Critically Secure
A free weekly newsletter covering the policy, technology, and events shaping the security of the world's critical infrastructure.
Thanks for subscribing — check your inbox to confirm.
Remote access is the OT attack surface, and vendors built it that way
Exposed PLCs keep getting framed as an operator discipline problem. They are closer to a procurement outcome — and that changes who has to fix it.
There are roughly 50,000 US water systems and most serve under 10,000 people. CISA can publish all it wants; the distribution model is the broken part.
The router campaigns and platform seizures describe dormant access, not encryption events. Budget follows the threat with the visible price tag.
Security teams get the demo. Engineering and procurement made the decision that created the exposure, often years earlier. That gap explains most of the friction.
From September, manufacturers of products with digital elements owe an early warning within a day and a full notification within three. Most have no process for either.
Subscribe to Critically Secure
Join a community of professionals interested in the trends and strategy shaping the security of critical infrastructure.
Free. Independent. Unsubscribe any time.
Thanks for subscribing — check your inbox to confirm.