PDF · free download, no form
Want the next one?
Optional. The download above never asks for your email.
Get the OT briefing
By subscribing, you agree to receive the OT briefing by email from Hillstrong Group Security, Atlanta, GA. Unsubscribe at any time with the link in every email. See our privacy policy.
// ebook
The Four Hats of Cyber-Risk Exposure
Chuck Tommey ·
The Four Hats of Cyber-Risk Exposure is Chuck Tommey’s guide for companies that build connected hardware, service it under contract, and may operate it inside critical infrastructure. It argues that those companies face four distinct sources of cyber risk on the same systems, and that one program scoped to where they converge can cover all four. Chuck is a Co-Founder and Principal Consultant at Hillstrong Group Security.
What is inside
- Introduction. One vulnerability, four liabilities
- Chapter 1. The enterprise hat: when cyber risk reaches the boardroom
- Chapter 2. The product hat: every unit you shipped is still your problem
- Chapter 3. The operator hat: the service you sell is the attack path you own
- Chapter 4. The critical infrastructure hat: when your asset belongs to the grid
- Conclusion. Scope to the convergence, with a four-hats self-assessment
Why one program misses three hats
Chuck wrote the book after assessments where a capable team with a real budget had covered the corporate network well and said almost nothing about field firmware, the service platform reaching into customer sites, or the reporting clock on a grid-connected asset. Each middle chapter names where the exposure starts, what triggers it, what current rules require (with citations current as of mid-2026), how it fails, and what to do.
One defect, four events
The core idea is convergence. The product you sell is the asset you service and a node on the grid. One firmware flaw can become a product-liability event under the EU Cyber Resilience Act, a breach of a customer service agreement, and a grid incident with a one-hour reporting clock. A company that splits those across separate teams will answer each one late.
Build the spine first
The conclusion sets out a shared spine of controls, then adds what each hat needs alone: board evidence, update-channel protection, tenant segmentation, and control-network defense. As Chuck puts it, “The hat you skip is the one an adversary will choose.”
For the operator hat, see third-party vendor risk management. To build a reporting pipeline to your tightest clock, see OT incident response planning and simulation. The Four Hats white paper carries the table of reporting clocks.
Download the free PDF from this page. No form, no email required.