{"id":187514,"date":"2026-02-15T03:13:00","date_gmt":"2026-02-15T08:13:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/02\/15\/from-concept-to-consequence-how-s4x26-bsides-ics-and-industrial-cyber-days-are-reframing-ot-security\/"},"modified":"2026-02-15T04:05:09","modified_gmt":"2026-02-15T09:05:09","slug":"from-concept-to-consequence-how-s4x26-bsides-ics-and-industrial-cyber-days-are-reframing-ot-security","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/02\/15\/from-concept-to-consequence-how-s4x26-bsides-ics-and-industrial-cyber-days-are-reframing-ot-security\/","title":{"rendered":"From concept to consequence: How S4x26, BSides ICS and Industrial Cyber Days are reframing OT security"},"content":{"rendered":"

From concept to consequence: How S4x26, BSides ICS and Industrial Cyber Days are reframing OT security<\/a><\/p>\n

https:\/\/industrialcyber.co\/features\/from-concept-to-consequence-how-s4x26-bsides-ics-and-industrial-cyber-days-are-reframing-ot-security\/<\/a><\/p>\n

Publish Date: 2026-02-15 03:13:00<\/a><\/p>\n

Source Domain: industrialcyber.co<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

As the industrial cybersecurity calendar accelerates through the first quarter of 2026, events like S4, BSides ICS\/OT, and Industrial Cyber Days Manufacturing, once again, are demonstrating the power of community-driven conversation in moving OT security from the realm of abstract risk to concrete consequence.\u00a0<\/p>\n

At S4x26 in Miami Beach, the event\u2019s agenda focuses on in-depth technical sessions, proof-of-concept exhibits, and Birds of a Feather meetings that allow asset owners, researchers, and practitioners to discuss OT security and security practices in an unscripted manner that\u2019s rarely, if ever, available at vendor expos. The conversations go well beyond vendor narrative and explore the reality of the trade-offs, and even incorporate AI-driven topics on the nature of connectivity and threat evolution.<\/p>\n

On the day before S4, BSides ICS\/OT will create a more grassroots atmosphere for focused learning and peer exchange. Its schedule blends keynotes and breakout talks that surface practical questions around responsible AI adoption in grid operations, skills for protecting industrial environments, and integrating guidance on OT asset inventories.<\/p>\n

Meanwhile,\u2002Industrial Cyber Days Manufacturing concentrates on the OT ecosystem practitioners\u2019 connection in manufacturing, with specific forums tailored to the unique challenges\/ shared threat experiences in automation. All these programs focus on a shifting trend in the discourse on industrial cyber, from the older vendor-centric stages to the places where\u2002experience, operations-based knowledge, and cooperative problem-solving are the cornerstones for the future of industrial security in the age of AI and cyber-physical threats.\u00a0<\/p>\n

Community conversations continue to shape OT security<\/p>\n

Industrial Cyber spoke with industrial cybersecurity experts to examine how community\u2013 and practitioner-led events shape how risks are understood, prioritized, and debated across critical infrastructure sectors.<\/p>\n

Mike Holcomb, founder, UtilSec<\/p>\n

\u201cEven though the OT\/ICS cybersecurity field has come a long way in just the last few short years, there is still a substantial lack of knowledge amongst owners and operators on not only the need for cybersecurity in OT\/ICS, but how to go about securing an OT\/ICS environment,\u201d Mike Holcomb, an OT\/ICS cybersecurity consultant and educational content creator, told Industrial Cyber. \u201cSuch events help to address both of these issues in helping owners\/operators not only understand the safety and operation availability risks that cyber-attacks present to their own sites, but also how to take steps in limiting those risks.\u201d<\/p>\n

Andrew West, a SCADA Communications and OT Cybersecurity Consultant at Integral SCADA<\/p>\n

Andrew West, a SCADA communications and OT cybersecurity consultant at Integral SCADA, told Industrial Cyber that in his view, community and practitioner-led events are great places for information sharing. \u201cHowever, they also need input from experts who may be aware of specific information that may not be public. One of the things I find most frustrating is not being able to get details about a particular threat I know exists, but no one will discuss because it is \u2018too scary.\u2019 In the absence of data, a lot of mis-informed opinion rises. Sometimes this underplays the seriousness of an issue or leads to ineffective responses.\u201d\u00a0<\/p>\n

He noted that it also goes the other way, where someone who doesn\u2019t understand the details also fails to understand that it is being addressed and continues to urge more action. \u201cThis then diverts them from other things.\u201d<\/p>\n

