Episode 105
Why OT Must Lead the Manufacturing Cybersecurity Conversation
Katie O'Brien shares her unconventional journey from music teacher to industrial cybersecurity expert, bringing over 25 years of IT experience into the OT world.
Chapters
- 00:00:00 — The Hard Truths About OT Security Nobody Wants to Hear
- 00:01:06 — Katie's Unconventional Journey: From Music Teacher to OT Cybersecurity Expert
- 00:04:00 — The Current State of OT Cybersecurity and Future Directions
- 00:06:00 — The Education Gap: Why Universities Aren't Teaching Industrial Cybersecurity
- 00:08:00 — The Disconnect Between IT/Security Teams and OT Operations
- 00:10:00 — Designing Cybersecurity Into New Manufacturing Projects From the Start
- 00:13:00 — IT Teams Who've Never Walked the Plant Floor
- 00:16:00 — The Emergence of Managed Services in the OT Space
- 00:18:00 — Garland Technology: Getting Visibility Into Aging Infrastructure
- 00:19:00 — Software Defined Automation and the Future of Industrial Control
- 00:22:00 — Why the OT Ecosystem Must Drive the Cybersecurity Conversation
- 00:24:00 — The Real Cost of Downtime and Cyber Incidents in Manufacturing
Show notes
Katie O'Brien shares her unconventional journey from music teacher to industrial cybersecurity expert, bringing over 25 years of IT experience into the OT world.
In this conversation with Dino, Katie discusses the critical gaps in OT cybersecurity—from the lack of university programs teaching industrial security to the disconnect between IT and OT teams.
They explore why system integrators and OEMs fail to design cybersecurity into new manufacturing projects from the start, compare it to building cars without safety features, and discuss the emergence of managed services in the OT space.
Katie explains how Garland Technology helps organizations get visibility into aging infrastructure with unmanaged switches, and both hosts emphasize the urgent need for the OT ecosystem to drive cybersecurity conversations proactively rather than waiting for IT teams who may never have walked the plant floor.
Chapters:
- (00:00:00) - The Hard Truths About OT Security Nobody Wants to Hear
- (00:01:06) - Katie's Unconventional Journey: From Music Teacher to OT Cybersecurity Expert
- (00:04:00) - The Current State of OT Cybersecurity and Future Directions
- (00:06:00) - The Education Gap: Why Universities Aren't Teaching Industrial Cybersecurity
- (00:08:00) - The Disconnect Between IT/Security Teams and OT Operations
- (00:10:00) - Designing Cybersecurity Into New Manufacturing Projects From the Start
- (00:13:00) - IT Teams Who've Never Walked the Plant Floor
- (00:16:00) - The Emergence of Managed Services in the OT Space
- (00:18:00) - Garland Technology: Getting Visibility Into Aging Infrastructure
- (00:19:00) - Software Defined Automation and the Future of Industrial Control
- (00:22:00) - Why the OT Ecosystem Must Drive the Cybersecurity Conversation
- (00:24:00) - The Real Cost of Downtime and Cyber Incidents in Manufacturing
Links And Resources:
- Katie O'Brien on LinkedIn
- Want to Sponsor an episode or be a Guest? Reach out here.
- Industrial Cybersecurity Insider on LinkedIn
- Cybersecurity & Digital Safety on LinkedIn
- BW Design Group Cybersecurity
- Dino Busalachi on LinkedIn
- Craig Duckworth on LinkedIn
Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!
Full transcript
Intro Welcome to the Industrial Cybersecurity Insider. In each episode, we dive into the world of industrial cybersecurity. Join us as we cover the latest trends, innovations, and practical insights as we talk with leaders and practitioners across the industry. Gear up and let's get into this week's episode.
Dino Hi, I'm Dino Bus Locking, and today we have a friend of mine and a colleague I've known for a number of years in the cybersecurity field. Katie O'Brien. Welcome.
Katie Hi, Dino. Thank you for having me.
Dino when I met you several years ago, you've been working for some of these top tier OT cybersecurity firms, and you continue to do so.
Dino So I guess what I'd like to know, let, I know a little bit about your journey, but let's have the audience learn about Katie's journey.
Katie Well, I think it's, it's been a bit of an interesting [00:01:00] journey. I started out as a music teacher many years ago, and when I got outta college, I went and took a bunch of graduate classes that IBM had put together around management information systems, computer science.
