Effective OT penetration testing isn't just about finding vulnerabilities, it's about building trust.

In this episode of Protect It All, host Aaron Crow is joined by Oren Niskin and Reynaldo Gonzalez for an engaging discussion on the evolving role of penetration testing in operational technology (OT) environments.

Drawing from years of experience in industrial operations, IT, and OT cybersecurity, Oren and Reynaldo explain why successful OT security assessments require far more than technical expertise. They explore how trust, communication, and collaboration help bridge the gap between security teams and operations, making penetration testing a valuable business tool rather than something to fear.

The conversation also highlights the importance of diverse career paths, hands-on learning, and mentoring the next generation of cybersecurity professionals. From network segmentation and risk communication to creating realistic lab environments, this episode offers practical lessons for anyone responsible for securing critical infrastructure.

Key Learnings: 

Key Moments: 

07:00 Oren's technology and security approach

15:04 Discussing network security measures

19:16 Building Trust in Business Relationships

26:17 Understanding and planning security architecture

30:16 Network management and rule assessment

33:39 Managing and Assessing Tool Overload

38:39 Analyzing tool overlap and complementarity

48:41 Building a trusting team culture

49:48 Encouraging Open Communication

56:34 Getting into cybersecurity without IT experience

01:04:56 Entry-level ICS training courses

Whether you're an OT engineer, penetration tester, security leader, or just beginning your cybersecurity journey, this episode delivers practical insights into protecting industrial environments while building stronger relationships across teams.

Tune in to discover why the most successful OT penetration tests don't just identify vulnerabilities they build trust, strengthen teams, and improve security for the long term.

About the guests: 

Oren Niskin is Principal OT Security Engineer at GuidePoint Security. His 20-year arc runs from the US Navy as a Nuclear Electrician's Mate, to Electronics Technician on offshore drilling rigs, to office OT/IT management, to OT cybersecurity consulting at EY, and now into OT cyber engineering at GuidePoint. He also runs Packets Or It Didn't Happen, a YouTube livestream where he builds a factory-realistic PLC and HMI training kit on camera (the open-source PLC Trainer Kit), aimed at helping newcomers get hands-on with OT for under $500.

Link to connect Oren Niskin:

LinkedIn: https://www.linkedin.com/in/orenniskin/

YouTube: https://www.youtube.com/@PacketsOrItDidntHappen

PLC Trainer Kit (GitHub): https://github.com/oniskin/PLC-Trainer-Kit

LinkedIn Group: https://www.linkedin.com/groups/17708001/

Reynaldo Gonzalez is a recognized cybersecurity thought leader with 18+ years of experience helping organizations strengthen cyber resilience and secure critical infrastructure. His expertise spans cybersecurity strategy, IT/OT security, AI security, risk management, and digital transformation, complemented by a passion for education, innovation, and industry collaboration.

Link to connect Reynaldo Gonzalez: 

LinkedIn: https://www.linkedin.com/in/reynaldoglz/

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

The biggest cybersecurity challenge isn't technology - it's people.

In this episode of Protect It All, host Aaron Crow welcomes Swapnil Kachave for an insightful conversation about what it really takes to build high-performing cybersecurity teams in an era of AI, automation, and increasing cyber threats.

Having built and led Security Operations Center (SOC) teams across five industries, Swapnil shares why successful cybersecurity programs are driven by leadership, communication, and continuous learning - not just the latest tools.

Together, Aaron and Swapnil explore the growing impact of alert fatigue, burnout, workforce development, and the changing role of AI in modern security operations. They also discuss why "people debt" can become just as dangerous as technical debt and how organizations can create resilient teams prepared for the future.

Key Moments: 

Whether you're leading a SOC, managing cybersecurity programs, or just beginning your security career, this episode delivers practical leadership lessons that extend far beyond technology.

Key Moments: 

06:04 Dealing with alert fatigue

07:55 Navigating SOC career growth

13:54 From network admin to new opportunities

14:41 Diverse career path overview

21:02 Translating tech issues for executives

23:41 Importance of Soft Skills in Tech

25:50 Prioritizing practical knowledge over trends

31:03 Prototyping and learning new skills

35:26 Using AI to validate ideas

37:57 Human awareness vs. tech evolution

41:32 Quality assurance in AI responses

42:40 Discussing AI system reliability

46:05 Accelerating processes with AI tools

Tune in to discover why investing in people is still the most effective cybersecurity strategy - only on Protect It All.

