Why Detection Alone Can't Stop the Next OT Attack

Tal [00:00:00] if you think about where the world is today, you have, uh, machine speed detection. Now you need the machine speed remediation,

Intro - Outro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.

Craig Hi, I'm Craig Duckworth, and today with me I have the pleasure of introducing Tal Callander, who is the CEO and founder of Roamedio. Tal, welcome to the show. If you would, give us a little background about yourself, kind of how you got here and some things that you're working on today

Tal First, thank you so [00:01:00] much, Greg, for having me.

Tal yeah, sure. Why not? So, as today I am, I am the CEO of Remedio, but, I didn't start, you know, and I wasn't born as the CEO of Remedio. I started in a very, young age, when I got my first computer, at a very, I don't know, it was, like, 12 or 13. I, during the summer when, you know, like, the, the, the parents gave us some, some time, you know, like, to be in front of a screen and not, all day long.

Tal so, I played some, games over the internet. and, th- there was, like, one game that I was really good at, and I woke up, at, I would say, like, it was, like, maybe one hour before, they announce who the winners are, which by the way, I, I thought, "Okay, that's it."

Tal I mean, I know that I'm way above, you know, the second place. I'm going to get it. And all of a sudden, I saw that I'm no longer number one. I am ranked number two, and someone came. He was never ranked before. I didn't see his name, and he was just, you know, like, the new, the new winner. And I was like, "What?"

Tal I mean, [00:02:00] how did he do it, like, in, in 12 hours or 10 hours? Like, it can... It doesn't make sense. And, because I, you know, I worked so hard in the past couple of weeks to make sure that I win it. And I said that, "No way that he won it, that he achieved it all, that he, that he really made it in a, on a legal,in a legal way,he must have been cheated."

Tal and I said, "Okay. If he can do it, I can do it." and because challenges are, I love challenges, and when people challenge me, that's something that really drives me. So long story short, I became the female version of Robin Hood, you know, in my, you know, to my, small town. It was really nice. I gave my friends lots of,lots of things,for free.

Tal and, a- and then I just,created my own, software. back in the day, it was really for SMBs and,it was email protection. so, protecting against email. It was really, not the way it is obviously like, it is done today, but, it did a pretty decent job, so I made my first million dollar before I was 18.

Tal and, then,[00:03:00] I would say that, I'm from Israel. So in Israel, we need, to serve in the army when we are 18, okay? It's, like, it's a must. And at the age of 18, I joined the army as a fighter pilot. so, again, I went there because people told me that, there is no chance that, that they will get me, so, and that I will be, you know, like accepted to the course.

Tal And, and that's exactly what I did. Like, I love when people are challenging me, in that way. although they think, you know, that probably, I don't know, it can hurt some people, but for me it is nothing but motivation. And I just continued to the army and, I did five and a half years. So I started in a fighter pilot course.

Tal I didn't survive the entire course because I thought I know better than the pilots. apparently he didn't think, he didn't think like me, so, I just continued to some computer units. and, they adapted my, hacker skills, into, you know, like to be a complete white attacker, but to think exactly what is open on, you know, on the, I would say like the enemy and to close it and to develop some absolutely cool tools there.

Tal [00:04:00] And then I just, after five and a half years, I just continued to some low tech, high tech companies. the last company I've been with was, EMC, and then it was acquired by Dell. And, I would say within the few, the last few months at Dell, I just thought about, you know, how come there are too many solutions that are telling you what is wrong, and are not fixing the problem?

Tal Now, maybe I, I saw it prior to what's going on today with MITRE and everything, but I... That's what I believed in. How come you are not going to close those configuration drifts and everything that is still open and enable any attacker to move laterally? And when I went to my friends sharing with them this idea, they said, "Ah, it will not work.

Tal It will not work. It's only a feature. No one needs it. We do it today manually. It's good enough." I said, "Yeah, but you know, what about some automation? What about safer mediation? You know, you don't want to break things." No one really, I would say the majority didn't really believe in it. and I said, "Okay, I'll take it as a challenge."