Katie It's kind of important to know that because that's. Taught me enough that three and a half years later in Atlanta looking for a job, I end up in front of a guy who says, do you know what a Atlanta is? And I'm like, yeah, it's a local area network. He goes, you're hired. And that was how I ended up in IT.
Katie Sales and ended up working for a company that developed the first 30 bit protocol analysis solution and. Just love that world so much. Really enjoyed sales. I think sales is so much like being a teacher, that you're going out and you are, you're educating people, you're, sharing your knowledge and I think it's, a really amazing opportunity to do that.
Katie And of course, you know, things kind of progressed. I was, with the company for a long number of years. I love small companies. I love being part of [00:02:00] developing them. I was at a company called Network Instruments for 18 years. Did some stints in DNS after that. And I was looking for something new and interesting to do while I was at the last DNS company.
Katie just kind of felt I had run my course with that if you look at back at my history, everything I've sold has been something that's very interesting. It's, not something that's mandatory on a network that's crucial to a network, crucial to keeping infrastructure up and running. I got this email from a recruiter about industrial cybersecurity and I was like, what is this?
Katie Because I'd been looking and nothing was grabbing my attention and I started digging into it and I'm like, wow. This hearkens back to everything I know about network troubleshooting. I get to play with protocols again. I get to, I get to learn something, which I also thought was fascinating. And there you have it.
Katie So the last five years have been just really immersed in. industrial cybersecurity and just loving it, learning, and yet still able to utilize [00:03:00] everything I had learned earlier in my career.
Dino Yeah. Well, and and your background though, outside the technical aspect. I mean, but you've been involved, obviously sales you talked about, but it's been marketing and a whole host of other activities in regards to driving these new ot industrial cybersecurity conversations.
Dino 'cause you've worked for some companies that, that are still out there, that are growing. Mm-hmm. Mm-hmm. Some that have been bought.
Katie Mm-hmm.
Dino and, and when you talk about, I know you talk about sales, but knowing you, you're really good at building relationships also, right.
Dino And trust not only with your partners, but also with the clients. and I think that's been very valuable, so when you think about OT cybersecurity specifically. Mm-hmm. and you've been to S four mm-hmm. And you've been to Rockwell Automation Fair. have you, have you been to No,
Katie that's the only one I've not been to one day.
Dino But you've been to other
Katie Yes. Conferences and
Dino forums, you know, as part of, of, this field. where do you think is gonna happen next? Where do you see this going? Right. I mean, you've heard. the throes of the ITOT convergence [00:04:00] conversation, the challenges with organizations such as the one that I'm a part of right now, which comes from the engineering side, the OEM, the system integrator.
Dino I have my thoughts on how I think this should work. What are your thoughts on how to make this work?
Katie Well, I think. there's a lot of different aspects that, need to, to come into play here. I think that there's so many challenges. First of off, just in cybersecurity, especially when you push it over to the industrial cybersecurity, you know, you've got budgets held not by the guys you think you should be talking to, but by other guys.
Katie You don't really understand it. And we end up people like you and I becoming this glue that brings them together. I think we have management that has been like, oh, industrial cybersecurity's really not the problem that every, we've been doing this for years. It's been fine. So I think that where it needs to go, I think there needs to be, there just needs to be more education.
Katie It's not included in master's degree programs. I go and I look through the curriculum for master's degree in information security. There's nothing around [00:05:00] industrial. When I talk to kids in the programs, they don't even know what I'm talking about. Right. And I think, there needs to be a change, and this is what I'm hoping for, that we see a change that starts from the colleges.
Katie We see colleges offering more so that people can learn. We see more online programs. We also see people who've been in the management positions for a long time, educating themselves. About things that are new to them. there's been a lot of change. you know, we've got CIOs and CISOs who are now responsible for stuff they were never taught about.
Katie it was never really discussed with them. And I think they need to learn their jobs as well. I think that you, and I've had this, conversation before, just that cybersecurity is such a big part of safety. I think that we need to, including cybersecurity. In so many different aspects of the conversations out there.
Katie So I think that needs to change too. So I'm hoping that we start seeing more of that. you know, it'd be great to see more mentoring programs out there for [00:06:00] people who are trying to learn cybersecurity so that they can really educate their personnel.
Dino And you've seen us do that, right? I mean, you've known me all the time.
