Welcome to the resources page! We have compiled a collection of useful information, tools, and resources to help you
PHP2Shell shows frontier AI turning long-known, hard-to-exploit vulnerabilities into real attacks. Andrew Ginter on what AI can and cannot do for attackers, and why OT defenders must engineer attack paths away.
Andrew Ginter’s practical advice for the smallest retailers and water utilities with Internet-exposed freezers and OT devices: bring in a firewall, allow only fixed IP addresses, and go live safely.
Lior Frenkel on the joint Waterfall and Siemens Energy MDR solution: real-time OT visibility through Unidirectional Gateways, with no path back into the systems.
Andrew Ginter shares a proposed IEC 62443-3-2 Appendix C: consequence-based risk matrices that replace likelihood with credibility for high-impact OT cyber attacks.
Recommended guidelines on cyber security baseline requirements for Operational Technology (OT) systems were published in June 2026. I reviewed them…
OT security is “hard” – engineering change control (ECC) makes patching slow and expensive, many OT devices and systems have no real support for zero trust (ZT)…
Two decades ago, we founded Waterfall with one purpose: to defeat nation-state attacks impacting OT environments and critical infrastructure.
Anthropic’s Claude Mythos is the latest example of a trend many of us in industrial cybersecurity have been warning about for years.
If only we could wave a magic wand and patch everything and zero-trust everything, just like with our IT networks, then our OT networks would be “secure”
Ask different questions, get different answers. What should you be asking your OT “secure” remote access (SRA) vendor?