About the guest : 

Swapnil Kachave is a cybersecurity operations leader with extensive experience building and leading Security Operations Center (SOC) teams across five industries. Passionate about developing people as much as technology, Swapnil specializes in security operations, incident response, and leadership development. They focus on helping organizations build resilient cybersecurity teams by balancing technical excellence with communication, mentorship, and continuous learning in an increasingly AI-driven world.

How to connect Swapnil: 

LinkedIn: https://www.linkedin.com/in/swapniilkachave/

Website: https://www.optiv.com/=

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

Some of the biggest cybersecurity threats to critical infrastructure aren't new - they've simply never gone away.

In this episode of Protect It All, host Aaron Crow welcomes back Lesley Carhart for a fascinating conversation about why decades-old malware like Conficker continues to infect operational technology (OT) environments around the world.

Drawing on nearly two decades of industrial incident response experience, they share real-world stories from the front lines of critical infrastructure, explaining why legacy systems, operational constraints, and workforce shortages continue to make remediation incredibly challenging. The discussion goes far beyond "just patch it," exploring the difficult risk decisions organizations face when uptime, safety, and cybersecurity all compete for priority.

Aaron and Lesley also examine one of the industry's most pressing issues: the growing shortage of OT cybersecurity talent and the need to rebuild foundational technical skills for the next generation of defenders. 

Key Learnings: 

Key Moments: 

05:47 Challenges with Old Industrial Systems

06:58 Struggles with malware cleanup

11:02 Challenges in Cyber Security Careers

16:19 Dealing with malware spread

17:53 Managing infection risk long-term

23:04 Challenges with nuclear hardware upgrades

27:05 Training the Next Tech Generation

29:33 Importance of Computer Basics

34:04 Discovering hidden technical issues

37:01 Troubleshooting in industrial environments

39:10 Malware and botnets era

42:20 Developing low-touch security solutions

Whether you're responsible for manufacturing, utilities, energy, transportation, or any critical infrastructure environment, this episode provides practical insight into one of OT cybersecurity's longest-running challenges.

Tune in to discover why yesterday's malware is still creating today's biggest industrial cybersecurity problems - and what organizations can do about it.

About the guest : 

Lesley Carhart is a Principal Industrial Incident Responder at Dragos and a recognized expert in OT and industrial cybersecurity. With nearly two decades of experience in incident response, digital forensics, and threat hunting, they help organizations defend critical infrastructure from cyber threats targeting industrial control systems. Lesley is also a respected speaker, instructor, and advocate for cybersecurity education, regularly sharing their expertise with industry professionals and the next generation of defenders.

How to connect Lesley: 

LinkedIn: https://www.linkedin.com/in/lcarhart/

Youtube: https://www.youtube.com/user/hacks4pancakes

Bluesky : https://bsky.app/profile/hacks4pancakes.com

Instagram: https://www.instagram.com/hacks4pancakes/

Website: https://tisiphone.net/

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

The biggest challenge in OT cybersecurity isn't technology - it's earning trust.

In this episode of Protect It All, host Aaron Crow sits down with Jacob McCune, a cybersecurity architect with more than 20 years of hands-on experience across both IT and OT environments.

Jacob shares his unconventional journey from the help desk to securing critical infrastructure, highlighting the lessons that only real-world experience can teach. Together, Aaron and Jacob explore why communication, collaboration, and trust are often the deciding factors between successful cybersecurity programs and failed initiatives.

The conversation also dives into the future of OT security, examining how AI, cloud technologies, and evolving architectures are changing industrial environments and why organizations need to rethink traditional approaches while keeping operational realities front and center.

Key Learning: 

Key Moments: 

05:18 Building a Power Plant Team

09:06 Balancing cybersecurity with business needs

11:01 Avoiding project delays during downtime

16:04 Importance of Broad Experience

17:59 A mentor's lesson on teamwork

23:41 Challenges with job postings and requirements

26:27 Managing risk and resource challenges

29:59 Helping Your Compliance Team

33:12 Dad's long career and expertise

36:44 Discussing cybersecurity risk management

39:44 Cloud resources and AI discussions

41:08 Exploring future solutions and technologies

Whether you're building an OT security program, managing critical infrastructure, or looking to grow your cybersecurity career, this episode delivers practical lessons from years of real-world experience.

Tune in to discover why people, trust, and communication remain the most valuable assets in modern cybersecurity only on Protect It All.