Dino Our team, and pulling the kids outta school that have the aptitude for it, have an engineering background, technical background, and bringing them along this journey, right? Because to your point on the mentoring side, because the schools aren't teaching it. Even big organizations, in the manufacturing space and the government are not trying to produce these skill sets and capabilities into our youth. They're just not. So we gotta grow 'em as I would say, I call it the farm, you know, the internship programs, which is really where you can begin to foster these folks. to your point about CISOs and CIOs, you're correct on, their role, and it's been expanding. What I would say and what I've witnessed or what I haven't witnessed is mm-hmm.
Dino Them reaching out to organizations like ours who are working in their manufacturing facilities, have been for years, in some case, decades, doing [00:07:00] big projects for them. Whether we're maintaining and supporting, helping with their, industrial control systems, expansions, green fields, brown fields, lifecycle replacement, but we don't get, we don't field a lot of conversations and calls from that group.
Dino To find out who we are, what are we doing, what kind of practice do you have? What kind of partnerships do you have to assist them with what they're starting to own in regards to this OT cybersecurity. and I don't know when that will happen, how you make that happen. And I think part of it is it organizations who deal with their traditional VAR or partner.
Dino aren't driving that narrative either, you know, kind of pushing 'em and nudging 'em that direction. Mm-hmm. It's like you really need to go over there and start finding who's working in your plans and what they're doing
Katie and you know, it's, funny that I will say, if somebody ever asked me, what, what is the best advice you could give to a CSO or a CIO who now is like, oh my gosh, I've got these new Find a company, I work at Garland Technology now, and we are a [00:08:00] completely partner driven company, and we do that intentionally because we see the value in a design group going in and talking. And I always sit there, I'm like, does your CSO know what you guys are doing? Does your CIO, have they talked to you guys?
Katie Have they started to learn about what you offer? Because I think you make a really bad point. You have so much experience that you can share when they're sitting there saying, I need to put these three products in. You sit there and you're like, no. Let me save you some money, but you need this product and here's why it is this product.
Katie You know, things along those lines. I, think that the resources are there. They're just not reaching out. Yeah. Yeah. And hopefully that changes.
Dino I mean, I've seen investments on, from a capital perspective, you know, because mm-hmm. We, I both know industrial control systems are out there, lifecycles, measured in decades, the question then becomes is, um, you know, how do we, Move this, timetable from money perspective, because a lot of times I hear we just don't have the money. and what I would say is if you have a capital project to put in a packaging line, money that's, they're [00:09:00] paying to do that.
Dino Wrapping cybersecurity technologies around that is not that much more expensive, right. To be able to do it mean you're spending $25 million on a packaging line, maybe a couple hundred grand over the course of a couple of years for that line. not in my view.
Katie I think you're absolutely right, but if you look back, I always try in order to understand, I like to look back.
Katie If you think about it, cybersecurity, when that first came out, it was the same thing. this is just, you know, coming now, but we dealt with this 20 years ago. There was no money. You'd go in, you're like, Hey, what's your budget for security? What's your budget for cybersecurity? Oh, well. If there's any money left over at the end of the year or then it slowly started becoming budgeted for, and we would have the same conversation you're putting in a new data center.
Katie where's your security? how are you monitoring this? Did you think about this before you designed it? That's my other favorite part, is that, you know, one of the challenges we both see is that when you're talking, well, that's not how I want [00:10:00] to monitor this, that's not how I wanna look at this.
Katie I need all this traffic. We know that from asset collecting solutions that we've worked with, well, we can't get to all the assets because of how the infrastructure set up. Now granted, we're dealing with very, very old infrastructures in that case. Hey, if you're designing something new, design it from the get go.
Katie It becomes a massive cost savings because maybe you don't need to put in, you know, as many sensors. Maybe we can, architect things differently. So it does need to be part of the conversation from the get go.
Dino Yeah. And it's just, it boggles my mind how much it's not, which gets me back to the folks that are traditionally leading the project.
Dino 'cause these projects begin two, three years in advance.
Katie Mm-hmm.
Dino As far as if you're gonna spend that kind of money, whether it's again, expansion or putting lifecycle replacement of control systems and the conversation isn't being sprinkled in upfront. and I don't know if it's because a lot of those,
Dino Engineering and CapEx people and operational people think that it is [00:11:00] gonna come back behind them at some point and fund and or do whatever they need to do to say that they're providing cybersecurity around that stuff. And of course, what we witnessed is they never get close to the control systems.
