Hunting the OT adversary: A behaviour-led operating model (constrain, observe, pursue)

Operational Technology (OT) and Industrial Control System (ICS) environments face escalating threats from sophisticated adversaries who exploit the growing convergence of IT and OT networks. Recent high-profile incidents have shown that traditional, alert-centric detection methods too often identify threats only after significant damage has occurred, exposing organisations to real-world safety and operational risks. Legacy infrastructure, limited native visibility, and the critical nature of industrial processes make these environments especially challenging to defend. Despite increased investment in monitoring and visibility, many organisations continue to lack a structured, proactive, and repeatable approach to identifying and mitigating adversary behaviour before it escalates.

To address this, the session introduces a behaviour-led threat-hunting operating model—centred on Constrain, Observe, Pursue—that moves beyond signature-driven, reactive approaches. Unlike conventional methods that rely on known indicators or isolated alerts, this model empowers defenders to proactively identify subtle patterns of malicious activity and adversary movement. By focusing on adversary behaviour, rather than static signatures, organisations can achieve earlier detection, reduce alert fatigue, and align security efforts with the unique operational demands of OT and ICS environments.

At the core of this model are three integrated capabilities. First, Zero Trust principles are adapted to OT constraints, using segmentation, least-privilege access, and session monitoring to constrain adversary movement without disrupting operations. These controls not only reduce risk—they generate valuable telemetry and predictable pathways, making adversary activity observable. Second, behavioural visibility is engineered across both IT and OT environments, baselining normal interactions between users, systems, and protocols. This allows defenders to identify meaningful deviations such as unauthorised engineering workstation activity, anomalous protocol behaviour, and unexpected configuration changes. Third, these signals enable organisations to pursue structured threat hunting, with continuous hypothesis generation, testing, and refinement, leveraging threat intelligence, exposure context, and operational data.

A key area to apply the model is the IT/OT boundary, where adversaries commonly transition from enterprise environments into industrial networks. By combining constrained access, behavioural telemetry, and targeted hunt hypotheses, organisations can detect and investigate these transitions earlier—before adversaries can impact physical processes.

Attendees will leave with a clear, actionable framework for incrementally applying the proposed model within their own environments. The session outlines key milestones for phased adoption—beginning with risk assessment and control prioritisation (to constrain), followed by the integration of behavioural observability and the establishment of proactive threat-pursuit practices. Practical guidance is provided for aligning these efforts with operational realities, assessing current detection maturity, and identifying capability gaps, enabling organisations to advance their OT security posture without disrupting production systems.

Looking ahead, adopting a behaviour-led approach to threat hunting will position organisations to better anticipate and adapt to an evolving threat landscape. As adversaries continue to refine their tactics and as regulatory expectations evolve, this model will equip organisations not only to protect critical infrastructure but also to demonstrate resilience and effective risk management. Concluding with a real-world scenario, the presentation illustrates how this model can surface and stop adversary activity that traditional alerting may miss—enabling faster, more confident detection in the most sensitive and complex networks.