Tal Again, as [00:05:00] I did prior to that, and this is how Remedio started. we started only, you know, like it was only the three of us. we used to write everything, every line of code, within the solution. We started bootstrap only, yeah, and we had, like, a few customers at the beginning, and we said...

Tal For six and a half years we said no to any money, even to some M&A offers or some, you know, like to full acquisition. and the reason why we said no is because we can definitely, like, the company can go, you know, 100 times, bigger and we really want to, we really want to be there and to help companies.

Tal So 400,companies after, we decided to take money, for the first time,it was very late last year, from Bessemer, 65 million. I believe it's, like, the largest seed for cybersecurity. and, yeah, and this is what kind of took the company from being a single product to a platform. and I love, you know, seeing the faces of the [00:06:00] people that, you know, like, that they use the solution, and they love sharing their feedback with us, and that's what makes my day.

Tal and yeah, so thank you for letting me, sharing.

Craig Oh, you're welcome. That's a, that's an amazing story, and congratulations to you and your team. that's a, a, a, that's a great accomplishment. So let's, let's do this. Let's kind of take, a, a look at some of the, what you're seeing from where you guys play in the industrial side.

Craig What's, you know, what are you seeing as some of the major concerns today? Obviously, in the, the most recent news, you know, over in the state side at, at least, we've seen several incidents within the water, wastewater environment, where third-party access or, remote access into environments is still a concern.

Craig Whether they get in through business email or however they get there,

[00:07:00] the, the adversaries are moving laterally to get to the OT side, which is an, a softer target because a lot of times those assets are older. They are not as, you know, security rich. What... How are you seeing that? What's kind of, what's some things that you're noticing as well?

Tal absolutely it's a good question and a relevant question, and I do want to start with something that is, that can reach, out to each and every one of us. and if we just talk about, you know, just the hacking phase, you know, like what happened with, with OpenAI. it is a sample of... Because today everyone is using AI.

Tal But I want to tell you something Many people don't know that in every, I would say attack, there is a misconfiguration abused, okay? Like there, there are some misconfigurations that are being abused by, by the attacker. Hugging Face is the amazing [00:08:00] example because the... You know, that AI that got out of control, they moved laterally abusing WebDAV service.

Tal WebDAV service is a service that exists on, like a, let's say, like Windows, devices,endpoint servers. Today it's, it-- e- even OT environment, you don't really need it. we in, in Remedeo, not only that we tell you for the WebDAV, hey, it is there, but we tell you the state, like if someone is using it, I mean, if you need it, if there are any dependencies, and we just...

Tal That's what we do. We offer the safe remediation. So what we did is like we analyzed the Hugging Face and what they did and, we saw how easy it is just to stop lateral movement if they just abuse one thing that we already offer. And so many customers of ours, they just already disabled this service, like the, the WebDAV.

Tal But the WebDAV is only, you know, like this service or whatever, like it's only a symptom. Like you see that, every lateral movement, whether it is with AI, whether it is with [00:09:00] whatever, like any, any attacking group,that, that is abusing, you know, like critical infrastructure, OT,and unfortunately some things like even hospitals, you see that they are, they rely on the fact that, the systems are not up to date.

Tal But today, even if they were up to date, they just know so many other zero days that are out there that are not being patched, and it's not because of people didn't patch them, it's because... Maybe that's one reason, but let's say that everything is patched, they will still be able to get in and move laterally because, the vendors, they don't have enough time to patch all of the findings that they just got from Mythos and similar, models.

Tal And we see it that, once you have an attack and, you know, you can create a lot of damage, you know? Like cyber is still relevant, will always be relevant. Like there isn't, you know, once it-- once we got it into our life, and once computers take control of the world, like we understand that cyber is,is here to stay, so is AI, of course.

Tal So [00:10:00] the, the OT and the critical infrastructure, we do find many of our customers that, they are trying to protect them in a different way. Sorry, just a second. okay, you still hear me? Okay. we are trying, Sorry, some, windows just popped up. we are, they are trying to, to protect them in a different way, and sometimes they are trying, you know, like because, oh, we cannot really install everything that we can install on the IT, and we cannot really, have whatever.

