up in court for you and be supporting witnesses. Hey, this guy went, did way more when they got to be in front of a jury. Who are your peers as well? They're the neighborhood. See, look, I did everything I could. I'm the one that shoveled your driveway. Here I'm sitting in the middle of a snowstorm with a snow background.

[00:30:46] Gerry: but you know what, you're going to take anything away, people don't understand by talking to you and Craig and the rest of people over at Velta and your extended friends, which we all have mutual friends, you know, who to call on a pre loss basis and say, look, this is what you need if I go into one of your clients and we sit down, first thing we're going to do is we're going to look at the chart of accounts.

[00:31:04] Gerry: And say, what part here is going to hurt you the most? is it the trucking fleet? Is it third party vendors involved in that? That's all the math that I'm talking about. I know I'm getting hoarse talking about this. You can hear my passion in this thing, because we're seeing this stuff.

[00:31:17] Gerry: we spent years talking to these people before these things. Now we're spending years fixing, you I'd rather be ahead of it. I feel like we're falling behind though. That's very concerning.

[00:31:26] Dino: Yeah, not

[00:31:26] Gerry: us personally, but society large.

[00:31:29] Dino: Well, are, and I witnessed it, but I do see that there are those that are trying to get better.

[00:31:33] Dino: Right. Like I said, 60 percent are just still aware to unaware spot got 30 percent actually starting to do something To get better. but then, and that's 90 percent of the market. And that's coming from the companies who service these organizations provide this technology.

[00:31:50] Dino: So

[00:31:50] Gerry: can you do your audience a favor before we go and explain what operational technology is versus it, your eyes, please.

[00:31:57] Dino: my simplest terms, I look at it this way. IT's job is to help you manage your business. OT's job is the reason why you exist, the reason why you're in business.

[00:32:06] Dino: They're your revenue. They're the ones that drive revenue in your organization, if you're a manufacturer, from that perspective. IT handles the business systems, your email systems, your ERP systems, right, your networks. On the OT side, you're making goods and you're using these technologies, you're using networks, you're using computers, you're using, applications and databases that are just in the hands of a different group of people.

[00:32:28] Gerry: So would would you say that the listeners here today, whenever this gets released, they need to keep learning. never stop. They need to keep questioning and get on the feeds that we're on right now. It's, a mind blow. Yeah. And some of them are quite humorous. We do have a lot of laughs.

[00:32:43] Gerry: We do need some levity in these things. Yeah. But you agree that the people that we're certainly about to talk to, need to get on our bandwagon just getting on the learning chain. Dino, I don't know what you know to the degree you guys do, but I enough to call you guys and say, what's this all about?

[00:33:00] Gerry: So I would suggest to you clients, they get into that mode and your future clients, our future clients to get there and have that caring. And I don't care how big you are. It's all the same, whether you're an SBU small business where you're, you got 5, 10, 000 locations across the country or around the world.

[00:33:16] Gerry: It doesn't matter. I your supply chains may be your best asset. You just ask them.

[00:33:21] Dino: Yeah, that's a new 1, you know, the supply chain, because we have witnessed, organizations that sell to the government who sell to the Googles and the Amazons the Tesla's. That are putting pressure on their supply chain to demonstrate that they're getting better.

[00:33:35] Dino: What is your asset inventory? What is your cyber hygiene? And that's going to keep expanding. Right now. It's just those types of organizations and by. Are requesting it now, the question is, is now it's coming down and starting to roll down and we're starting to witness some of that.

[00:33:49] Gerry: flipping the script on you a little bit, but how many times have you been where you see somebody who's going the right direction?

[00:33:55] Gerry: Are you using multi factor authentication? they're looking at taking, the on off switch and making it part of the protocol and telling them number one, where is it? how many times do you get that harumph from the, people who have to utilize it? Oh, geez, I don't want to do that because when you hear that thing, do you know, you and I know that is the problem that's the human element.

[00:34:15] Gerry: for the people in the HR arena, you better start working on that one really hard. Listen for the harumphs because that's where your risks lie because they don't want to listen to you because it makes their jobs in their minds more inconvenient. Yeah. Those are the people that are going to get you.

[00:34:31] Gerry: So you need to take the time to educate these people a little harder, show them what goes boom. I went to a very large facility out in Wichita, Kansas. This place was miles long. It was a huge facility, you know, and I'll never forget this. I tell this on a couple of the podcasts. But when I walked out of this facility you've been in these fields, they have the yellow lines walking down because you can't step out of the yellow lines because a forklift will go by you kind of thing will knock you over.