About the guest: 

Jacob McCune is a cybersecurity architect with more than 20 years of experience across IT and OT environments, helping organizations secure critical infrastructure through practical, real-world security strategies. From starting his career on the help desk to designing enterprise security architectures, Jacob has built a reputation for bridging the gap between IT and OT through collaboration, communication, and trust. He is passionate about helping organizations move beyond compliance to build resilient cybersecurity programs that protect both people and operations.

Links to connect Jacob : 

LinkedIn: https://www.linkedin.com/in/jake-mccune-33a08984/ 

CornCon Cybersecurity Conference : https://corncon.net/

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

AI is changing OT cybersecurity - but success still depends on understanding your operations.

In this episode of Protect It All, host Aaron Crow welcomes Vivek Ponnada for a practical conversation about how artificial intelligence is transforming the way organizations defend critical infrastructure.

With decades of experience in industrial automation and OT security, Vivek shares firsthand insights into the realities of protecting legacy control systems while preparing for a future increasingly shaped by AI, automation, and digital transformation.

Together, Aaron and Vivek discuss how organizations can use AI to improve visibility, accelerate threat detection, prioritize vulnerabilities, and strengthen operational resilience, without losing sight of the fundamentals that keep industrial environments safe.

Key Learning: 

Whether you're responsible for manufacturing, utilities, energy, water, or other critical infrastructure, this episode provides practical insights into balancing innovation with operational reliability.

Tune in to discover how AI can strengthen OT cybersecurity while helping organizations protect the systems that keep the world running.

Key Moments: 

06:43 AI and cloud adoption in OT

13:27 Controller logic changes and safety steps

21:24 Discussing Digital Twins for Security Use

26:51 Managing vulnerabilities at scale

32:41 Understanding Power Plant Limitations

37:17 Keeping up with plant changes

41:43 Automating infrastructure and maintenance

49:08 Rising importance of cybersecurity investment

52:16 Early days in cybersecurity and OT

01:00:03 Ransomware impacts on industries

01:01:53 Using GPUs for security and OT

About the guest : 

Vivek Ponnada is an Operational Technology (OT) Security practitioner with global experience and currently serves as the SVP of Growth & Strategy at Frenos, the world's first Simulated OT Pentesting Platform. Having started his career in Industrial Control Systems (ICS) as a Technician, Vivek became a Controls Engineer and commissioned Gas Turbines in Europe, Middle-East, Africa and South-East Asia. Post MBA, Vivek held multiple roles in Sales, Marketing & Business Development and Services covering ICS and OT Security solutions for Critical Infrastructure industries (Power, Oil & Gas etc.) at GE, XenonCyber Dynamics and Nozomi Networks. He was a co-lead for the Top 20 Secure PLC Coding Practices Project and regularly speaks at Information Security Conferences. Vivek has a C.Eng. from IEI, MBA from McCombs (UT Austin) and holds the ISA/IEC 62443 Cybersecurity Expert & GICSP certifications. He is a member of the ISA, ISACA, Public Safety Canada ICS Security Symposium Advisory Committee and is a CS2AI Fellow.

How to connect Vivek: 

Frenos: https://frenos.io 

LinkedIn: https://www.linkedin.com/in/1ot/ 

Frenos YouTube: https://www.youtube.com/@Frenos_Security

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

When it comes to OT cybersecurity, the fundamentals still matter - even in the age of AI.

In this episode of Protect It All, host Aaron Crow sits down with Caleb Davis for a practical discussion on securing industrial environments where uptime, safety, and resilience are non-negotiable.

From legacy control systems and tight budgets to AI-powered threats and open-source security tools, Aaron and Caleb explore the real challenges organizations face every day - and the strategies that deliver meaningful protection without requiring massive investments.

A major focus of the conversation is defense in depth: building multiple layers of protection, fostering trust between IT and OT teams, and strengthening foundational cybersecurity practices before chasing the latest technology.

You'll learn:

Whether you're responsible for manufacturing, utilities, water treatment, energy, or any critical infrastructure environment, this episode delivers practical strategies you can apply immediately.

Tune in to learn how layered defenses, strong relationships, and proven fundamentals create resilient OT security programs - only on Protect It All.