West advises the need to share openly. \u201cI\u2019d much rather know accurate information about a risk, even if I cannot address it, than to be kept in the dark. I also know of things that really concern me that most people ignore because the public information includes analysis by people who do not understand (and therefore are unaware of) some of the issues.\u201d<\/p>\n

Jonathon Gordon, directing analyst at Takepoint Research<\/p>\n

Community and practitioner-driven events act as a reality filter for the industry, each playing a different but complementary role, Jonathon Gordon, directing analyst at Takepoint Research, told Industrial Cyber. \u201cSome widen the entry point, creating accessible and affordable spaces where emerging professionals and seasoned practitioners can exchange real-world lessons without lowering technical standards. Others operate at the leading edge, focused on depth, rigor, and the challenges faced by highly mature, well-resourced industrial organizations looking to take the next step. Still others are designed around global access, recognizing that risk does not shrink simply because travel budgets do.\u201d<\/p>\n

He added that risk does not scale down because budgets do.<\/p>\n

\u201cAcross all of them, what truly shifts is the emphasis. The conversation moves from checklist alignment to operational consequence,\u201d according to Gordon. \u201cYou hear how remote access controls delayed maintenance, how segmentation complicated recovery, how backup strategies failed under live pressure. The real test is not whether a control exists. It is whether it holds when the plant is under stress. That dialogue reshapes priorities and keeps the industry focused on uptime, safety, and resilience rather than abstract threat categories.\u201d<\/p>\n

Brian Foster, OT security strategist<\/p>\n

These events have acted as the industry\u2019s reality filter compared to the hype that often fills the vacuum in cybersecurity, Brian Foster, an OT security strategist, told Industrial Cyber. \u201cThey shift the conversation from theoretical vulnerabilities to tangible operational impacts by demonstrating real exploits on physical hardware. This has provided the unexpected result of forcing a standardization of risk language, allowing asset owners to prioritize defenses based on engineering consequences\/safety rather than abstract marketing.\u201d<\/p>\n

He added that by providing a venue for ground-truth intelligence, \u201cI argue these events help security budgets align with the most critical hazards facing critical infrastructure. Ultimately, they bridge the gap between cyber risk and operational safety, maturing how the entire sector understands and discusses resilience.\u201d<\/p>\n

Moving OT security from concept to consequence<\/p>\n

At events such as BSides ICS, S4, and Industrial Cyber Days, the executives address how discussions have helped move the industry away from abstract cyber risk toward real-world operational, safety, and resilience challenges faced by asset owners and operators.\u00a0<\/p>\n

Holcomb noted that while such events can include talks based on research and hypothetical situations, there is a growing number of talks based on helping those who work to protect their plants from cyber-attacks, to help provide those team members with the practical, real-world information that these defenders need to keep the attackers out and keep their environments up and running.<\/p>\n

\u201cI think \u2018how\u2019 varies by individual case,\u201d according to West. \u201cI think that raising awareness almost invariably has positive benefits, even if there is little or no perceptible change in action. I do know of entities that have implemented specific programs as a result of information sharing and that this has materially improved their postures.\u201d<\/p>\n

Gordon recognizes these events as having changed the framing of the problem. \u201cSeveral years ago, much of the discussion centered on breach headlines and adversary sophistication. That context still matters, but it is no longer the core focus. The emphasis has shifted toward what actually fails when systems are placed under stress.\u201d<\/p>\n

\u201cThe dialogue today is far more operational. Practitioners describe real control system weaknesses, legacy exposure that cannot simply be patched away, segmentation designs that behave differently during live incidents, and recovery plans that look solid on paper but struggle in production,\u201d he added. \u201cRemote access friction, backup reliability, and incident response coordination are discussed in terms of uptime, safety, and continuity.\u201d<\/p>\n

He further noted that the tone is less theoretical and more consequence-driven. \u201cThe focus has moved beyond detection and visibility toward resilience and the ability to act effectively when conditions start to degrade. This evolution from abstract threat narratives to practical operational impact is a clear sign that the industrial cybersecurity community is maturing.\u201d<\/p>\n

Foster observed that these forums anchor risk in physical reality. \u201cBy demonstrating how code affects actual hardware\u2014like pumps or breakers\u2014they shift the focus from patching to safety. My S4x26 talk will drill directly into this, covering how code can redefine what power means on the grid and how that can result in real-world damage to critical infrastructure.\u201d<\/p>\n

That said, he added that the real magic happens in the hallway track. \u201cI\u2019ve had in-depth conversations with counterparts on how to resolve month-to-year-long security challenges that yield real results when everyone returns home while standing in the hallways. These informal exchanges translate abstract threats into site-specific defensive playbooks. We are no longer just securing data; we are ensuring the lights stay on through shared, battle-tested field intelligence that vendors often haven\u2019t even documented yet.\u201d<\/p>\n

