The Glamour and the Glory of OT Security

David Moulton: Hollie, do you have a favorite cybersecurity joke that you like to tell?

Hollie Hennessy: I do. Where did the threat actor go?

David Moulton: I don't know.

Hollie Hennessy: He ran somewhere.

David Moulton: Oh. Yeah. Yes. And I think we found our call open.

Hollie Hennessy: Yeah.

David Moulton: Welcome to Threat Vector, the Palo Alto Networks podcast where we discuss pressing cybersecurity threats and resilience and uncover insights into the latest industry trends. I'm your host, David Moulton, Director of Thought Leadership for Unit 42. In October 2024, we released a series of episodes where we explored the evolving landscape of OT security, from the rise of cyberattacks targeting industrial environments to the urgent need for stronger segmentation in policy enforcement. In our earlier conversations, we discussed the increasing frequency of OT breaches, the convergence of IT and OT security, and the real-world impact of cyberthreats on operational resilience. Today we're continuing that discussion with a fresh perspective on securing OT environments using platform-based approaches and how organizations should think about network security versus asset security. Joining me today is Hollie Hennessy, Principal Analyst for IoT Cybersecurity at Omdia. Hollie has spent years researching the intersection of OT, IoT, and cybersecurity, helping organizations understand how to build resilient defenses in complex industrial environments. Today we're going to talk about OT security platforms, segmentation strategies, and how organizations can take a more proactive approach to securing critical infrastructure. Hollie Hennessy, welcome to Threat Vector. I'm really excited to have you here today.

Hollie Hennessy: Hi. Yeah. Thank you so much for having me.

David Moulton: Hollie, talk to me a little bit about your background. What led you to focus on OT cybersecurity as you do your research?

Hollie Hennessy: Yeah. So my background is actually from the consumer side of things. I used to work for an organization called Which? here in the UK. I was part of the product testing team, so we used to test all kinds of products for performance. And I used to work on IoT routers, smart home stuff. So, yeah. Increasingly cybersecurity was a focus, and whether or not these devices were actually secure enough to be putting into people's homes. So I started working on little bits of that here and there. And I just thought, you know, this is actually really interesting to me. And I want to kind of build a career in the cybersecurity space, so I kind of moved into the role that I'm currently in, much more of an enterprise focus. Yeah. So I could touch on all things IoT, IoT automotive, cyber physical. And, yeah; OT just really kind of stood out to me as an area that's really interesting. Obviously, a huge part of critical infrastructure, a huge amount of impact. Yeah. Something I just found super interesting. And I think it's a space that deserves and needs a lot more attention and research.

David Moulton: I was recently talking to a journalist about the underrated and the overrated, the underreported and the overreported in our industry. Do you look at OT as one of these areas that is underreported, underrepresented, overrepresented, overreported? How would you -- how would you position it on that kind of quadrant?

Hollie Hennessy: Yeah. I think that's an interesting question. I think, if you're looking at cybersecurity, IT security, you know, obviously gets all the kind of glamor and the glory. I would say OT security is way smaller a space, so it's a lot more niche. I don't think everyone is as interested in it. I don't think everyone understands it as much. So, in that sense, it's kind of underfocused on, I would say. I obviously find it incredibly interesting. I think it's -- I think it is super interesting for people who are kind of, you know, perhaps wanting to learn more about the space. There's a lot that is different to IT, but there's also a lot in the cybersecurity space, on the IT side, in general, that can kind of transfer over. If -- I mean, if you think of any of the large events, you're way more likely to see IT security focused talks. Technology, there's way less on OT. So, yeah. I would say it's perhaps underrepresented. But I think those that are in the space do a good job at showing how interest -- interesting it is and showing why it's so important to kind of focus on.

David Moulton: So I think you just unlocked something for me. We were tentatively going to call it Hacked Factories, Real Consequences. Sure. But I think the glamor and glory of OT security is now my new working title for this episode. So thank you for that. And then you say it in that British accent, which I'm just like, hmm, the glamor and the glory. I want me some of that. All right. Hollie, you recently coauthored the Omdia Market Radar OT Cybersecurity Platform 2025 Report, which provides a comparative evaluation of leading OT security platforms. What led you to focus on this area, and what are some of the most surprising insights from the research?