Tal So we always see, you know, like the conflict between, yeah, we need to protect it, it is the most critical thing. But on the other hand, they they're having hard time to do it, because they don't know the impact of things, they don't know how to harden it properly, and they don't know how to protect it the way they really want and desire, because of those, you know, oh, what would be the impact if I do A, B, or C?

Tal and we are going to see more and more attacks, towards critical infrastructure, OT, and even IT. Yeah, like, there are many things that we don't even know that exist, that are out there, that, yeah, that are not even on the news.

Craig Yeah, no, I would, I would say [00:11:00] you're 100% correct. and we see that from a, a manufacturing or an industrial network standpoint, a lot of the misconfigurations, a lot of a- A third-party vendor needs access, so someone goes in and modifies a control.

Craig They allow them in, and they forget to close that firewall rule. They forget to change that control back. and a part of that, I think, is because in the OT space, organizations are reluctant to make changes because of the implications those have in that environment. So they're not as willing to do it.

Craig You look at... You talked about patching. That's not commonplace in the industrial space. It's hard to, let's say, smokescreen what happens if I patch a Rockwell asset or a Siemens asset, and [00:12:00] what's the implication to the OEM system that it's running? Is it gonna crash that system and I've got to start all over?

Craig Is it gonna work? Is it not gonna work? And it's not an easy process, so there are so many unknowns that just don't really play well together, as I would say.

Tal I agree with you 100%. That's exactly like, what happens everywhere. Like, it's not the... and sometimes they are telling you, "Oh, you cannot patch it because if you patch it, we will not give you more..."

Tal You know, like the, the, I mean, we will not support. we will stop supporting it because, oh, if something happens. But if I'm going to, if I'm going, like, to lose my, you know, like everything because of your unpatched software or, you know, like I didn't harden it properly. and again, like you just see that even if you manage, even if an attacker o- or when an attacker manage to get into an environment, they are just moving laterally and find everything.

Tal So WebDAV was only example. I mean, what if I told you that so many organizations, they [00:13:00] still have SMB version one enabled and open, you know? Especially on the, on, on the OT side. And what about, I'll give you another example that Microsoft keeps patching. So SMB one you don't have any more patches, right?

Tal Like, you just need to disable it. But let's talk about something else. Let's take the print spooler, example. Today, especially on the OT, people don't need to print. It's not a must for them. You know, they don't have to print, not from all of the devices all the time, right? Print spooler or CUP service, but yet every other month or once in a quarter, there is a zero-day on the print spooler.

Tal Now, the problem is not about that the print spooler is, is enabled, the problem is that it is enabled by default and running, and you don't have any printings and any printers. Now you don't need it, but you don't know that you don't need it, because if, for example, the vendors like Microsoft, like, Reddit, like [00:14:00] whatever, they would provide a hardened, hardened image to the end customer, that would help a lot.

Tal maybe some things wouldn't work at the beginning, but then you will open a little bit, but instead of just making... keeping everything open all the time and closing almost nothing, let's have the other approach of closing a lot and then open only when needed. and that would help significantly, you know, like, on the cyber attacks.

Tal we just help all of the organizations to stay, Obviously, we can provide now patching and application control fully. You know, like, if you don't use the application, just uninstall it. That's our motto, you know? Not only, hey, let's keep, you know, whatever, application can, whatever can be open.

Tal But let's harden your OS or your app, and let's make sure that you use only the things that you need to use. It can be from cloud to your browsers, to your database, to your web server, to, to your OS, and many other things. But again, just make sure if you, if... I mean, you... And you can see this is already proven.

Tal If your system, [00:15:00] if your systems are hardened, then you know for sure that you are less, that it will be so hard for someone to move laterally and take everything. It's already proven and, and we are happy, of course, like, to share more, more data about it.

Craig Yeah, no, that... And it's almost like you're taking the secure by design approach and saying, look, organizations need to be more proactive in doing this from the start versus relying on the end user or the, the client to provide security, which is the, I think, which is the right approach.

Craig From an industry, we all collectively need to grow up and help own this problem. It's not gonna fix itself.

Tal Yeah, and, and as you said, like, now w- today we all have the reactive, right? We have the EDRs of the world, but it didn't stop Hugging Face, it didn't stop so many attacks. I had the best EDRs, and they still [00:16:00] didn't stop any attack.