Key Moments: 

05:41 PLCs and network security challenges

07:24 Challenges in Updating OT Systems

11:33 Impact of Downtime on Security

16:03 Using affordable cybersecurity tools

19:14 Building Trust in Business Deals

23:01 Security challenges in medical devices

25:49 Trust and IT implementation risks

28:35 Using AI for safer software updates

31:05 Cybersecurity best practices for plants

33:40 Balancing Security Costs and Business Needs

37:50 Nurturing OT like raising kids

41:20 AI and cybersecurity concerns

About the guest : Caleb Davis is a founding member of SolaSec, a cybersecurity consulting firm specializing in advanced penetration testing for embedded and connected systems. Based in Dallas/Fort Worth, he holds a degree in Electrical Engineering from the University of Texas at Tyler and is a patent-holding expert with vast experience in hardware and firmware security. Caleb leads deep technical assessments across a range of high-impact industries, including medical devices, automotive, industrial control systems, ATMs and financial terminals, aerospace components, and consumer electronics. His work focuses on secure design, trusted boot processes, cryptographic implementations, and threat modeling, helping organizations integrate security throughout the development lifecycle and align with industry and regulatory standards.

How to connect Celeb :

SolaSec: https://solasec.io 

LinkedIn: https://www.linkedin.com/in/caleb-davis-400439100/ 

OTPCAP (OT PCAP analysis tool): https://github.com/SolaSec/otpcap

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

Quantum computing isn't a future problem - it's a cybersecurity challenge organizations need to start preparing for today.

In this episode of Protect It All, host Aaron Crow welcomes Jim Sortino for a timely discussion on quantum readiness, cryptographic risk, and the future of cybersecurity.

As organizations continue accumulating technical debt and relying on aging cryptographic systems, the arrival of quantum computing threatens to disrupt the very foundations of digital trust. Jim explains why leaders need to think beyond today's threats and begin preparing for a future where current encryption standards may no longer provide adequate protection.

Together, Aaron and Jim explore the practical realities of quantum risk, how organizations can identify vulnerable systems, and why crypto agility is becoming one of the most important cybersecurity priorities of the next decade.

You'll learn:

Whether you're a cybersecurity professional, technology leader, board member, or simply curious about the future of digital security, this episode provides actionable insights to help you prepare before quantum disruption arrives.

Tune in to learn why the organizations that start preparing today will be the ones best positioned to protect tomorrow.

Key Moments: 

06:02 Challenges with product maintenance and AI integration

08:42 Importance of Software in Everything

12:30 Addressing cybersecurity risks

16:00 Authentication and trust challenges

18:13 Preparing for technological changes

20:56 Planning and Implementing Projects

25:38 Budget planning for cybersecurity risks

28:54 Challenges for Small Financial Institutions

31:27 Importance of regulations in business

33:37 Legacy security systems and protocols

36:38 Quantum readiness and future risks

About the guest : 

Jim Sortino is the Chief Revenue Officer and a Board Member at Isera Corporation, where he helps organizations address emerging cybersecurity challenges through innovative identity and cryptographic security solutions. With decades of experience working with global enterprises, Jim specializes in helping leaders navigate complex technology risks, from technical debt and encryption modernization to quantum readiness. He is a passionate advocate for proactive cybersecurity strategies that prepare organizations for the next generation of digital threats.

How to connect Jim Sortino : https://www.linkedin.com/in/jamessortino/

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

Cybersecurity isn't the goal. Business resilience is.

In this episode of Protect It All, host Aaron Crow sits down with Lee Ward to explore why organizations need to move beyond compliance checklists and start focusing on what really matters: the ability to withstand, recover from, and adapt to disruption.

Drawing on more than two decades of experience spanning the UK civil service, logistics, supply chain operations, and governance, risk, and compliance (GRC), Lee shares practical insights on helping boards and executives understand cyber risk in business terms.

Together, Aaron and Lee discuss the realities of risk acceptance, operational technology challenges, patching constraints, and why resilience not perfection should be the ultimate objective of any cybersecurity program.

You'll learn:

Whether you're a security leader, executive, risk manager, or OT practitioner, this episode provides practical guidance for building organizations that can continue operating when disruptions inevitably occur.

Tune in to learn why resilience not just security is becoming the defining metric of successful organizations.

Key Moments: 

03:59 Understanding Cyber Risks for Leaders

07:16 Discussing non-cyber risks to services

11:12 Understanding business impact of cyber risk

15:45 Evaluating Cybersecurity Risks

19:37 Understanding installation complexities

21:15 Global risks affecting business resilience

24:27 Discussing regulation impacts on business

29:30 People's drive to make good choices

31:27 Industrial control systems demo at DEFCON

34:43 Limitations of technical security

38:06 The future of AI and education

About the guest : Lee Ward is a Governance, Risk Management, and Compliance (GRC) leader with more than 20 years of experience spanning the UK civil service, logistics, supply chain operations, and cybersecurity. Specializing in business resilience, risk governance, and operational technology security, Lee helps organizations translate complex cyber risks into meaningful business decisions. He is passionate about moving beyond compliance-driven security programs and helping leaders build resilient organizations that can adapt, recover, and thrive in an increasingly uncertain world.