Hollie Hennessy: Yeah. So we did. This research was actually an update to a piece of research I did back in 2022. And I would say, back then, the OT security platform space was less of a platform space at that point in time, really. In terms of the goal of the research, it was -- it was the same, really. So to help decision-makers kind of distill all of the information out there on the OT security market, really understand the capabilities that are offered and which vendors really kind of stand out. So, of course, I focus on IoT cybersecurity, given the service that I run. But I look at more than just that. I essentially look at everything in the cyber physical systems space rather than, you know, your traditional IT type of devices. So kind of, as I -- when I started this role, I obviously find the space very interesting. But OT kind of really stood out to me, and it's become a really large part of my research coverage. So I feel like, you know, in OT-centric environments, it's really that physical element that's super important. And the crossover into the physical spaces is perhaps much more obvious than in other areas. So it changes priorities. And I think it has just a very tangible impact on the business in a way that IT doesn't. So it's just really become quite interesting to me. In a research role, obviously, I have flexibility in what I can look into and learn about. So I do really enjoy that. Yeah. So in terms of things that were kind of surprising, I think one of the things that I'd like to pull out is, you know, visibility. It's still actually so key at this point. There's still certain verticals that need more coverage, certain types of devices that need coverage, barriers when kind of gaining asset inventory. So vendors are still kind of focusing on building out that visibility capability. And I think that's a good thing. Overall, we do see quite, you know, advanced technology in that area. But, simultaneously, I think the reason why it's kind of surprising is that there's perhaps a perspective that visibility is relatively basic or, you know, more preliminary.

David Moulton: Your report highlights how OT security has matured beyond visibility and asset management to include proactive risk management and autonomous response. What are some of the biggest shifts that you've seen in how organizations are approaching OT security today?

Hollie Hennessy: Yeah. So I think things have shifted, for sure. I think it is worth clarifying that, you know, it's not for all organizations. I think some of them are going to be, you know, not perhaps looking at risk management and autonomous response at this point in time, even if you -- if you look at autonomous response for one, you know you're not going to go zero to 100 and then just get there straight away. But I would say that visibility is no longer kind of standing out as the -- the one, number one capability, and everything else is kind of landing behind. Overall, kind of organizations are looking for more from their IoT or OT security technology. It's kind of a combination. And visibility is one of those things. You know, if you look at the OT security market and the technology, it was very passive first. So there's reasons for that, obviously. And there wasn't much kind of agent-based technology in the space either. But it really kind of has developed since then. So, you know, there's a lot of technology that's been developed, purpose-built for these environments now. So you're seeing more of those kind of active discovery approaches. And this is why kind of autonomous responses come about. So, you know, I think it makes sense if you think of what OT organizations are focusing on, and it's that business continuity and naturally capabilities that are kind of going to support that being able to, you know, effectively manage risk and kind of get to a point where you can perhaps stop downtime happening before -- before it does. Those things kind of support that goal of keeping operations running. And obviously OT is such a huge part of the business. I also think one of the shifts is around kind of regulation. It's jumped up gradually, that kind of list of priorities. Again, it makes sense. A lot of regulation has kind of come out and been spurred on in the last few years. And it's put much more of a focus on risk management. You know, it has to be done. But, in some ways, it's led to more discussion around these proactive approaches. If you think of the IT space, that's been going on for a while. It's not that it's brand new in OT, but we're seeing kind of lots more developments from the technology that's out there in the market. You know, a lot of the risk-based vulnerability management capabilities within these platforms are relatively new. So they're in the last year, couple of years or so. And it's to kind of meet that demand from organizations.

David Moulton: So the report mentions that modular OT security platforms are becoming the preferred approach for many organizations. Why is modularity important in OT security, and how does that help organizations with different maturity levels?