Tal we have another customer, critical infrastructure that had, that had a breach, a month ago. And, you know, by default, our mistake, okay, we kept the tenant open. So instead of closing it, you know, like the other month, and like instead of whatever it was, like February of 2026, we just by accident did February of 2027.

Tal So they had the tenant open by defau- I mean, like, by, by mistake, and they saw that everything that the EDR, considered as normal behavior, was absolutely not a normal behavior. It's everything that you can remediate with Remedia. You know, accessing, you know, admin shares, opening more, more things, renaming, you know, local admins, doing things that you usually don't do.

Tal and that's exactly like what we-- why you need to be proactive and not only the reactive, because reactive is good, but it's not good enough.

Craig Yeah. No, you're, spot on, and we, we see the same thing. So if, if we go

[00:17:00] back and we look at from a, a people standpoint, you look at people, process, and technology, kinda how do you see those three working together?

Craig Is it mostly a people? 'Cause in, in the past I've had hosts on here that have, "This is a people issue," and some are, "This is a technology issue." Some are, "This is a process issue." So how would you look at this from a best practices and a try to solve the problem-

Tal Wow. Wow. It's a very good question.

Tal Now, if you think about where the world is today, you have, uh, machine speed detection. Now you need the machine speed remediation, okay? And here is where, we see some problems between tech, process, people. so maybe the tech, we [00:18:00] have the tech, it's, everything is good, it works, okay, so check on that.

Tal If there isn't... Again, obviously, the more, the more big,the, the bigger the organization here is obviously the more complex. But,sometimes there are some places when we do see some, let's say, it's job security. When someone know, I mean, like they don't want, they are afraid to do things, they don't want like to onboard maybe new tech.

Tal so that is one thing, but on the other thing, like yeah, the process now is to, sometimes I do hear that new processes today is let's patch within 24 hours. Let's patch within, you know, maybe a week, okay? which I don't know if you know, but I mean, these days it's all about 90 days, 120 days, you know, like a very big cycles.

Tal and not forget that patches also break stuff so now we understand that we need to patch faster or we need to fix faster. It doesn't really matter what. we need the people to be aligned with the process, and here we see a little bit of, some collisions [00:19:00] sometimes, okay? Not all the time, but when we have collisions it's because people, they either don't trust the process or they are afraid that it will impact, or they love the current tech, but the current tech is not fast enough to do things, or to close the gap faster.

Tal and yeah, I-- we must see this shift ASAP in the industry because, it's no longer about job security. It's no longer about, "Hey, let's see. I mean, you are here for 20 years, great. Please stay here, for longer." But it's about to adapt faster, you know, like the new tech and just help the organization to be as secure as possible.

Tal And by the way, organizations, it's part of their risk. the, you know, like, whatever they call it, risk calculation, they can already... They say, "Okay, my patches today can shut down or can stop something for whatever time, but this is a risk that I can take rather than being, you know, like, being, targeted and being [00:20:00] attacked by someone and being, you know, like, and pay them or being down, you know, like, being down for weeks."

Tal that is something that we hear recently. It's a change. some, I mean, some people, they still need to have this journey especially... And again, it's not easy, especially with the OT environments. You know, if it works, don't touch. I mean, that's a great, password. I do want to sell-- I do want to say that, the, there is a mind shift,with, you know, like with what we see today to what we will see in a couple of months.

Tal but again, having this in OT- It will take a bit longer because, these are not, you know, the latest and greatest of operating systems. And, and don't get me wrong, even in banks, you s- you still have the mainframes, right? Like, but, Or, or AIX, you know, 400 or whatever, like very old ones. But again, the majority of the operating system, you can still do something about it.

Tal You can still protect, you can still, be re- reactive and proactive,with them. There is a small subset, it can be 10, 20, 30% that you, okay, you [00:21:00] cannot move as fast. But for the ones that you can, just do it, okay? Like, don't wait, you know, that the 30%, I mean, everything will be ready for them, and then you will start doing it.