Where industrial cybersecurity finds common ground<\/p>\n

From their perspective, the executives look into how industry events, both physical and virtual, foster trust and collaboration among researchers, asset owners, vendors, and policymakers across the industrial cybersecurity ecosystem.<\/p>\n

Holcomb said that industry events act as a common location where people can come from different roles, no matter where they are in the world. \u201cJust the fact that people come together in the same place provides an immediate connection where people can start to have a bit more empathy and understanding for the other, realizing that they\u2019re on the same team and want the same thing \u2013\u00a0 to stop cyber-attacks from impacting OT\/ICS.\u201d<\/p>\n

\u201cI have observed that some collaborations only occur once people have met and performed whatever meta-cognition it is that we do to assess that other parties are appropriate for that collaboration,\u201d West said. \u201cFor me, this works best face-to-face, with virtual meetings being a poor second and other forms of contact being inconsequential. Summary: Meeting in person and hallway\/water cooler discussions are the best ways to identify who might be a fellow-traveller.\u201d<\/p>\n

He added that he would love it if \u201cwe could get more policy-maker\/regulator involvement. These people seem the most detached from the reality that most of us face, or, at least, seem to have the most difficulty explaining how what they propose is sensible and should be listened to.\u201d<\/p>\n

\u201cTrust in industrial cybersecurity is built through shared exposure to constraints and consequences, not through statements,\u201d Gordon said. \u201cResearchers need to understand operational reality across distributed sites. Asset owners need to grasp the technical depth of legacy exposure. Vendors need to hear what fails under production pressure. Policymakers need to see how guidance translates into plant-level execution. These forums work because, for a moment, the incentive shifts from positioning to problem-solving.\u201d<\/p>\n

He added that when operators explain why a recommended control is difficult to implement at scale, it influences how vendors design and how regulators think about timelines. \u201cWhen researchers demonstrate credible exploit paths in real ICS components, it reframes how boards view legacy risk. The value is not in agreement.\u201d\u00a0<\/p>\n

Equally important are the conversations outside the formal agenda, according to Gordon. \u201cCorridor discussions and informal exchanges build the personal connections that sustain collaboration long after the event ends. Those moments humanize the ecosystem and create trust that carries throughout the year.\u201d<\/p>\n

\u201cThese events provide the DMZ necessary for a collective defense. By humanizing the actors\u2014turning a vulnerability reporter into a collaborator over coffee\u2014they replace adversarial legal threats with collaborative fixes,\u201d Foster said. \u201cAnd I mean that literally, when I tell a vendor about a vulnerability we have exploited in their product on a conference call, they are often defensive. When it is over, coffee or something stronger at a conference, they just want to know more about it and our ideas to fix it.\u201d<\/p>\n

He added that virtual and physical forums provide many benefits, such as allowing policymakers to witness technical plant-floor realities, ensuring regulations are operationally feasible. \u201cMeanwhile, vendors receive unvarnished feedback from the no-downtime environment separate from their contractual obligations. These circles of trust enable rapid, informal benchmarking that solves problems faster than any formal reporting structure I have seen. Ultimately, they create a shared ecosystem where researchers, owners, and vendors are unified in a single mission: protecting critical infrastructure.\u201d<\/p>\n

Inside the candid debates reshaping industrial cybersecurity<\/p>\n

The executives address whether forums like BSides ICS, S4, and Industrial Cyber Days changed how sensitive or complex topics, such as legacy system exposure, IT and OT convergence, and incident response readiness, are discussed more openly and constructively.\u00a0<\/p>\n

Agreeing somewhat, Holcomb said that different forums, especially in-person events, do provide practitioners a safe venue for sharing past experiences and stories about what has been happening behind closed doors in the industry, so that more helpful information about various incidents and other issues that plague OT\/ICS is starting to come out more and more. \u201cWhile more information is coming out, it is still a trickle compared to the amount of public information sharing that happens in the IT world.\u00a0 We\u2019re on the path to get there, but we have a long way to go.\u00a0 It\u2019s one of the biggest challenges we face in OT\/ICS cybersecurity today.\u201d<\/p>\n

Gordon recognizes that the shift has been meaningful, but it is a disciplined openness. \u201cIn the past, legacy exposure, convergence risk, and gaps in incident response were often minimized or discussed in broad terms. Today, those issues are addressed more directly, with greater maturity.\u201d<\/p>\n

