Control Loop: The OT Cybersecurity Podcast

The episode is split between news recaps (which add no original analysis beyond quoting agency press releases) and a surface-level regulatory explainer that covers well-known frameworks without generating novel operational takeaways. The few concrete details - INSM timelines, zone-to-zone monitoring progression - are the only real substance.

“This is fairly typical because in these types of environments, you don't want to be introducing a lot of change without time to do testing and preparation.”

“the more that folks talk and collaborate and work together, the more alignment we see”

There are no contrarian or first-principles arguments anywhere in the episode. The regulatory compliance discussion follows a completely predictable narrative arc (new standard extends old standard, industries will follow each other's lead), and the news segment is a straight read of existing public advisories with no original commentary.

“So it's kind of a natural progression. So we don't have any, there's not many published statements saying that's the direction that everyone is going.”

“I think we can look at where different industries are moving and then apply that to other industries. So it's not always going to be exactly one-to-one.”

Kimberly Graham holds a senior product title at a credible OT security firm (Dragos), giving her legitimate industry standing, but she repeatedly and explicitly disclaims expertise in the regulatory domain being discussed, which is the entire subject of the interview. This limits the depth she can credibly deliver.

“I'm not an expert on NERC SIP or TSA or so on, but I do work with a lot of people who are”

“I'm not enough of an expert to dive into the whole review process”

A handful of concrete data points exist - the 70% EPA non-compliance figure, the 36-month and 60-month INSM implementation timelines, and the July ratification date - but the interview portion lacks named customer examples, dollar figures, or detailed case evidence. The news segment cites real advisories but only paraphrases them.

“over 70%, do not fully comply with requirements in the Safe Drinking Water Act, and that some of those systems have critical cybersecurity vulnerabilities, such as default passwords”

“in 36 months, it goes into effect for all high and medium. Control centers have to be compliant. and then in basically 60 months, so five years, then everyone else has to be compliant”

The host asks broad, open-ended questions with no meaningful follow-up or pushback. Questions like 'Is it possible to look into a crystal ball?' and the 'needle between collaborative and adversarial' framing are soft and imprecise, and the guest's non-expert disclaimers are never probed or redirected to someone who could answer more definitively.

“Is it possible to look into a crystal ball and see where we're headed?”

“I guess I'm trying to understand if you have collaborative on one side and adversarial on the other. Imagine a needle between the two of those.”