Tal So yes, it, there is a very, very, very,I would say very strict connection between tech, process, and people, as you said. and we need it all to be aligned, because I can have the best tech in the world, but people will not want to adapt it, and then, okay, what's in it for me? or like, what did I do here?

Tal So yeah, it's, Yeah.

Craig I agree, and I, and I think that, you know, even with some of the advancements in tech, you look at the process in the OT space, for example. You know, w- you've mentioned EDR a couple different times, it's very difficult to put endpoint protection in the operational side, because a lot of those assets,they can't do it.

Craig It's, it's difficult to put it on an [00:22:00] HMI. It's difficult to put it on a PLC, if not impossible. You can run it on a engineering workstation, that's fine, but that isn't all the way down where sometimes it needs to be. So some of that tech and some of the processes don't work as well because of the inherent nature of the way the controls layer works.

Craig Organizations don't always realize the differences in the way that an OT environment is constructed and operates versus an IT when some of the leadership is often IT-focused, IT-trained, and don't have that background for the operational side of the business.

Tal Yeah, and, and, and, and don't forget, to add another thing.

Tal Right now with everything about AI,You see a lot of layoffs, right? And, you know, like that, eh, people that, eh, that are asked [00:23:00] to leave the organization, and then now you need to do more with less. and when,all of the, eh, eh, eh, the, or, or the management or the board, they are saying, "Oh, yeah, you need to adopt more AI, more AI."

Tal But, do you know what, what's the risk? I mean, like, and, and we see so many times, you know, people that they bought, you know, like the enterprise license of Cloze or Claude or GPT or whatever, and they still unfortunately... Or OpenAI, yeah. But, they still,we see how people still log in from their own usernames, you know, like, and their own Gmail, Hotmail accounts.

Tal people, they... even if you bought the, the enterprise, what you don't know is, hey, you can store your credentials in clear text. I mean, your, by default, your state local directory is, is open to the world, the, the permissions. And, the, the, the sandbox is not disabled by default. And so many other things that you can...

Tal That again, like, those are the default settings that are so important for us, that we do understand why if you don't have them, like again, there, there will be no one that can tell you, "Oh, and you need to do A and B [00:24:00] and C." No, it's like the default thing that the... It's both on the IT and the OT, by the way, because even on the OT, the unmanaged devices, the managed devices, you need to understand what is it that you need to do in order to have a better, I would say first it will be everything correlated, but also like in a control.

Tal so it's another,it's another great thing that's also worth mentioning, about it, so yeah.

Craig Yeah, no, I, I- I agree, and, and, and the topics that you're bringing up are 100% relevant. It's, we often see the significant differences. I like to say, you know, the, the worst job in the world is that of a CISO because he has all of the responsibility for security within an enterprise organization, but he has no authority to affect change down in that controls environment because he doesn't own those assets.

Craig He doesn't understand, in some [00:25:00] cases, what he can and can't do down there, and the physical impact. from an IT side, you've got, you know, number one triad in that arrangement is security protection. On the operational side, it's safety. If it's not safety-oriented or if it's not uptime production oriented, the teams on the plant, they don't care.

Craig They don't wanna hear about it. They don't wanna take it on. They don't wanna discuss it. They just want you to go away. finding that balance and being able to come in and look at the OT team's controls, configurations, assets, and say, "Okay, here's how we could apply a framework or a principle that we could take from the IT side and use a different set of tools or a different methodology to [00:26:00] use it on the OT side."

Craig I think that's where you can kinda come in and help guide and give that overview. Would you say maybe?

Tal Yeah, I mean, spot on. Like, to be honest, that's exactly what we do. We even,today we all need to understand that we are on the same boat, you know? Like, we have the IT and the security, they must work together.

Tal This is why with Remedio, when eventually someone needs to click on Remediate, by the way, they can always revert, okay? Everything that they did. So they know it's a safe remediation, but they rely on the IT to do it. So that is one thing, then the revert also, brings it back to the,to the, eh, to the original state.

