Agentic SOCs are one of the hottest topics in cybersecurity—but what do they actually mean for OT?

In this episode of Talk OT to Me, Jesper and Jeff explore how AI-powered security operations could change industrial cybersecurity, and why many OT organizations aren't ready to take advantage of them yet.

They discuss why AI is dramatically increasing the speed of cyberattacks, what makes OT fundamentally different from IT, and why building an effective AI-powered SOC starts with something much less exciting: good data.

The conversation covers:

• Why AI attackers are changing the economics of defense
• What an Agentic SOC could realistically look like in OT
• The importance of context, governance, and human oversight
• How to introduce automation without increasing operational risk
• Why strong fundamentals still beat flashy technology
  

The episode wraps up with practical advice for OT leaders looking to prepare for an AI-driven future—without losing sight of the basics that keep industrial environments secure.

In this episode of Talk OT To Me, Jesper and Justin tackle one of the most challenging topics in industrial cybersecurity: incident response in Operational Technology (OT).

Having an incident response plan is one thing. Knowing how to execute it when production, safety, and business continuity are on the line is something entirely different.

The conversation explores why OT incidents can't be treated like IT incidents, how poor visibility and unclear ownership slow down decision-making, and why tabletop exercises often reveal critical gaps in preparedness. They also discuss real-world examples, the growing impact of AI-driven attacks, regulatory pressures such as NIS2 and the Cyber Resilience Act, and why collaboration between IT, OT, engineering, operations, and leadership is essential.

Key topics include:

• Why most incident response plans fail in practice
• The unique challenges of responding to cyber incidents in OT environments
• How visibility gaps create dangerous delays
• Lessons from real-world OT incident response scenarios
• The impact of AI on attack speed and defender readiness
• Compliance, liability, and regulatory requirements
• Why OT incident response is ultimately an engineering and business problem—not just a cybersecurity problem

If your organization believes it's prepared for an OT cyber incident, this episode will challenge you to ask a simple question: When was the last time you actually tested the plan?

This episode explores the complexities of OT supply chain security, emphasizing the importance of trust, asset management, and proactive risk mitigation in industrial control systems. Justin and Jesper discuss real-world threats, best practices, and strategic steps for enhancing cybersecurity in operational technology environments.

Key Topics

• OT supply chain complexity and trust chain
• Risks of long-term asset management and legacy systems
• Best practices for supply chain security and risk mitigation

The conversation delves into the complexities of identity management for IT and OT, emphasizing the need for separate identity management to address different requirements and risks. It also highlights the importance of network segmentation, access control, and auditing for securing OT environments. Additionally, the human factor is identified as a significant vulnerability in cybersecurity, emphasizing the need for training and awareness. The practical approach to identity management is discussed, considering the cost and resources involved in implementation.

Takeaways

• Identity management for IT and OT should be separated to address the different requirements and risks.
• Network segmentation and access control are crucial for securing OT environments.
• The human factor is a significant vulnerability in cybersecurity, and training and awareness are essential for mitigating risks.

The ManuSec Europe 2026 and S4x26 conferences provided valuable insights into the current state and future of OT security. Key themes included the rise of remote access, compliance standards, trust, AI, pen testing, and the need to validate humanity in the context of cybersecurity. These themes shed light on the challenges and opportunities in the OT security landscape.
In this episode, Jesper and guest Jeffrey discuss their takeaways from being present in those conferences.

The conversation delves into the historical relationship between OT and IT, the challenges of integration, and the crucial role of leadership and personnel in bridging the gap. It also highlights the responsibility of vendors in providing tools that facilitate collaboration and the need for a shift towards a more collaborative and friendly relationship between OT and IT.

Takeaways

• OT and IT have historically been frenemies, but are moving towards a more collaborative and friendly relationship.
• Leadership, personnel, and strategic team-building are crucial in bridging the gap between OT and IT.

Chapters

• 00:00 Introduction and Background
• 05:03 Challenges of IT-OT Integration
• 34:06 Tooling and Vendor Responsibility

The conversation covers the critical importance of OT security, the differences between OT and IT security, real-world impacts of OT security breaches, the significance and impact of OT security, challenges in OT and IT security collaboration, the maturity of OT security in Europe vs. the US, and the influence of insurance companies on OT security. It also discusses the impact of COVID-19 on OT security, standards and compliance in OT security, European OT security regulations and their impact on the US, and the descriptive vs. proscriptive nature of frameworks in OT security.

Chapters

• 00:00 Introduction
• 07:10 Real-world Impact of OT Security Breaches
• 13:35 OT and IT Security Concerns and Priorities
• 20:24 OT as the New Frontier in Cybersecurity
• 26:20 Standards and Compliance in OT Security
• 31:28 Descriptive vs. Proscriptive Frameworks in OT Security