Dino They never get down to that level. Right? Yeah. Past that PLC and around all of those industrial control systems and the equipment associated with it, they, they just don't. Right. And to, to your point, it needs to be done up front and that that's a blind spot, right? Mm-hmm. Moving forward, the older industrial control systems, to your point of the age of them.
Dino Damn it, we still connected 'em, you know, I was connecting PLCs to ethernet back in the early 2000, late nineties timeframe. Mm-hmm. We're, I'm talking over 25 years ago, and it's, become common practice, you know, moving forward to connect your hmis, your motor control centers, your, your pumps, your drives, your robots, or your PLCs.
Dino Obviously they're all making their way to the sensors, all making their way to ethernet. Connected. Slowly but
Katie surely. Yep.
Dino Some form of it. It's out there Still a lot of cases [00:12:00] on unmanaged switches though.
Katie I, you know what's so funny you say that, I feel like I went back 20 years when I came into the industrial space and I was, fore warned to this when I started.
Katie They're like, Katie, you're gonna run into these these, and I'm like, I had to stop and think, when did I last use Windows? NTE? When did I last think about an unmanaged switch? And it's interesting now as, other people start to join us in this industrial cybersecurity world and you're explaining this to them and they kind of look at you and they're like, yeah, you're wrong.
Katie And you're like, yeah, no, I'm right. And, but it is interesting. But I do, think you made a really interesting point when you talk about. They think that the IT guys are gonna come in behind him. And I think what sometimes they're failing to realize is that the IT guys don't always know either.
Katie They're still learning. Now I've seen a huge jump. I will tell you from when I started in this, world to now. I've seen a huge jump in it guys starting to understand, but I remember the first time I met you and we were talking about it, about how many IT [00:13:00] guys had never walked the plant floor where they're supposed to be supporting ot.
Katie And you know, some of them would say, you know, Hey, I put a firewall in you're just like, well, well good for you. What are we doing next? Because that's one point of entry. but I think it's really fascinating that it's. You know, it's kind of like, I think they had this attitude, why I did this.
Katie It should be enough. Right. But it's, it's not enough. And I think that unfortunately blind, the news says every day it's not enough.
Dino Yeah. The blind spots still exist, you know, and mm-hmm. And even changes the firewall, you know? 'cause if you follow the CPWE, right, the converge plant wide ethernet architecture.
Dino the design that most organizations and some do not many do. You would have two firewalls in that plant. You'd have one on the IT side, and you'd have one on the OT side, right? Mm-hmm. Because if it doesn't trust, trust, ot, why should OT trust it? Right? Exactly. You have skillset. Inside that OT environment to be able to deal with these more complex technologies, right?
Dino Software defined networks, the [00:14:00] firewalls, you know, there's the security practices policies, the governance, et cetera. Microsegmentation, name it something that it is good at in their world. Mm-hmm. They haven't figured out how to implement it in the OT world. 'cause to your point, they don't spend time in that environment really to determine how they can leverage their capabilities and skills and partners to do that.
Dino So that being said, what we're starting to see a shift in, and I don't know if you'd say the same thing, is that, you know, managed services have been a big part of the IT world mm-hmm. For a couple of decades, right? Where organizations we're like, we need technologies, we need enterprise systems, enterprise networks, you know, access to all these applications.
Dino I'm not gonna build a monster IT organization to do that. I'm gonna leverage. What I do have, and then I'm gonna outsource, if you will, to organizations provide me those services. We're starting to see that in the OT world, whether it be around networking, whether it be around cybersecurity. Or even managing their control systems for them, you know, as a tier two, tier [00:15:00] three support model.
Dino If the plant can't figure it out, what's going on with their packaging line and their drives and their filler, then they fall to somebody who may have been a part of that, design build and has a maintenance of support role. is this something that you've, come across much. There's only a few companies that do it.
Dino You know, rock will be a big one. Right? But, there is demand services play. We call it DG 360 in our world. I just didn't know in your space if you
Katie we're, we are seeing it and, we're seeing more companies coming to us at Garland, you know, looking to us for like, Hey, we're, putting together these offerings and we need to be able to get the data.
Katie So they're coming to Garland for our, you know, purpose-built OT taps, right? OT packet brokers so that they can get the data out and start offering those services in a, cleaner way. what I think is interesting is that in a lot of, a couple of the conversations I've been in lately, they actually already have, you know, like a visibility, product deployed.[00:16:00]
Katie It got deployed, but now everybody's sitting there like, well, we don't know what to do. We don't have the bandwidth. to deal with this. We did get it in, we checked the box, it's up, it's running, and they're looking for people. And so we're starting to see people coming to us, not only to help with the deployment of the visibility partners, but to then help get the information back to them to a central point so that they can start, you know, providing those services.
