// resources · author
Roger Hill
Founder and CEO, Hillstrong Group Security
Articles (33)
-
Your Capital Plan Is Already a Security Plan
Capital projects set how plants connect, get vendor support, and recover for decades. Four light additions give the CISO a seat in every design review.
-
From Asset Inventories to Stop-the-Line Maps
Build a one-page stop-the-line map for each production line: six columns, a named owner per entry, and a restoration time measured with a stopwatch.
-
Who Can Still Log Into Your Factory at 2:00 A.M.
Why OT access reviews miss vendor paths like OEM tools, jump hosts, and cellular modems, how Akira bypassed MFA, and why every path needs an expiry date.
-
Your ERP Is a Plant Floor Control System – Nobody Scoped It That Way
Why ERP and SAP MII act as plant floor control systems, what Clorox's $49 million disclosure shows, and how to triage a 9.9 CVE that no patch window owns.
-
The Line Stopped and Nobody Touched a PLC
Why Mackay Sugar and fairlife stopped production with no PLC touched, the three IT tethers (order, host, access) behind it, and a dependency list per line.
-
The Competitive Advantage of Disclosure Readiness: Why the Best Manufacturers Will Embrace Transparency
How OT disclosure readiness wins manufacturers better insurance terms, investor confidence, and customer trust, and five steps that start with materiality.
-
Building a Board-Ready OT Materiality Framework Before You Need It
Pre-define OT incident materiality across five dimensions (production, safety, environment, regulatory, insurance) with a four-level escalation protocol.
-
Incident Forensics vs. Disclosure Timelines: The Manufacturing Double Bind
OT forensics take weeks, but the SEC expects materiality calls without undue delay. Learn five steps to prepare now, from PLC baselines to forensic retainers.
-
The OT Disclosure Gap
Why most manufacturers' 10-K Item 1C omits OT risk, a sample OT-inclusive disclosure, and five steps to close the gap before your next annual filing.
-
The Clock Nobody Planned For
Why the SEC's four-business-day Form 8-K clock breaks on OT incidents, and how to score production, safety, environmental, regulatory, and insurance impact.
-
Building Resilient, Explainable AI Systems: The Hard Truth About Trustworthy Autonomy
Industrial AI earns trust through explainability, testability, and recoverability. See the five actions executives should take before scaling AI in plants.
-
Ethics & Accountability in Industrial AI: Why Trust is Your Hardest Asset to Build
How manufacturers build trust in industrial AI with the NIST AI RMF: five trustworthiness traits, four common ethics myths, and five actions for executives.
-
When Cyber-Physical Systems Collide with Privacy and IP: Preparing Manufacturing for AI’s Next Chapter
How AI turns plant data into privacy and IP exposure, from vision systems that capture biometrics to PLC files sent to vendors, and five board guardrails.
-
OT Security Meets AI: Blind Spots in the Plant Floor
AI anomaly detection works like a flashlight. It sees only the data you collect. Find where OT monitoring goes blind and how to report those gaps to the board.
-
When Patching Won’t Protect Your Factory
Why patch metrics miss most OT outages: in most disruptions Hillstrong reviewed, an operational failure caused the outage. Map dependencies instead.
-
The Value Gap in OT Security: From Telemetry to Trust
Why OT visibility tools produce findings but not decisions, how one team reframed 280 high-risk findings by consequence, and how to make telemetry useful.
-
The OT Risk the CFO Can’t See
Why patch counts and scan stats fail at the executive table, how one contractor credential caused a $3.1 million outage across four sites, and what to report.
-
How to Build a Sustainable OT Vulnerability Management Program
A lasting OT vulnerability management program needs an OT-specific RACI, central governance with site flexibility, tracked exceptions, and a steady cadence.
-
Jump Boxes and Workarounds Become Risk Nobody Owns
Improvised OT controls like jump boxes and ad hoc segmentation turn into risk nobody owns. Four steps bring them back: inventory, tier, assign, and retire.
-
The RISE Model: Prioritizing OT Vulnerabilities Where It Matters Most
The RISE model (Risk, Impact, Scoring Improvement, Effort) ranks OT vulnerabilities when CVSS misleads. A five-device example shows how the order changes.
-
Passing the Audit Does Not Mean the Plant Will Keep Running
A plant can pass every cyber audit and still stop when cloud identity or a VPN fails. Map IT-OT dependencies, test failover, and ask the board three questions.
-
How to Recalculate CVSS Scores in an OT Context
Raw CVSS base scores mislead in OT. Recalibrate them in five steps using asset role, network context, compensating controls, and business process impact.
-
What CFOs Wish CISOs Knew
How CISOs keep OT security funded in a recession: show downtime cost per facility tier and day 1, 3, and 10 exposure, and pitch uptime risk reduction instead.
-
Why Patching is Not a Panacea in OT Security
IT-style patching fails in OT. See how a pharma plant secured an FDA-validated system without a patch, and three metrics that beat patch compliance.
-
Scaling Security: Tailoring Programs for Distributed Organizations
CISOs scale OT security across distributed plants with a central framework, local flexibility, site tiering, interdependency analysis, and feedback loops.
-
Making the Business Case for OT Security
Win executive support for OT security by tying controls to five mission pillars, shaping the pitch for CFOs and COOs, and putting a number on downtime risk.
-
Turning Audit Results Into Actionable Security Improvements
Turn OT audit findings into action by ranking each one by risk, splitting the work into remediation, improvement, and optimization, and tracking KPIs.
-
Mastering Regional Regulations in a Global Compliance Framework
One global OT compliance framework sets core controls at every site, leaves room for NIS2 and NIST 800-82, and flags local deviations for review.
-
Achieving and Sustaining Cybersecurity Maturity
OT cybersecurity maturity rests on five components, from governance to incident response. Audits, training, and threat intel keep it in place once you reach it.
-
Measuring Progress and Adapting to New Threats
Track five OT security metrics, from incident response time to patch compliance, and see how one manufacturer set a target of under 1 hour to respond.
-
Developing and Executing a Cybersecurity Roadmap
Build an OT cybersecurity roadmap with seven components, from vision and risk assessment to KPIs and governance, plus sample segmentation and incident goals.
-
Setting Goals and Benchmarks for Cybersecurity Improvement
Set SMART OT cybersecurity goals and track benchmarks such as response time and patch coverage, with a case study that moves OT vulnerability coverage to 95%.
-
How to Assess Your Current OT Cybersecurity Posture
IEC 62443-3-2 sets seven steps for assessing OT risk, from defining the system under consideration through zones, conduits, and change control approval.
Talk it through with a practitioner
Book a 30-minute consultation with a senior OT security practitioner about your plants.