How to connect Lee:  https://www.linkedin.com/in/lee-ward-882a54244/

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

What if trust wasn't something you granted once - but something you continuously verified?

In this episode of Protect It All, host Aaron Crow sits down with Frank Goodman to explore one of the most important challenges in modern cybersecurity: establishing trust in an increasingly connected world.

As organizations expand across cloud, OT, AI, APIs, and distributed workloads, traditional approaches based on static credentials, API keys, and long-lived tokens are struggling to keep up with modern threats. Frank shares his vision for continuous trust, where cryptographic source identity and automated policy enforcement work together to verify every interaction in real time.

Together, Aaron and Frank discuss how organizations can move beyond traditional security models and build architectures capable of responding to threats at machine speed.

You'll learn:

Whether you're responsible for enterprise security, critical infrastructure, cloud operations, or emerging AI systems, this episode offers a practical look at the next evolution of cyber defense.

Tune in to discover why identity, trust, and automation are becoming the foundation of modern cybersecurity - only on Protect It All.

Key Moments: 

03:56 Importance of cryptographic source identity

08:52 Securing software supply chains

11:31 Current gaps in network security solutions

16:51 Improving cybersecurity through source identity

17:50 Trust thresholds and security priorities

23:51 Monitoring and securing backend systems

24:51 Managing security with SaaS providers

30:35 Enterprise security and infrastructure challenges

32:23 Adapting to new technologies

36:08 Improving cybersecurity tool integration

40:38 Innovative tech solutions discussion

About the guest : 

Frank Goodman is a cybersecurity entrepreneur with 25+ years of experience in enterprise infrastructure and security. After leadership roles at Gigamon, NetScout, and VSS Monitoring, he founded Onoratio to tackle what he sees as a fundamental cybersecurity challenge: building continuous trust and verifiable source identity into the infrastructure itself.

How to connect Frank : https://www.linkedin.com/in/frankgoodman/

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

Technical skills might get your attention - but soft skills build cybersecurity careers.

In this episode of Protect It All, host Aaron Crow sits down with technology leader and mentor Robert Whetstine for a candid conversation about what it really takes to succeed in today’s cybersecurity job market.

As AI reshapes hiring, the market becomes more crowded, and professionals struggle to stand out, Aaron and Robert explore the overlooked factors that often determine long-term success: adaptability, networking, authenticity, and communication.

This episode goes beyond résumés and certifications to focus on the human side of career growth.

You’ll learn:

Whether you’re breaking into cybersecurity, navigating a career transition, or trying to stay relevant in a fast-changing industry, this episode delivers practical advice and honest insights for building a sustainable and rewarding career.

Tune in to learn why relationships, mindset, and adaptability are becoming the true differentiators in cybersecurity - only on Protect It All.

Key Moments: 

07:31 Developing essential soft skills

11:44 Embracing leadership and failure

16:14 Evaluating candidates for fit

22:00 Building a career through networking

31:16 Taking risks and finding support

35:16 The importance of empathetic leadership

38:34 Networking for job opportunities

47:28 Discussing layoffs for AI investment

50:07 Concerns about infrastructure cost

53:40 Entering the tech industry

About the guest : 

Rob Whetstine (#BowTieSecurityGuy) has been in the technology and Cyber Security space for the last two decades. Known for the Mentoring, Making and of course his nerdy bowties. Born with an obsession for problem-solving, Rob's journey into the world of technology began at a young age, where he spent countless hours tinkering with computers found in the trash.

When he was laid off a year ago from Disney after almost 20 years of service. He made it his mission to help people anyway he could. Those who were struggling in this job market and people new to Cyber. He started sharing videos on LinkedIn about his journey and sharing leadership stories. He has now started a podcast and mentors people all over the world.

How to connect Rob :

LinkedIn https://www.linkedin.com/in/bowtiesecurityguy/

Youtube: https://www.youtube.com/@bowtiesecurityguy

Connect With Aaron Crow:

Learn more about PrOTect IT All:

To be a guest or suggest a guest/episode, please email us at [email protected]

Please leave us a review on Apple/Spotify Podcasts:

Apple   - https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify - https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4