Katie But it's interesting to see. I think that's something really, I don't know about you. I would say it's like the last year. Obviously I've been familiar with what you guys have been doing, but. Until then, I think you were like really the first people I'd ever talked to who were doing it. But you know what, can I say?
Katie You're leaders. Everybody's not like,
Dino so you talked about Garland. So let's talk about Garland a little bit so I know what Garland is enough to be dangerous. why don't you give our audience the, the summary down solution story of. Garland Technologies.
Katie Well, you know, the cool thing is Garland's been around since, 2011, so next year it'll be 15 [00:17:00] years.
Katie So we're gonna be celebrating big. one of the co-owners, Chris Bahar, I've actually known probably 28 years at this point. he's had products that I've, I've worked with my, pretty much most of my career. He's just done a great job with that. as he likes to say, the truth is in the packet.
Katie So we are very focused and we plan on remaining focused on basically getting you every packet so that, regardless of whether it's a tool on the IT side or a tool on the OT side. Our solutions are purpose built so we can deliver those packets to you. And we do a lot of work with a lot of the visibility partners on both the IT and the OT side.
Katie Mm-hmm. And it's, it's pretty cool. And I think, you know, if you ask me what is one of the coolest reasons for coming here, this is the, probably one of the only companies that can come to where I get to use all the IT knowledge I had. All the OT knowledge that I've learned in the last five years at a company where I can talk to both sides of the fence.
Katie And it's, it's just a really great experience and we've got tools that can go on [00:18:00] both sides of the fence that are built for that.
Dino Now we have two. Right? I mean, it's definitely a, key tool going into environments again, that have an aging infrastructure. Mm-hmm. But yet they want to improve their cybersecurity posture.
Dino And the question is, how do you get those older switches that don't, that are unmanaged, don't have span interfaces on 'em to be able to collect that information to move it to your OT IDS platform that you've invested in to put in. So it's definitely a good fit, but also really good for comparisons too, if you wanna look at multiple platforms.
Dino To determine which, that way the tools are getting the same data mm-hmm. From the Garland platform, you know? Mm-hmm. In order to assess, you know, your decision making process as you're picking OT cybersecurity platforms. So, Is there anything that you'd like to talk about that we haven't discussed?
Dino Something you wanna bring up? Any topics? Oh gosh,
Katie I'm always curious to hear, you know, what do you think is going to be the biggest influencer on OT in 2026?
Dino Well, you know, I just, came outta Rockwell Automation Fair outta [00:19:00] Chicago, oh, two weeks ago.
Dino they've thrown this, term they've put together, they call it software defined automation. Oh,
Katie that's interesting.
Dino Yeah. And we know what software defined networks are, right? Yeah. And those have been around for a, a bit, but they're, it's the intelligence that's coming into these industrial control arenas with their applications, right?
Dino Mm-hmm. Software and how they can, you know, extract all this relevant information to help with, whether it be safety, operational efficiencies being, you know, improving their, production capabilities. And improving their cybersecurity because cybersecurity was laced in, I would say, 80% of the, presentations that were given in the keynote sessions, at Automation Fair a couple weeks ago.
Dino And, I would say that a lot of the partners that, are there, the OEMs and sis, many of them don't have anything regarding cybersecurity and the machine centers that they're building. Right? Mm-hmm. Equipment that they're providing, you know, where they're using Rockwell technology and a [00:20:00] whole bevy of other things to create some type of machine center, right?
Dino Those groups are not thinking about those things, right? It'd be like, if use safety as an analogy, it'd be like building a new car and not putting safety belts on it, or backup sensors or cameras or airbags. You know, none of those, those things, you know, in the vehicle, at your building. And a lot of these OEMs and are doing that from a cybersecurity perspective.
Dino And just ignoring the technology that they could have designed and built in to the machine centers is providing their clients, instead of just saying, well, it's their responsibility to put in the seat belts and the airbags and the backup cameras and the antilock brakes on the car. That's their job.
Dino Right? When it really needs to come from those machine builders. Mm-hmm. Those system integrators and those OEMs. That's my perspective and I think that is changing some, but I at automation Fair. Eight outta 10 aren't there yet. They're just not.