He added that it is now acceptable to acknowledge where environments are fragile without exposing what must remain protected. \u201cPractitioners speak candidly about unsupported systems, stalled segmentation efforts, and recovery exercises that revealed coordination gaps. At the same time, they avoid disclosing sensitive network details or architectural specifics. This is not reckless transparency. It is professional transparency. Leaders understand the line between sharing lessons and exposing vulnerabilities.\u201d<\/p>\n

That balance has made discussions more constructive, allowing the community to learn from real challenges while maintaining the confidentiality the domain demands.<\/p>\n

\u201cAbsolutely. These forums have dismantled the shame surrounding legacy systems, replacing it with proactive strategies like compensating controls and consequence-based defense,\u201d Foster said. \u201cCollectively, we\u2019ve largely moved from adversarial IT\/OT turf wars toward integrated governance and shared incident response playbooks (between OT\/IT).\u201d<\/p>\n

However, he noted, \u201cthe industry and I must remain humble. Despite the open dialogue, 15-plus-year-old, highly exploitable vulnerabilities remain the operational norm across much of our critical infrastructure. While the discourse has matured, the deployment of fixes lags. We are talking the talk in the conference halls, but many vendors continue to not patch or update their software components\/libraries, and no shortage of facilities continue to go years\/decades between deploying available patches.\u201d<\/p>\n

Inside the off-script OT security debates<\/p>\n

The executives explore the types of insights or practitioner-level discussions that tend to emerge at these events that are less likely to surface in vendor-led conferences or more traditional industry forums.<\/p>\n

Holcomb said that organic conversations that are born out of such events, when two or more people just bump into each other and start talking about what excites them, about the real-world issues that they are experiencing back at the plant. \u201cIt can be absolutely magic when different people find each other at these events, and there is an energy to that conversation that can go on to birth new knowledge, new solutions, or new companies that could help to secure the world.\u201d<\/p>\n

\u201cICS cybersecurity seems to be a strange and complex beast. There are many things that can be done that can improve an entity\u2019s cybersecurity posture. Every vendor or participant, myself included, has something to offer or a particular focus,\u201d West pointed out. \u201cNo one has \u2018The Universal Solution.\u2019 Asset owners have to tread the path of choosing some combination of training, policies, procedures, and products that makes sense for their particular needs, based on their analysis, security policies, regulations, and risk appetites.\u201d\u00a0<\/p>\n

He added that case studies or discussions of selection considerations at a general industry meeting are usually broader and more useful to the wider audience than those at a vendor meeting. \u201cBut there are always exceptions. Both kinds of meetings can provide new perspectives or fresh information. Good practice seems to be ever-evolving and willing to be open to learning.\u201d<\/p>\n

Highlighting that conversations are more about lived reality, not policy language, Gordon mentioned that there is also more candor around constraints such as budget limits, staffing shortages, and competing priorities between safety, uptime, and security hardening. \u201cThe focus is less on aspiration and more on execution. Progress starts when we talk about the gap between intent and implementation.\u201d<\/p>\n

He added that this is not to diminish vendor-led environments. \u201cA significant portion of industry learning comes from vendors and their cross-sector experience. They see patterns across multiple industrial environments and often identify emerging risks early. The difference is emphasis. Vendor forums tend to focus on capability and solution evolution, while practitioner forums focus on operational reality. Both are necessary, but they serve different purposes within the ecosystem.\u201d<\/p>\n

Foster said that \u200b\u200bat practitioner events, the discussions shift from \u2018What can this product do?\u2019 to \u2018How does this actually fail in the field?\u2019 \u201cThe DMZ quality of these events is almost mythical in my experience. Because they aren\u2019t sales-driven, the defensive guardrails of corporate-speak are significantly reduced.\u201d\u00a0<\/p>\n

He noted that within this neutral setting, discussions tend to surface a more unvarnished truth. Several firsthand examples illustrate this dynamic. In one case, an engineer openly explained why a specific security tool crashed a safety system, a level of candor rarely heard in a vendor keynote.\u00a0<\/p>\n

In another, practitioners shared the improvised yet effective fixes that keep 20-year-old proprietary protocols running. There was also a moment when the developer of an ICS intrusion detection system sat beside a grid operator in a hallway, discussing real operational challenges. It was not a formal support exchange but two experts working through a protocol parsing bug in real time. This DMZ fosters a level of raw, engineering-focused transparency that turns these events into the ultimate incubator for real-world resilience.<\/p>\n

Recalibrating industrial cyber dialogue for AI threat era<\/p>\n

As industrial cybersecurity continues to mature, the executives focus on how community and practitioner events need to evolve to remain relevant in the context of automation, AI adoption, and increasingly cyber-physical threats.\u00a0<\/p>\n