Tal But again, whether it is, you know, like the, the risk on hardening, the AI govern, the thing that are,you know, that maybe look, oh, yeah. I mean, like, they take it as obvious. But, at the end of the day, we do see that even by default, and believe it or not, even on OT, environment, when you kind of, oh, I have,Y- we do see, like out of a sudden, like even on servers or some Windows PCs, like, whatever [00:27:00] Copilot or other Microsoft that you should not have. and people are asking, "Oh, how... what's going on? Like, how come we have it?" When, again, they should not have it, especially not on the OT environment. those glitches we find all the time, those glitches are, are, I would say, like this is what hackers are looking for.

Tal and it's everything about, you know, even the patching side that, again, is very limited on, on the OT. But everything that you can do just to harden and make sure that it works and again, our customers speak for themselves, and I love seeing, you know, like, their feedback about it. But it's about to do a better together between the IT and the security to make sure that everything is aligned, to continue with the proactive approach of remediation.

Tal because at the end of the day, you need to be faster than them.

Craig Oh, well, you, you talk about faster, and part of the, the AI conversation's been going on in the last, I don't know, several years, is how quick the adversaries can exploit vulnerabilities to create [00:28:00] a, an exploit within matter of minutes now versus days or weeks or months or whatever.

Craig So the ze- zero days or the exploits are coming quicker in more cases than the good guys can stop them because of the advances in AI. So it, it goes back to better hygiene, more of the proactive and not so much of the reactive, and we've got to get better as an industry. And I agree with you, and I, you know, it's, it's a point that's worth making again.

Craig It's better together when IT and OT work together, they understand each other's role, and there's a collaborative effort to try and protect that enterprise. It's not my team and your team, it's we're all on the same team. And the sooner that organizations realize that, the better off I think we will all be [00:29:00]

Tal I, again, I couldn't agree more.

Tal Eventually, it's again, like it's a, it's a team effort and it's a, and it- it's a teamwork. They need to see eye to eye. They need to work together. and again, being, being more on the proactive side, it doesn't really matter if you have IT, OT, VDIs, cloud, on-prem, as long as you make sure that, you do a machine speed remediation instead of only the detection that you, that you have so much of it already, that's a game changer and that's what you should be focusing on.

Tal So yeah, I couldn't agree more.

Craig Yep. No, I, I appreciate your time. As we kind of wrap up today, one, one thing, you know, if, if you could leave organizations that are trying to figure this out or going down this road or, or just really aren't sure where to go, what would be one final thought of, "Here's a place to begin"?

Craig Y- I- You will say, we've heard you can't eat the elephant in one bite. Okay, so what's a, what's a small chunk that [00:30:00] would make a meaningful difference within an organization if they had to pick something that would help them? What advice would you give?

Tal The first thing they need to do is to work on their communication and internal communication between what security wants and what IT can achieve, as, as one team.

Tal That's if they have it, they will have w- it will be way easier for them to achieve anything else because if they think as a one team that security comes first, but yeah, I'm not going just to shut down the entire organization for, five years. But if they think of, "Hey, okay, what are the quick wins that I can achieve now?

Tal What are the, the easy things for me to do now?" That would be way better a start, and then it will be easier for them to onboard, to onboard proactive tools and even to do some proactive,job, together as a team and not only, you know, like just, either fighting with [00:31:00] each other or, like, continue having this massive backlog with no, with nothing to be addressed or almost nothing to be addressed.

Craig No, I, I think that's great advice. You know, it, it makes sense, it's sound, and I think if organizations would look at that, it would be a headstart from where they are today. Great conversation. I really appreciate your time and insight and your knowledge. Hopefully, the listeners take the value that you bring and, and go back to their organization and say, "Hey, let's take a look at this."

Tal Perfect. I mean, yeah, 100%, and again, happy to support, and, and I do believe it's the right thing to do, as the definitely the starting point. And thank you so much for having me, Craig, and I'm wishing you a wonderful day.

Craig Thanks, Tal. Appreciate. Thank you so much. Great conversation.

Intro - Outro Thanks for tuning in to the Industrial Cybersecurity Insider.

Intro - Outro To stay up to date with our latest episodes, be sure to click the follow or subscribe button now. [00:32:00] And if you found this podcast helpful or have a topic you'd like us to discuss, please leave us a review or let us know. Thanks again for listening. See you next time.