Katie But you know, the interesting thing is, I, feel like this is a [00:21:00] conversation this topic is something you and I have been talking about for years.
Katie Very feeling very strongly, how do we get these manufacturers to start including it? How do we get it? Whoever's doing it, whether it's the manufacturer in si, doesn't matter. How do we get them thinking about that? Because I think there's, they have this assumption that they all know what they should do once they get it in.
Katie Like you said, that they know they're supposed to come in, put the anti-lock brakes in, put the airbags, put the seat belts. But you know what, if they only are thinking, oh yeah, well we put seat belts in. That's good. And instead of thinking, okay, but that's just one line of defense. You know, there's a lot of little sayings within our worlds.
Katie There's too many sayings. The only one that like I've ever really, truly liked was defense in depth. And that is where we need to. To be thinking, we need to be thinking about, alright, what if they get past this? Okay, what if this is only protecting North-South? What if this is only east, west? there's also Southwest and southeast, there's too many vectors.
Katie We need to, [00:22:00] it needs to be a design it. Cybersecurity really does need to be part of that design. And if the manufacturers and these global sis, these people doing these big projects, started having that conversation like you and I think they should be having it, I think we would see this industry explode.
Dino I don't know how many podcasts. Right. I make that point that the OT ecosystem has to get much better at this.
Katie Oh, yeah.
Dino We, we, we are not ker They have driving sphere of, you know, tip of the spear and having this conversation that every time you engage with a client who's asking you for whatever they're asking for in regards to the manufacturing environment.
Dino In that dialogue, there has to be, well, tell me about your OT cybersecurity strategy. What technologies are you using today? And if they turn around, which we hear a lot, well that's it. Fine. We need to talk to them and here's why we need to talk to 'em, right? Because this is the data we're gonna be looking for.
Dino Here's the reason why we need it. If they can't provide it, then we need to bring our own tools in to be able to do that, right? If I'm gonna walk into an environment and I need to extract information out of there, and they have layer [00:23:00] two unmanaged switches, I'm coming in with my stuff, I'm gonna bring my garland taps.
Dino Because switches you got out there aren't gonna get me what I need. Yep. So I need a tap to be able to do that. Right. And that's, how you're gonna know this is changing. When folks start going, well, I want to improve my cybersecurity posture. I'm not ready to swap out my network infrastructure just yet.
Dino The OEM doesn't want me touching the switch. Fine. I'm gonna go in there and put a garland tap in so I can get me a stand for there and I can start siphoning that metadata off to feed my OT asset inventory so I can get asset inventory and find out what my vulnerability management are, see if I have any risk and threats in the environment.
Dino All the reasons why you should have that stuff instead of just ignoring it. So, well,
Katie tools are only as good as the data that is going to them, and that's the bottom line of, what they need to remember that if they're not thinking the whole picture. They're gonna put all these tools in and they're still gonna, like you said earlier, there's gonna be blind spots they're missing, and that's what somebody's gonna be taking advantage of.
Katie And that's where you start getting into, you [00:24:00] know, the things we don't wanna talk about. Profit loss, soft cost loss, all those things, right?
Dino I just think that that's why I think the OT ecosystem has to really start moving the ball. I think it will follow along or be happy that, that industry is doing that.
Dino Right. Yeah. And then it would have a rule with inputs and data that they want out of it. And knowing that at least we're moving in a path. We're going down a direction, and all the people involved are paying attention. Whereas I could sit there and tell you right now, I can walk 'em into a plant. They could have 30 plants in their fleet.
Dino They'll have over a hundred different system integrators working across all those plants, and they might have two that have an idea about what we're talking about right now. The other 98 are just out there trying to keep that machine running best they can. For that plant and that client, right. And not do anything more than necessary, to extract as much as they can out of those assets without pouring any money into it.
Dino that's just been the reality of it moving forward. I don't know how you think you're gonna compete doing that.
Katie I think we're gonna start [00:25:00] seeing the differences. I think they're gonna start popping up. We're going to see companies who are being aggressive and having that, design that includes their cybersecurity and they're gonna have less downtime, they're gonna have less blocks.
Katie And unfortunately we know the reality is we always need data to back up. Why do we need to be buying this? Why do we need to be investing? And I think we're gonna can just continue. The numbers are gonna show, you know. insurance is not gonna save you. it really is not. I think that's, that's one of things.
