Arcanum Technical Director, Lawrie Abercrombie, identifies why organisations are often looking in the wrong direction when it comes to improving Operational Technology security and how they can start addressing the right challenges.
OT security conversations often start with tools. That’s understandable, but it’s also why many programmes stall. In OT and safety-critical environments, availability is more often the constraint. And once you accept that, you stop asking “How do we deploy security like IT does?” and start asking better questions like:
- What changes are safe to make without disrupting operations?
- Where are the actual control points (identity, remote access, segmentation, monitoring)?
- What risks are operationally material (not just technically interesting)?
- Can we recover? Not in theory, but in practice?
This is why resilience frameworks that focus on outcomes (anticipate/withstand/respond/recover) map better to Critical National Infrastructure (CNI) reality than vulnerability-centric programmes.
It also changes how you run assurance:
- You don’t just list findings.
- You build a narrative: what matters; why it matters; and, given any operational constraints, what the “next best step” is.
The organisations that mature fastest are typically the ones that treat OT cyber resilience as a joint engineering + risk + governance problem – not a “security team project”.
In OT and safety-critical environments, the bar for trust is higher: security must improve resilience without jeopardising availability, safety or operational performance.
At Arcanum, we bring accredited, high-assurance capability to OT/ICS contexts, helping regulated operators and critical suppliers build resilience that is both technically credible and operationally feasible. We focus on outcomes-led assurance (anticipate, withstand, respond, recover), producing evidence and prioritised roadmaps that regulators, boards and engineering teams can all stand behind.
If you’re trying to connect OT security activity to resilience outcomes (and regulatory expectations), get in touch today and our expert team can advise on the right approach in the context of what is operationally feasible for your environment.