\u201cIndustry events must embrace not only mastering the fundamentals of current and past technologies in OT\/ICS, but also those newer ones that are coming to OT\/ICS at a furious pace,\u201d Holcomb said. \u201cTeams responsible for security and operations need to understand newer technologies like cloud and AI adoption. Our events can help raise awareness and education on the associated risks of these new technologies and help operations and security teams to understand how to work with the business to ensure that each newer technology is implemented as securely as possible, rather than in a vacuum.\u201d<\/p>\n

West sees this as perhaps going the other way. \u201c\u2018Traditional\u2019 controls-focused events are picking up more cybersecurity focus, and it is becoming just one of the factors in an asset-owner\u2019s considerations. The traditional ICS cybersecurity events have been quite narrow in their introspection. I suspect this might have been in part due to the difficulty in getting cybersecurity considerations onto the agenda for mainstream controls conferences a decade ago, so they found their own forum.\u201d\u00a0<\/p>\n

\u201cI think we are now at the place where cybersecurity has become mainstream and is beginning to suffer when focused on in isolation. Maybe it is time for the ICS cybersecurity world to merge back into the broader controls community, perhaps by treating it less like an outlier,\u201d he added. \u201cMaybe conferences join up by \u2018co-branding\u2019 or co-locating or otherwise finding ways to integrate. There may be a continuing need for very specific niche cybersecurity conferences where birds-of-a-feather could meet to discuss their deepest, darkest secrets. And maybe that is the direction for change: Let the general industry events broaden focus and have good cybersecurity content while witches and warlocks have their own coven.\u201d<\/p>\n

West further identified that automation, digital twins, AI, and a pantheon of threat actors are just today\u2019s new challenges. \u201cThere have always been challenges. Gone (and lamented) are those days when being able to get RS232 to work offered the reward of success. Now we have other things to work on. The focus and topics evolve, but, in the end, some of the goals do not change much: To keep the lights on, the water flowing, and people healthy and safe. The technology in between just changes faster than it used to. We sometimes need to keep reminding people why we are doing these things.\u201d<\/p>\n

Gordon said that as industrial cybersecurity matures, the events shaping it must move beyond awareness and into consequence modeling.<\/p>\n

\u201cAI-driven detection, automated response, and digital twins are beginning to enter operational environments, and that alone is starting to shift the risk profile,\u201d he pointed out. \u201cAutomation does not remove risk. It changes the speed and scale at which mistakes propagate. The real concern is not replacing engineers, but codifying flawed assumptions and deploying them widely. If we are going to automate, we must also simulate the failure modes of that automation.\u201d<\/p>\n

Gordon said that future events need to examine how automation intersects with safety systems, maintenance schedules, human oversight, and recovery models. \u201cThey must also address systemic risk, where increasingly interconnected digital and physical systems create cascading failure paths. Leading forums should function as laboratories for consequence thinking, stress testing new capabilities against realistic operational scenarios.\u201d<\/p>\n

At the same time, he highlighted that accessibility matters. \u201cEvents focused only on the most well-funded organizations will move that top tier forward while widening the gap between early adopters and the late majority. That gap already exists in industrial cybersecurity. Community and practitioner events must remain inclusive in terms of budget and attendance options so that progress is not limited to those with the largest resources.\u201d<\/p>\n

Foster said that evolution at these forums happens organically because our community is inherently restless. \u201cPresenters consistently submit cutting-edge research and topics, most currently on things such as agentic AI and autonomous cyber-physical threats. This provides event operators a rich pool to curate. This natural selection process has the added benefit of ensuring the hallway track remains the industry\u2019s problem-solving engine.\u201d<\/p>\n

\u201cAs seen at S4x26 with its \u2018Connect\u2019 theme, the focus is shifting toward the security of AI-driven industrial transformation,\u201d he concluded. \u201cWe don\u2019t force relevance; my drive, every practitioner\u2019s drive, to solve the next impossible problem naturally recalibrates these events for the era of automated resilience and will do so for whatever the next era becomes.\u201d<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

From concept to consequence: How S4x26, BSides ICS and Industrial Cyber Days are reframing OT…<\/p>\n","protected":false},"author":1,"featured_media":187515,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/industrialcyber.co\/wp-content\/uploads\/2026\/02\/2026.02.15-From-concept-to-consequence-How-S4x26-BSides-ICS-and-Industrial-Cyber-Days-are-reframing-OT-security.webp","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,30,24,31,27],"class_list":["post-187514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-breach","tag-cybersecurity","tag-exploit","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/187514"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=187514"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/187514\/revisions"}],"predecessor-version":[{"id":187516,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/187514\/revisions\/187516"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/187515"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=187514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=187514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=187514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}