Hollie Hennessy: Yeah. So, you know, I briefly mentioned a little while ago that organizations want more than just one thing from their IoT or OT security technology. So it's really a combination of capabilities. And something that I think is interesting in the IoT and OT world, it's not, you know, a direct replica of what you'll get in IT. You know, sometimes I get questions around, oh, you know, what's spam in IoT and things like this. So you're not necessarily going to have those specific technologies replicated or duplicated for the IoT or OT space. And it's much more of an outcome-focused market, really. So it's kind of led to the key vendors developing these platforms. So it spans, you know, a number of different categories, a number of different technologies and so lots of different products, perhaps from one vendor, all rolled up into one, rather than it kind of being these kind of point products. And, you know, I think it really helps these organizations. As you said, you know, how does it kind of cater to different maturity levels? You know, compared to the IT space, security maturity is lower in industrial environments. You know, not everyone's looking at their shiniest, newest, most advanced technology. So that platform approach can kind of work with organizations as they grow, as they uncover new gaps. Like, they may want to add a different module on. And, you know, being able to kind of have all those different pieces work together can help with complexity. You know, technologies brought a lot of those issues that organizations are facing as they kind of develop out their cybersecurity practice.

David Moulton: Many vendors are now integrating AI-powered analytics for threat detection, risk scoring, and automated response. How do you see AI transforming OT cybersecurity, and what are some of the potential challenges with its adoption?

Hollie Hennessy: Yeah. So we have to talk about AI, I think. It's in, you know, every conversation really, in cybersecurity at the minute. Obviously such a hot topic. We are I think going to see more of -- more of it in the OT security space as well. In some ways, it's kind of, you know, why not as this technology is developing. But, realistically, you know, it's been in this space for a long time now, spans cybersecurity in general, not just the IoT and IT security space. I think what we're kind of seeing that's new is more of the assistant type AI that's helping with more actions, more recommendations. I think one of the things to consider is that it has to actually be useful, though, you know, to be used. I think that's what -- what's important as well. You don't just want AI for AI sake. But, in the OT security space, I think it's actually quite useful. In my opinion, you know, organizations, one of the biggest challenge we see for OT-centric organizations is skills. They're really struggling with that. They're struggling with complexity. So these AI-based technologies can kind of help make sense of all that overwhelming information that's coming in, especially if you haven't got someone to kind of do that in house. One of the things that I think stands out as being -- you know, making -- making it a little bit more useful is around kind of flexibility and transparency. So being able to understand how, you know, your assistant got to a conclusion or how the analysis is being done and kind of tweak that based on your internal knowledge or specific assets. I think that can really help with trust, you know, because you're going to need to be able to trust whatever recommendations are coming out based on whatever, you know, AI-powered analytics is working behind there and just kind of make sure that, you know, you're not going to get to a point of over reliance. I think it needs to be, yeah, part of the picture but not -- not all of it.

David Moulton: So thinking about that, you've got folks that are maybe not able to keep up with the security needs that they have. Maybe they don't have the skills. They lean into and become reliant on an AI service or capability. That seems like a risk that they don't have a foundational understanding. It seems like a risk that they wouldn't catch a mistake from an AI, especially given that they're already overwhelmed and underskilled. What's -- what's the risk there? What's the answer to that problem?

