How to Turn OT Risk into a Plan

Most people working in or around OT security know something is wrong. They’ve seen the flat networks, the vendor VPNs that terminate directly in the control zone, the historian that sits on both the IT and OT networks with nothing in between. The harder part is turning that instinct into something a leadership team can act on.

This workshop is where the instinct becomes a document.

In four hours, you will use a real tool (Wireshark) to discover assets on a simulated OT network without generating a single active scan packet – the only safe approach in a live industrial environment. Then you will score what you found against a consequence-weighted risk model, document the compensating controls already in place, and calculate the residual risk for each asset. The result is a completed 5-asset OT risk register that you can bring back to your organization and use immediately.

The risk register is not a practice exercise. It is built on the same methodology used in the 16-hour Foundational OT Cybersecurity course and follows NIST CSF 2.0 Identify function structure. If you decide to go further, your workshop deliverable travels with you into the course.

Who Should Take This Workshop

This workshop is for people who work in or around industrial environments and want to start doing something concrete about OT security, not just understand why it matters.

IT security professional entering OT: You know how to run a Wireshark capture. You’ve never done it in an OT context before. This workshop closes the gap between what you already know and what OT risk scoring requires.

OT / control systems engineer: You know these assets better than anyone. What you may not have is a structured way to score their risk and communicate it to leadership. The risk register gives you that language.

Operations or plant manager: You’ve sensed the exposure but haven’t been able to put a number on it. This workshop produces exactly that, a ranked list with scores your security team can act on.

Security consultant or vCISO supporting industrial clients: You need a methodology you can hand to a client that is credible, defensible, and doesn’t require a six-month engagement to produce. The risk register is that starting deliverable.

What You’ll Learn

• Use passive network monitoring techniques to identify OT assets on a simulated control network without generating active traffic
• Classify discovered assets by Purdue Model level and document device type, function, and network exposure
• Apply a consequence-weighted risk scoring model to 5 OT assets, producing a ranked risk register with compensating control analysis
• Articulate the connection between asset visibility gaps and OT security investment priorities in plain business language