[00:34:57] Gerry: I'll So what happened is, we walked out inside this facility and there was a concussive boom inside the plant. And what made me happy, and this was definitely an OT guy that was running the show, who was with me, I literally was looking for the exit doors that, like something went off, because on top of the plant was molten glass.

[00:35:16] Gerry: They're making fiberglass. Scary, scary stuff. And that guy said, Oh, I know what that was. Do you know how comforting that was? Because it had been the IT guy who had stepped out. I was no T guy. Had it been the IT guy who had stepped out on that curb onto the yellow pavement and said, What was that? I was out of that door.

[00:35:34] Gerry: You would have seen stuff flying me like I was behind me, like I was the roadrunner. Because it's that kind of mentality safety that that organization, when I'm telling you, and I can't mention the name, embraced safety at the highest level because they got nailed at one of the worst cases ever.

[00:35:52] Gerry: They're probably one of the safest organizations I've ever been in, and it was incredibly dangerous. They had taught what I would say needs to be taught, the OSI model. On top the bottom and everybody right down to the janitor knew what they're doing. There was nothing on that floor. You could eat off that.

[00:36:08] Dino: There's 3 things that companies will spend money on safety, quality and cyber security. They will, if they've been breached, they got no choice. They got, they got to do something. They got to fix going on. but if you're having safety issues, plants not operating just to your point, have to be safe.

[00:36:24] Dino: And then the quality of your products are required. Otherwise your clients aren't going to take them or buy them. So, those three things, they will spend money on them when they're dealing with, impacts that love for that stuff,

[00:36:34] Gerry: you know, one of the things is enlistment, I'll speak to your company because you're the host, but you need to enlist people like yourselves.

[00:36:42] Gerry: In each genre, you guys are excellent at the mapping of OT risk, but even if you have something, you got an entry problem, like a password problem should be using password should be using the holograms to even know they exist to change the whole paradigm to take those third parties and invite them in.

[00:36:59] Gerry: Not just to get a price because the second when you come in, there's way more to coming to this on these meetings that we're having, as I say, we're better than an invoice even if you don't take us, you're going to be a lot smarter if you're in that mode of embracement, if you're not in the mode of embracement, you can throw rocks at windows because that's what you're doing.

[00:37:17] Gerry: I mean, I think what happens, my message to your people is for them to enlist the talent that they don't possess. It's third party risk. But the fact that you guys, you're much like an underwriter, you're seeing a lot more things outside of because you, they are not you. You're seeing this stuff. Just by going to the next meeting, you guys are smarter.

[00:37:35] Gerry: Same with me. I didn't know that. Well, now I do. If you aggregate the, I didn't know that. We're defacto pretty smart just by proximity.

[00:37:43] Dino: the folks need to grow up in this space. Right? They need to mature and recognize that this, problem is theirs to solve. And they play a very significant role.

[00:37:51] Dino: You know, I use this term all the time. you want 'em on the field, you want 'em in the huddle. They just can't be the quarterback for this. it's just not their forte in regards to quality and safety and operation process integrity. What goes inside these manufacturing facilities? You know, the fact that you got stuff that's been out there for 10, 15, 20 plus years.

[00:38:09] Dino: It's not sexy for it, and so they don't want to mess with it. Why do I want to work on a windows XT machines? I even support it anymore. Yeah, but you got a bunch of them in your plant is running critical things. So whose responsibility is it? ot. I'm needs to step up with their ecosystem of suppliers.

[00:38:24] Dino: And start trying to figure some of the stuff out, relying on it to be the 1 to pick your remote access tool or to pick your tool. In my view, it's a start, but they're never going to get you all the way down the field, to get you to the goal line. They're not going to get you there.

[00:38:40] Gerry: I agree with you wholeheartedly.

[00:38:42] Gerry: those people they're not even in the stadium to get to the goal line. but one thing you need to do is for the IT and the is number one, admit they don't speak the same language. How do you know that should be part of it? if I had an opening whiteboard. That's what I put up on there.

[00:38:55] Gerry: How do you know that? Tell me. So what am I looking for? So think, We probably could go all day my friend. So as we always do but

[00:39:03] Dino: yeah I want to thank you for your time today. It was really beneficial looking forward to more opportunities to work together catch up So have a great day and I'll see you soon. All

[00:39:13] Gerry: right. See you in cleveland again.

[00:39:14] Dino: Perfect