{"id":192167,"date":"2026-03-02T12:04:00","date_gmt":"2026-03-02T17:04:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/02\/ot-cybersecurity-is-a-governance-failure-masquerading-as-a-vocabulary-issue\/"},"modified":"2026-03-02T16:30:18","modified_gmt":"2026-03-02T21:30:18","slug":"ot-cybersecurity-is-a-governance-failure-masquerading-as-a-vocabulary-issue","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/02\/ot-cybersecurity-is-a-governance-failure-masquerading-as-a-vocabulary-issue\/","title":{"rendered":"OT cybersecurity is a governance failure masquerading as a vocabulary issue"},"content":{"rendered":"

OT cybersecurity is a governance failure masquerading as a vocabulary issue<\/a><\/p>\n

https:\/\/www.controlglobal.com\/blogs\/unfettered\/blog\/55360902\/ot-cybersecurity-is-a-governance-failure-masquerading-as-a-vocabulary-issue<\/a><\/p>\n

Publish Date: 2026-03-02 12:04:00<\/a><\/p>\n

Source Domain: www.controlglobal.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. The operational technology (OT) cybersecurity community was created and serves its mission to focus on OT network cyberattacks. However, this charter does not extend to malicious and unintentional control system cyber incidents involving process sensors, actuators, motors, turbines, transformers, etc. As such, industry and government OT cybersecurity experts continue to downplay the threat of control system cyberattacks and ignore actual control system incidents that do not originate from OT networks by not calling them cyber-related.
\nThis indicates that control system cyber incidents that are not classified as internet protocol network-enabled need their own classification as issues to be addressed by cybersecurity policy, especially for critical infrastructure whose accidental and malicious cyber failures could result in widespread death and destruction. Given that the current world situation has motivated nation-states to assess their own capacity for delivering widespread damage on their adversaries, ignoring control system cyber incidents simply because they do not originate in internet protocol access is very dangerous. Our adversaries focus on compromising critical infrastructures and their control systems, not just OT networks.
\nERPI focus
\nThe European Risk Policy Institute (ERPI) was founded by the Australian Risk Policy Institute as part of the Global Risk Policy Network. Ivan Savov, Chairman of the European Risk Policy Institute, wrote the following blog:
\n\u201cFrom our ERPI \/ 3\u00b0C World SRP perspective, Weiss\u00a0is pointing at a governance failure masquerading as a vocabulary issue: if you define \u201ccyber incident\u201d through an IT breach lens, you will miss (or dismiss) the incidents that actually move risk in a 3\u00b0C world\u2014those that degrade continuity lifelines by disrupting physical processes. He makes the case that control-system cyber incidents include electronic\/automation failures across sensor signals, control logic, firmware and field device communications, and that many are non-malicious yet still produce loss of view, loss of control, equipment damage, and safety\/environmental consequences.
\n\u201cWhat matters strategically is the reporting and response architecture. Breach-centric metrics (and the cultural reflex that \u201cno attack = no incident\u201d) bias organizations toward under-detection, weak root-cause discipline, and false trend comparisons\u2014exactly when coupled infrastructures are most fragile and repair cycles are tight. Weiss\u2019s bridge condition is practical: align engineering and security on a shared incident definition, and train both communities in control-system incident reality so that operational anomalies are treated as cyber-relevant signals, not \u201cmaintenance noise.\u201d If you\u2019re responsible for critical infrastructure, this is a reminder to recalibrate your incident taxonomy and your board narrative: the control-room outcome is the headline, and the network story is only one possible path to it.\u201d
\nOTI Impact Score
\nThe Operations Technology Incident (OTI) Impact Score for measuring real-world consequences of industrial cyberattacks was unveiled at the\u00a0S4x26 Conference Feb. 23-26, 2026. The purpose of this approach is to provide a standardized way for the public and policymakers to understand cyber incident severity. The initiative is meant to address a growing problem where minor incidents are often over-sensationalized, leading to unnecessary hysteria and misallocation of critical security resources.\u00a0
\nGet your subscription to Control’s tri-weekly newsletter.
\nHowever, this approach requires that control system incidents be identifiable as cyber-related, and this is not happening. There have been more than one million control system cyber incidents in 2025, including deaths, equipment damage, and environmental impacts. Yet the only control system cyber incident identified by the OTI and the Dragos 2025 report was the December 2025 Russian cyberattack on the Polish grid. It was stated this was the first cyberattack targeting renewable resources.
\nYet, Feb. 24, 2022, the day\u00a0Russia invaded Ukraine, thousands of Viasat modems went offline caused the malfunction in the remote control of 5,800\u00a0Enercon wind turbines in Germany and disruptions to thousands of organizations across Europe yet there were OT cybersecurity experts that would not call this a cyberattack because power wasn\u2019t lost. Moreover, continuing to erroneously include the 2021 Oldsmar event as a cyberattack doesn\u2019t help either.
\nSummary
\nNetwork cybersecurity (IT and OT) and control system organizations have fundamentally different objectives and criteria when it comes to identifying and addressing cyber incidents. The Verizon Data Breach report, the Dragos 2025 Report and the OTI Impact Score are typical of OT cyber incident reporting that equate data breaches and ransomware with cyber incidents. Industry and government network security organizations cannot continue to ignore control system cyber incidents because the incidents don\u2019t meet their narrow definition – this is a governance failure masquerading as a vocabulary issue.
\nNetwork and engineering organizations need to accept the same cyber incident definition, and both network security and engineering organizations receive appropriate control system cyber incident training. Otherwise, comparing numbers and impacts from network versus control system cyber incidents will continue not only to be an exercise in comparing apples to oranges, but will also leave our critical infrastructures dangerously cyber vulnerable.
<\/p>\n","protected":false},"excerpt":{"rendered":"

OT cybersecurity is a governance failure masquerading as a vocabulary issue https:\/\/www.controlglobal.com\/blogs\/unfettered\/blog\/55360902\/ot-cybersecurity-is-a-governance-failure-masquerading-as-a-vocabulary-issue Publish Date: 2026-03-02…<\/p>\n","protected":false},"author":1,"featured_media":192168,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/img.controlglobal.com\/files\/base\/ebm\/controlglobal\/image\/2026\/03\/69a5b71bb51edb64e471fc5c-shutterstock_2376133957.png?auto=format,compress&fit=fill&fill=blur&w=1200&h=630","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[30,24,29],"class_list":["post-192167","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-breach","tag-cybersecurity","tag-network-security"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/192167"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=192167"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/192167\/revisions"}],"predecessor-version":[{"id":192169,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/192167\/revisions\/192169"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/192168"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=192167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=192167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=192167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}