Hollie Hennessy: Yeah. I think it's a tricky one. Some of the technologies out there are obviously more reliant on AI than others. And I think, again, it's really kind of that trust piece. So you do need to be able to understand exactly how that AI, as well, is working, really, to make sure that you can rely on it. I think -- as I said, it's never going to be the only way that things are looked at. I think for a lot of organizations who are kind of lacking that in-house expertise do turn to service providers. We do see that quite a lot. So being able to kind of add supporting services, being able to have that extra set of eyes on things can help. But, yeah. I think it can be a risk because you don't want to be up -- you don't want to miss things, for sure. But, you know, a lot of these models are kind of constantly updating as well, so things should improve. But, yeah. The reality of the situation is that a lot of organizations are kind of a bit further behind in this space, so making sure investments are kind of done in a way that's going to most effectively mitigate risk I think is going to be top priority for a lot of organizations to think about. The report suggests that visibility is no longer enough and that organizations need better risk management capabilities. What does effective risk-based prioritization look like in OT security, and how are vendors addressing alert fatigue? In my opinion, visibility isn't, you know, the be all and end all. I think it's a piece of that overall puzzle. And I think it's kind of a hot topic and, you know, the importance that's kind of put on visibility in the space. I'm not saying it's not important, but I think the focus now should be on what's next. So you know what you have. What are you going to do about it, really? And I think a proactive cybersecurity can be really useful in the OT cybersecurity space, given, you know, those nuances of the environment, the priority to kind of keep those operations running. So putting best efforts in place to make sure that downtime kind of doesn't happen in the first place. And, you know, being more proactive will hopefully improve that cybersecurity posture, improves cybersecurity resilience, meet regulatory requirements as well. So it's kind of win-win. I think -- you know, if you think of OT, IoT, there's a lot of vulnerabilities with the assets themselves. There's, you know, countless patches. There's legacy systems which, you know, not necessarily can be patched. So there's this huge amount of information, alerts, problems that are going on and, you know, a lot of information for users to kind of work with. And we kind of touched on it before. It can be overwhelming, and if you're overwhelmed, you know, that can actually hinder improving things and getting to a better point. So previously when I kind of looked at this space, I focused really on vulnerability management, and I was just kind of looking at that. But it has become much more risk focused now, especially with the leading kind of platforms out there. So I think the effective piece of that so how to kind of get effective risk-based prioritization is really tailoring to the environment. So, you know, it's not just about the severity of the vulnerability but its criticality of the assets, connectivity to other assets. You know, what role does that have in terms of the operations? What's the exposure looking like and so many different things that can be kind of factored in. And, now, some of that's automatic, ingrained into the platforms, depending on the product. But, you know, users -- you can usually go in and kind of tweak those different kind of factors. You can adjust the weighting, the scoring to kind of get to a point where prioritization really reflects your organization. So I think that's something that can move towards that effective -- effective risk management and kind of get you to a point where you're focusing on exactly what matters to you. But, you know, above and beyond kind of those analytics and prioritizing, there's, you know, a lot of different things that can help with the kind of alert fatigue issue. We've already mentioned AI that can, you know, sense, track, validate, assign confidence levels to a lot of these alerts. There's baselines. Pretty much baseline is so common in OT security technology that you can either have one, multiple, kind of working out what expected behavior is, which can help to reduce false positives. They tend to develop over time, improve as time goes on. So hopefully things will get better if there's kind of teething problems, you know, correlating and analyzing multiple different detections together to streamline can kind of help. And, also, another thing I think is quite useful is threat intelligence too. So being able to kind of really understand what's relevant to your particular organization can help with that as well.

David Moulton: So talking more about the threat intelligence piece, some vendors are investing heavily in OT-specific threat intelligence. Talk to me about how important this capability is, and how does that real-time threat intelligence improve an organization's ability to detect and respond to those threats that those OT organizations face.

Hollie Hennessy: Yeah. I think threat intelligence is something that's really key in this space for OT, for IoT. And, you know, it's so different to the IT space. I think, you know, is -- the threats are different really. So I think insight into specific environments and understanding the devices themselves, those that are actually targeting the environments or specific verticals, it can kind of provide that context that's needed and, again, kind of help organizations think, okay. Well, maybe there's this vulnerability. But, you know -- you know, it's incredibly unlikely that I'm going to be targeted. Or maybe I don't need to worry about that right now, that kind of thing. Being able to analyze that in real time, as well, it's just, again, helping with that alert fatigue. So it's providing context to alerts as they come in. Any recommendations that are going to be generated, that's going to be dynamically updated with whatever threat intel is going to be factored in there. You know, on top of that, I think being able to kind of pull in that real-time data and add, you know, extra qualification on things. It can -- it can kind of also help with insights off the bat. So you're not necessarily having to spend more time delving into something but -- so, for example, you are relying on baselines. It can be a bit of a slower process or anomaly detection. But kind of adding that threat intelligence in, as well, can kind of provide quicker insights on top of that. I think it feeds into the proactive security piece that we've kind of been discussing as well. So those who do have the skills or resources to do so, it's not going to be every organization but it can also really help with things like threat hunting, also feeding into the proactive space. Many of the vendors -- or should I say more of a handful, actually; I wouldn't say it's many -- are kind of productizing the threat intelligence as well. So you may be with one vendor for your technology or your tooling. But you may think, oh, hey. You know, so and so has really great threat intel I want to be using in my environment. I'll factor that into whatever activities I'm doing. And a lot of the time now it's more of a productized offering. So the OT security specialists are able to kind of offer that to a wider audience, which, again, can kind of be useful, yeah, when kind of developing out that cybersecurity practice.