Dino Or regulatory, other regulatory, you know, depending. Exactly.
Katie you know, look at your environment and, and sit there and figure out, I know that, you know, for years, you know, it was so easy depending on what you're doing. But in manufacturing, it's even easier to sit there and say, what does it cost me if this line is down?
Katie How many other lines does this, affect? What does it cost me? Immediate profits, what does it cost me in, lost revenue because I had to destroy product? What does it cost when I lose? I always go back to Clorox. How much did that lose them Shelf space wise? tho those are the things that I don't think people [00:26:00] are having the hard conversations about. And then when you look at those numbers, you start looking at. Oh my gosh. You know, wow. If we had just budgeted $200,000 more for cybersecurity, we wouldn't have lost $2 million.
Katie But somewhere along the line, somebody did not wanna have that tough conversation or get to the point that they understood. And I think, you know, I'm curious, I know we're probably running out of time here to been such a great conversation. Do you think we're gonna have more regulation coming out? I mean, I only foresee we're in America, so we're probably not gonna have any more.
Katie But not under, not under
Dino the current administration. You're not.
Katie But what about, but if you're part of a company that's out of Europe, you are going to have more regulation. ' Because you have to adhere to those, don't you? We're
Dino seeing some of that with pi, with certain clients. GDPR.
Dino Mm-hmm. that is part of it, even though it's not so much on the plant floor as much as it is part of the corporate global, you know? Mm-hmm. legalese, you know, in the relationships with their partners. I think that some of that will happen, but at [00:27:00] some point, it's like the engineering organization we work for.
Dino engineers do not like talking about things they don't understand very well. Okay? And so they don't bring it up right now if the client ask about it, they can ask questions and then they can say, Hey, we got a group that does that. Or however that conversation. But they're not gonna bring it up and say, Hey, I wanna talk to you about your OT, cybersecurity.
Dino 'cause they're never gonna know how the response is gonna be coming back the other way. And they don't wanna look like they, they're out in left field, And I've witnessed it just recently with jobs that we've got that we're working on, and some of the, client facing leaders just do not bring up this topic.
Dino And if you turn around person on the client side, they're gonna go turn around and say, I absolutely want to have that conversation.
Katie So I think it really, it's, back to us, you know, the manufacturers, the, partners that are out there to ask these questions and, you know, to say to them, Hey, go have a conversation with your finance guys because you are, you're sitting here saying to me, I, I know I've had customers over the years saying to me, well, I don't know if [00:28:00] we can afford your tool.
Katie And I said, you just told me that you guys were down for a week. How much did that cost you? I don't know. I said, well, I can give you median costs. I said, go talk to your finance guy, find out what that downtime cost you, and then look at my quote and you're going to find that you would be out so much less money.
Katie and we're preventing. Yeah, either a repeat performance or we're mitigating the risk that could happen in a repeat. And I mean, 'cause there's nothing nothing a hundred percent perfect up there, but if we can sit there and make it as protected as it can be. You know,
Dino we're hired to do that.
Dino Right. You know, to with whether it be manufacturing, execution systems, helping 'em with their OEE mm-hmm. And whatever, there's a metric that ev most plants, if not all of 'em, have determining on how well they make goods, right? Mm-hmm. Quality, performance and availability of those assets. And, you know, most discreet manufacturers probably run somewhere in the sixties, the seventies, you know, world class in the eighties.
Dino Right. But if you can just move that a few [00:29:00] percentage points, It's millions and millions of dollars to the bottom line. If I can take, from you losing, you know, a hundred hours a year and OnPlan unscheduled downtime.
Katie Why have to go through that? Why lose your 300 be proactive? I think we'll get 'em there. I think it's just gonna take some time. All right. Good
Dino seeing
Katie you. It was great seeing you, Gino. Thank you.
Intro Thanks for tuning in to the Industrial Cybersecurity Insider.
Intro To stay up to date with our latest episodes, be sure to click the follow or subscribe button now, and if you found this podcast helpful or have a topic you'd like us to discuss. Please leave us a review or let us know. Thanks again for listening. See you next time.
About Industrial Cyber Security Insider
Industrial Cybersecurity Insider brings clarity to one of the most urgent gaps in manufacturing and critical infrastructure: the divide between IT and OT. Hosts Craig and Dino talk with plant leaders, engineers, and security practitioners about protecting industrial operations in the real world — practical conversations for the people responsible for keeping production running and secure.