Operational technology environments are under growing pressure from sophisticated cyber threats, yet many industrial organizations still rely on legacy defenses that were never designed for today’s connected factories and utilities. In this IIoT World strategy guide, we examine practical, forward-looking approaches to OT security, covering network segmentation, asset visibility, zero-trust architectures, and cross-functional IT/OT governance. Whether you manage a single plant or oversee critical infrastructure across multiple sites, these frameworks will help you build a security posture that adapts as threat landscapes shift, regulatory requirements tighten, and digital transformation accelerates.
Cyber threats are evolving at an unprecedented pace, and regulations are tightening across industries. In a recent conversation at the S4 conference, Vivek Ponnada, SVP of Growth & Strategy at Frenos, shared valuable insights on how organizations can bolster their Operational Technology (OT) security posture. Frenos, a startup backed by recent seed funding, focuses on prioritizing risks and delivering immediate value to its customers.
The Need to Act Before Regulations Demand It
Vivek emphasized the importance of proactive action rather than waiting for regulatory mandates. “Waiting for regulations is like waiting for the doctor to tell you to stop eating fries because you’re at risk of a heart attack,” he said. Organizations must recognize that OT security has long been an underserved segment, often overshadowed by IT security. With increased attention from companies like Moody’s and insurance providers, now is the time to address OT security vulnerabilities.
Common Mistakes in OT Security Implementation
One of the most critical mistakes Vivek highlighted is treating OT security as a “science project.” Many companies delay action by embarking on lengthy, complex assessments that take months to complete. “There’s already 15+ years of experience and proven solutions in the industry,” he said. Rather than trying to “boil the ocean,” organizations should focus on quick wins to build momentum and demonstrate value.
Shifting the Value Proposition Beyond Insurance
Security tools are often seen as an insurance policy—essential but non-revenue-generating. Vivek advised vendors to showcase value beyond risk mitigation. For instance, upgrading infrastructure not only enhances security but can also improve reliability, uptime, and operational efficiency. “If security investments align with revenue goals, decision-makers are more likely to prioritize them,” he noted.
Addressing the Skilled Labor Shortage with Automation
The OT security industry faces a significant skills gap. With limited talent available, automation becomes a key enabler of resilience. “We can’t solve the labor shortage overnight,” Vivek said, “but we can use AI and automation to empower existing teams.” By implementing policies that streamline processes and facilitate knowledge sharing, companies can extend the capabilities of their workforce across multiple sites.
Frenos’s Approach: Faster, Continuous OT Security Assessments
Vivek explained that one of the biggest challenges in OT security is the delayed realization of value. Traditional approaches often require 12 to 24 months before tangible results emerge. Frenos aims to address this by offering repeatable, consistent, and continuous assessments. This approach allows organizations to identify and address high-priority risks immediately rather than waiting for extensive assessments to conclude.
The Low-Hanging Fruit: Security Awareness Training
When asked about the easiest immediate action organizations can take, Vivek pointed to employee training. “The biggest risk often comes from a lack of security awareness,” he said. By educating employees about security best practices, companies can significantly reduce insider threats, whether malicious or accidental. Awareness programs are cost-effective and yield quick, substantial benefits.
Using Safety as a Model for Security
Drawing from his experience at S4’s metrics challenge, Vivek advocated for leveraging safety protocols as a model for security initiatives. “Many OT professionals already understand the importance of safety training, regular checks, and protective equipment,” he said. Organizations can use familiar safety metrics, like near-misses, and apply similar concepts to track and manage cybersecurity incidents.
Looking Ahead
The conversation with Vivek underscores the urgent need for proactive, practical, and people-focused strategies in OT security. As cyber threats grow more sophisticated, companies must prioritize risk, invest in automation, and build a culture of security awareness.
About the author
Lucian Fogoros is the Co-founder of IIoT World.
Related articles:
- Strengthening OT Supply Chain Security: Key Insights from S4 Conference
- Fortinet’s Approach to OT Security: Bridging IT and Industrial Worlds with Ruggedized Solutions
FAQ Section
1. Why does Vivek Ponnada of Frenos argue against treating OT security as a lengthy assessment project?
Vivek Ponnada, SVP of Growth & Strategy at Frenos, stressed that there are already 15+ years of experience and proven solutions available. Traditional approaches require 12-24 months before producing tangible results, whereas Frenos advocates for repeatable, continuous assessments that enable organizations to identify and address high-priority risks immediately.
2. What does the 2024 SANS ICS survey reveal about OT security incidents?
The 2024 SANS ICS survey found that 70% of organizations experienced at least one OT security incident in the prior 12 months.
3. What is the most cost-effective immediate action to improve OT security?
According to Ponnada, employee training represents the most cost-effective immediate intervention, since the biggest risk often comes from a lack of security awareness. He also suggested leveraging existing safety protocols, such as near-miss tracking, to manage cybersecurity incidents.
Related from IIoT World:
