February 2021. An operator in Florida watches his cursor move across the screen on its own. It wasn’t a glitch; it was an active attempt to poison the water supply by changing sodium hydroxide levels.

But here is the terrifying part: The attackers didn’t use a zero-day exploit. They used the plant’s own maintenance tools.

In this episode, we dissect the Oldsmar incident to uncover a harsh reality: in OT, your "authorized" engineering path is often the attacker’s favorite backdoor. We break down how legitimate tools—like TeamViewer and shared credentials—get weaponized, and how to stop hoping for the best by designing for abuse using IEC 62443.

Listen to find out: Could you prove who changed a setpoint within one hour?