Its all ones and zeros to me

For years, the conversation about IT and OT security has been framed as a warning: "Leave us alone — you don’t know what you are doing - you could kill someone - it's not a risk we need to worry about now".

While safety in operational environments is non-negotiable, this framing has become a convenient barrier — one that keeps the security team at arm’s length and reinforces the idea that cyber security is something OT can defer or exclude.

I want to challenge this narrative.

The reality is simple but uncomfortable: if applying security practices to an OT environment can inherently cause loss of life, then the system has not been designed to fail safely. Safety-critical engineering has always assumed that things will go wrong — components fail, people make mistakes, and systems behave unexpectedly. Cyber security does not invalidate that assumption; it strengthens it. Treating security as uniquely dangerous, rather than as another design condition to be engineered for, is no longer defensible.

The talk explores how the long-standing divide between IT and OT, why it still exists, and its shift from healthy caution into unhelpful gatekeeping. Phrases like "you don’t understand" or "this is different" are too often used to shut down collaboration rather than enable learning. The result is predictable: the security team are excluded from operational environments, risks go unchallenged, and accountability for cyber resilience is quietly deferred until after an incident occurs.

Rather than framing this as a cultural clash or a skills problem, I see this as a responsibility gap. Cyber security is now inseparable from the safe and reliable operation of critical infrastructure. OT engineers cannot reasonably expect to carry that burden alone, just as security professionals cannot apply IT controls blindly without understanding operational context. The solution is not separation — it is shared ownership.

As an ICS engineer, I know OT environments must be designed to fail safely and recover predictably, including under cyber conditions. If activities such as asset discovery, monitoring, or access control are considered too dangerous to attempt, that is not a reason to avoid them — it is evidence of deeper architectural fragility. Resilience is not achieved by keeping people out; it is achieved by designing systems that tolerate intervention, degrade gracefully, and recover deliberately.

I want to put out a clear call to action for OT practitioners. Cyber security can no longer be treated as "someone else’s problem." With increasing connectivity, regulatory scrutiny, and threat capability, OT professionals must actively educate and enable security teams — explaining how systems behave, where risks genuinely lie, and how controls can be applied safely. Knowledge hoarded is risk multiplied.

It’s All Ones and Zeros to Me is ultimately a talk about professional accountability. It challenges fear-based narratives and defensive postures, and argues for collaboration grounded in engineering discipline, evidence, and respect. Because when cyber events have physical consequences, exclusion is not protection — it is exposure.