David Moulton: Hollie, your research highlights secure remote access, or SRA, as this key feature in many OT security platforms. Why has SRA become such a critical capability, and how does it impact risk management and operational resilience?

Hollie Hennessy: Yeah. So secure remote access has a lot of promise, I think. It's one of the fastest growing areas of the market. So, you know, a lot of organizations are looking for this technology. But there's still relatively decent, sizeable gap in the market for vendors to be filling. So, in the most recent report, there's, you know, quite a few vendors that are offering this natively. It's much more so than a couple of years ago. It was kind of few and far between. And now there's also a lot partnering with specialists in the space because there are also more point products that are kind of offering this to meet that demand from customers. And I think it really stands out in OT security, given that, you know, these environments and how they're working, how users are kind of connecting. There's been a lot of discussion around zero trust in OT, what that means and how that kind of translates or looks different to an IT sense. You know, I think, crucially, part of that is including users and everything else that you shouldn't trust. But secure remote access is really kind of standing out in terms of that access. Also, the R in that, the remote I think has kind of -- now kind of expanded to access in general. So it's not necessarily remote users but could be users who are regularly accessing equipment as well. So being able to monitor that activity, I think, is really useful. Obviously, it enhances visibility, again, within the organization. But it can be a really useful way to mitigate risk and kind of reduce that likelihood of a threat in the environment. So, yeah. Kind of adding that technology into the platform can be useful because, you know, you've already got technology there. You've got -- it's already going to kind of factor into your monitoring and your threat detection activities. But there's a -- there -- as I said, there are a lot more integrations, as well, with more of the point products in a space for secure access.

David Moulton: Let's shift gears a little bit and talk about some regulatory pressures on OT security. There's been increasing regulations like this, too, in Europe and TSA directives in the US. How are organizations adapting their security strategies to meet compliance requirements? And are regulations driving innovation in OT security, in your opinion?

Hollie Hennessy: Yeah. So we're seeing regulation bump up the list of drivers on, you know, why organizations are purchasing IoT or OT security technology. I think it definitely has put more of a focus on risk-based approaches, things like access control, like we've just been talking about, network segmentation, technologies like that. So it's spurred on both the capabilities in the market and also use of those technologies. There's no surprise that obviously vendors are responding with the tooling to kind of meet those regulatory demands. In terms of innovation, I wouldn't necessarily say that they're driving innovation. They're putting more of a focus on OT security, which is a good thing. But, on the other hand, I think there are, you know, some limitations as well. The risk with regulation is that it ends up just being a kind of box ticking exercise, right? So, obviously, that's not the aim. It hopes to do so much more than that. But for some I think it can be a burden. Especially if you're operating in multiple regions, you've got to kind of navigate loads of different regulatory requirements. It can be -- that can be a struggle, be tricky to deal with. You might not have the budget. You might not have the staff. You might not have the resources. And then it can end up kind of being more of a legal effort, rather than kind of using those requirements to get to a point where you're -- you've got better cybersecurity resilience. Obviously, that's the goal. But, yeah. I think it is a good thing because, if you're looking at the business, they have to pay more attention to cybersecurity. If they, you know, they have to do it, if they have to be considering these technologies, at least, hopefully there'll be kind of more money put behind it. One of the things we see as a big struggle is cost. So hopefully this will help kind of be able to get more budget approval to enhance kind of cybersecurity practices. But, yeah. Innovation, I'm not so sure.

David Moulton: So let's shift to look into the future a little bit. The report discusses ongoing convergence between IT and OT security. Are we moving towards a fully unified security operations center, or SOC; and do you see IT and OT security remaining separate? Or do you see IT and OT security remaining separate for the foreseeable future?

