Klaus Mochalski und Daniel Weber (telent) diskutieren Best Practices für OT-SOCs im KRITIS-Umfeld. Erfahren Sie, warum der Trend zum Outsourcing geht, wie das „KISS“-Prinzip vor einer lähmenden Alarmflut schützt und wie SOAR-Systeme mit KI die Reaktionszeiten von Stunden auf Minuten senken – ohne die Prozessstabilität zu gefährden.

Mehr zum Thema OT Security Made simple findet Ihr auf rhebo.com oder schreibt uns mit Euren Ideen, Fragen oder Gastvorschlägen an [email protected].  

Solving the OT Talent Puzzle: A Career Roadmap from Three Industry Veterans

Derek Harp sits down with Marcus Sachs (Center for Internet Security), Patrick Miller (Ampyx Cyber), and Christian Harter (UPS) for a candid conversation about breaking into — and building a career in — ICS/OT cybersecurity. The panel tackles the IT/OT divide, why "dropping your ego" matters more than any certification, how AI is reshaping the skills employers want, and why old-school, face-to-face networking still beats the resume-screening algorithms. Whether you're a plant engineer eyeing cybersecurity or a security pro trying to understand the physical world, this episode is a practical roadmap for finding your way in.

At Black Hat USA 2026, cybersecurity experts issued a stark warning: we may have just three years to shore up the invisible web of keys and certificates that keeps power grids, billing systems, and critical infrastructure secure. Ellen Boehm of Keyfactor explains why the clock is ticking—and what must happen now with post-quantum cryptography.

Cybersecurity in an industrial environment isn't just an IT concern. It's a question of whether the business can keep operating, and whether people stay safe when systems fail.

Craig Duckworth talks with Tim Hoffman, a former NSA director of threat intelligence whose career spans military intelligence, defense, healthcare, finance, critical infrastructure, and industrial operations.

They discuss why CMMC needs to be treated as a cultural shift rather than a compliance exercise, how CISOs earn trust with plant teams, and why leaders have to translate cyber risk into terms the board actually understands.

Tim explains why tools alone can't protect OT. Craig ties digital safety back to the drills and routines plants already run. And together they look at where AI helps, where it adds risk, and why two fundamentals still matter most: clear processes and the discipline to practice them.

Chapters:

• (00:00:00) Why Security Tools Cannot Solve Operational Risk
• (00:01:00) Lessons from an NSA and Mission Critical Security Career
• (00:05:00) Why CMMC Must Be More Than a Compliance Checklist
• (00:08:00) Closing the Authority Gap Between IT and OT
• (00:12:00) Translating Cyber Risk Into Cost and Human Consequences
• (00:17:00) Why OT Security Demands More Than IT Tools
• (00:19:00) AI, Faster Attacks, and the Need for Human Judgment
• (00:25:00) Start With Process and Build the Discipline to Follow It
• (00:27:00) Treating Cyber Response Like a Plant Safety Drill
• (00:31:00) People and Process Come Before Technology

Links And Resources:

• Want to Sponsor an episode or be a Guest? Reach out here.
• Industrial Cybersecurity Insider on LinkedIn
• Cybersecurity & Digital Safety on LinkedIn
• BW Design Group Cybersecurity
• Tim Hoffman on LinkedIn
• Dino Busalachi on LinkedIn
• Craig Duckworth on LinkedIn

Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!

AI agents are becoming more autonomous - but are they becoming more secure?

In this episode of Protect It All, host Aaron Crow welcomes David Girvin for a timely discussion about one of the fastest-growing challenges in cybersecurity: AI agent security and governance.

From an unconventional career as a ship captain to building one of the first governance platforms for AI agents, David shares why organizations must begin treating AI agents as powerful digital coworkers with permissions, identities, and risks that require the same level of oversight as human employees.

Together, Aaron and David explore how autonomous AI systems can unintentionally create business risk, why credential starvation, execution-layer security, and human-in-the-loop controls are becoming essential, and how organizations can safely adopt AI without sacrificing security.

In this episode, you'll learn:

Key Moments: 

05:31 Career paths and diverse experiences

06:24 Startup experiences and mentoring journey

09:30 Exploring a career shift to marketing

15:30 Building a Successful Career

18:20 Governance and AI risks

19:24 Early AI research and presentation

23:19 Just-in-time tokens discussion

27:52 Balancing work, family, and startup challenges

30:48 Transitioning from Operations to Events

35:18 Industry friendships and shared experiences

36:04 Work stress and job challenges

39:49 Securing AI systems and LLM inputs

43:46 Developing AI observability tools

47:56 Managing session risk and autonomy levels

51:14 Security and file management controls

55:34 Cybersecurity awareness chat

Whether you're building AI applications, leading cybersecurity programs, or simply exploring how AI will change your business, this episode offers practical insights into securing the next generation of intelligent systems.

