Compliant, but still exposed: Rethinking OT cyber risk as an architectural problem

Across critical infrastructure sectors, operational technology (OT) cyber security is increasingly shaped by frameworks, standards, and regulatory obligations. Yet recent cyber incidents and operational disruptions continue to show that governance maturity does not necessarily translate into effective risk reduction.

This presentation argues that a key gap remains between the presence of security controls and security control effectiveness. In many OT environments, risk is no longer driven primarily by missing controls, but by how systems are interconnected, how trust boundaries are enforced, and how compromise or disruption can propagate across operational architectures.

The session introduces a practical model of architectural exposure pathways to explain how risk emerges despite the presence of security controls. Four representative pathway classes will be discussed: segmentation bypass, uncontrolled remote access, lateral movement, and dependency-driven operational exposure. The first three are access-driven scenarios, where compromise propagates through insufficiently controlled reachability across architectural layers. The fourth is dependency-driven, where enterprise-system compromise or disruption cascades into operational disruption through architectural and business-process dependencies, even without direct compromise of control devices.

These pathway classes will be illustrated using well-known incidents including Colonial Pipeline, Oldsmar, Stuxnet, Triton, Clorox, and cyber incidents affecting Jaguar Land Rover. A key contribution of the presentation is the distinction between access-driven and dependency-driven exposure, which is often under-emphasised in conventional OT security discussions.

The presentation also examines the role of the Purdue Enterprise Reference Architecture as a useful reference for understanding layered industrial systems, while highlighting why functional layering alone is insufficient as a cybersecurity model in highly connected OT environments. This is contrasted with risk-driven approaches such as IEC 62443 zones and conduits.

The talk concludes with a clear proposition: improving OT cyber resilience requires a shift from verifying whether security controls exist to validating whether they are effective within the live operational architecture. The aim is to provide leaders, governance stakeholders, and practitioners with a more practical lens for understanding accountability, resilience, and risk in distributed OT environments.

Three Key Takeaways

1. The gap between compliance and resilience in OT is fundamentally architectural: risk is increasingly shaped by connectivity, trust boundaries, and operational dependencies, not only by isolated vulnerabilities.
2. Not all OT exposure is the same: A useful distinction exists between access-driven exposure and dependency-driven operational disruption.
3. A new governance lens is needed: Improving OT cyber resilience requires validating security control effectiveness in practice, not just confirming the presence of controls on paper.