Hollie Hennessy: Yeah. So, based on my research, it's a bit of a mix at this point in time. So I would say there are more who have a converged SOC covering both IT and OT rather than a separate IT and OT SOC. But it's not -- they're not -- it's not the majority. So there's around 40% that have it converged. I would say 20% have OT only, and then you've got the rest that are doing it managed, and they have a third-party provider. Or they just have an IT SOC. So I think something we do know is that the vast amount of organizations, whether you have got a separate SOC or not, you're using OT or IIoT specific tooling rather than IT. So, you know, they much prefer to purchase specialist technology rather than IT and kind of utilizing that in the space. So I think integrations are really important, whether or not you're doing it separate or converged. What really stands out to me is that OT and an industrial internet of things have to be included from an IT point of view. I don't think you can be an industrial organization or a critical infrastructure organization and be looking at it from just IT. If you're looking at kind of your risk management, you need to be factoring in these devices. So integrating with specialist tech, regardless of who the kind of provider it is, is going to be really important for a SOC. On the other hand, you know, we know that many incidents originate in IT. And then they impact OT in some roundabout way. So you also can't really silo OT and industrial internet of things. So, you know, converging the SOC can alleviate some of those issues and kind of some of the reasons why more organizations are kind of going down that route.

David Moulton: As you were talking through that, it made me think about a kinesiologist that I worked with years ago who looked at medical doctors who would treat knee pain separate from hip pain, separate from ankle pain. And he's like, it's all the same system. They all work together. And, if you focus on one area and ignore something else, it's at your own peril. And I think what you're talking about is these are all integrated systems. And, if you try to separate them out, you end up allowing risk in or allowing those threats to manifest and come into your organization and give an attacker leverage. So seeing that it's moving maybe in that direction of more convergence is really -- I think it's encouraging. You mentioned innovation a moment ago, and I want to -- I want to talk about that for a second. You know, looking ahead, what do you see as the next big innovation in OT security platforms? Are there emerging technologies or some positive trends that you believe will shape the market in the coming years?

Hollie Hennessy: Yeah. For sure. I think that's one of the fun things about doing this research, is that you do kind of get to see trends in things that you think, oh, wait. That's interesting. Or, you know, I'm going to see a lot of this in -- next year or two years' time or three years' time. We've spoken so much about risk-based from ability management, proactive security, prioritizing, you know, taking actions, essentially getting to that point where you're effectively reducing, mitigating risk. I think it's going to see a lot more development. There's vendors in the space that are just focusing on this area. There's startups that are coming out. I think the bigger vendors are going to be innovating here to try to, you know, keep differentiating in the space, potentially acquiring. We've touched on kind of compensating controls and being able to take action and put things in place to produce. The likelihood of something happening in the environment and why they're so important in OT environments, you know, being -- being able to kind of, I guess, look at things a different way, given there may not be the opportunity to kind of patch as you work in the IT world. But I think the interest in these actually going to be around assessing those controls, working out how they're actually changing risk, whether they're reducing the likelihood of attack. I think some of the things around that are going to be really interesting in the OT security space. I think we're going to see more focus on exposure, attack surface management, attack path analysis. So, again, more of that focus on really each specific environment and what actually matters.

David Moulton: Hollie, for every episode, my favorite question is to ask what's the most important thing that a listener of today's conversation should take away from it, should remember?

Hollie Hennessy: Yeah. I think the most important thing as a takeaway I think would be around that piece in terms of not siloing OT and industrial internet of things. If you're an OT security professional, kind of make sure your voice is heard in the -- in the wider cybersecurity piece of things. I think that's really important. And, if you're on the IT security side, learn about OT. Make sure you're factoring that in if you're part of an industrial organization and you need to kind of understand what that landscape looks like as well. So that would be kind of my main takeaway of today.

David Moulton: Hollie, thanks for such an awesome conversation today. I really appreciate you sharing your insights from your report and to talking to me about this area, which I agree is underreported but incredibly important.

Hollie Hennessy: Yeah. Thank you so much for having me. I appreciate getting the chance to, yeah, give a bit more insight into the research I've been doing. Thank you.

David Moulton: That's it for today. If you like what you heard, please subscribe wherever you listen. And leave us a review on Apple podcast or Spotify. Your reviews and your feedback really do help me understand what you want to hear about. If you want to reach out to me directly about the show, email me at ThreatVector @PaloAltonetworks.com. I want to thank our executive producer, Michael Heller; our content and production teams, which include Kenne Miller, Joe Bettencourt, and Virginia Tran. Elliott Peltzman edits the show and mixes the audio. We'll be back next week. Until then, stay secure. Stay vigilant. Goodbye for now.