Tune in to learn how organizations can embrace AI innovation while keeping people, data, and critical systems protected.

About the guest :
David Girvin is a cybersecurity leader, security architect, and Founder & CEO of Assury.ai, where he is building execution-level governance for AI agents. With leadership experience at companies including 1Password, Red Canary, and Sumo Logic, David has spent his career helping organizations strengthen security, architecture, and AI strategy. He specializes in making complex cybersecurity and AI concepts practical and accessible, helping businesses adopt emerging technologies securely and responsibly.

Links to connect David: 

LinkedIn: https://www.linkedin.com/in/david-a-girvin/ 

Website: https://assury.ai

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

Check Point Head of Agentic Security Innovation Shahar Tal joins the Nexus Podcast to discuss research he and colleague Yarden Porat conducted that uncovered a dozen vulnerabilities in popular AI agent frameworks such as LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. The vulnerabilities allow an attacker to exploit the inherent trust given to AI agents and can pave the way to remote code execution and other malicious outcomes. 

Subscribe and listen to the Nexus Podcast here. 

Patrick Miller sits down with Scott Kannry, co-founder and CEO of Axio, to work through cyber risk quantification as a security decision tool for OT and critical infrastructure. Scott came up in the insurance industry at Aon in the early days of cyber coverage. He founded Axio with Dave White to close the gap between a technical security program and a number a CFO and a board can act on.

The conversation stays practical. Why you start on the impact side instead of arguing about probability. How NERC CIP already thinks in consequence. Why the events that matter most are rare, huge, and short on data. How to compare controls, insurance, and compliance spend on the same dollar scale. What AI and quantum do to the "it will never happen" excuse. And a new D&O option for CISOs built on top of consistent quantification.

Full show notes, links, and the episode transcript are on the Ampyx Cyber episode page at ampyxcyber.com/podcast.

Topics covered:

• The founding of Axio and the insurance-meets-frameworks origin
• A short history of cyber insurance, from data breach to business interruption to cyber-physical
• The four loss categories Axio uses, first and third party, financial and tangible
• Coverage gaps for industrial facilities and the danger of assumed coverage
• Impact-first quantification versus probability-first modeling
• NERC CIP and consequence-only risk rating
• Fiduciary duty, duty of care, and defensible decisions
• Security decision support versus vanity security metrics
• The art and science of pricing control ROI
• AI and quantum, and why low-probability high-impact events deserve attention now
• A D&O insurance option for CISOs tied to consistent quantification

ממשל ארגוני הוא דבר "חי" שדורש עדכון חדשות לבקרים במיוחד כיום שנכנסה האינטליגנציה המלאכותית לסביבות העסקיות והתפעוליות.

ממשל ארגוני דורש הבנה עמוקה בתהליכים, אנשים והטכנולוגיות בארגון, עברו הימים שמנכ"ל ודריקטוריון מכירים ומבינים "בערך", האחריות האישית של ההנהלה הבכירה והדרקטוריון הולכת וגדלה וניתן לראות זאת בברור בחוק הסיבר שעבר בקריאה ראשונה בכנסת.

כול זה הופך את התפקיד של הסיסו לצומת מרכזית ודורש ידע וכלים שלא נדרשו בעבר.

נחשון פינקו מארח את שירלי סידי מנהלת חטיבת הייעוץ לסייבר וגי.אר.סי באשנב (לשעבר אמן סיבר וענן) מקבוצת אמן.

המשמעות של גי.אר.סי לארגון

מה תחומי הידע שהסיסו נדרש כיום להחזיק

איך מתמודדים ארגונית עם האינטליגנציה המלאכותית

ועוד

Organizational governance is a “living discipline” that requires constant updates, especially today as AI enters business and operational environments.

Effective governance demands a deep understanding of processes, people, and technologies within the organization. The days when CEOs and boards had only a “rough” understanding are over — senior leadership and boards now carry growing personal responsibility, clearly reflected in the new Cyber Law that passed its first reading in the Knesset.

All of this turns the CISO role into a central crossroads, requiring new skills and knowledge, never needed before.

Nachshon Pincu hosts Shirly Sidi, Director of the Cyber Consulting and GRC Division at Eshnav (formerly Aman Cyber & Cloud) of the Aman Group.

The significance of GRC for the organization

The knowledge domains modern CISOs must master

How organizations should address the rise of AI

And more

ועוד

Join ISA for a recap of day two of the OT Cybersecurity Summit, held in June 2026 in Prague. Speakers include:

• Steve Mustard, au2mation
• Ilja David, Iron OT
• Gustav Martin Bartel, Robert Bosch GmbH
• Dr. Lukasz Kister, Honeywell
• Petr Kopřiva, BDO Consulting s.r.o.
• Mark Harbord, UK Parliament