Fortinet Cybersecurity Podcast

The episode covers important OT/IT convergence concepts but relies heavily on restatement of a single core idea - understand your environment, build culture, then implement controls - repeated across multiple client anecdotes. While some useful framing exists (Purdue model, asset discovery basics), there's substantial filler around terminology definitions and general principles that B2B operators in security already know.

“Start simple Joe. Start simple. Get to know your environment before you secure it.”

“Most of this it comes from a uh, people mindset and cultural change. Before I start thinking about architecture”

The framing of IT/OT convergence and culture-first approaches is well-trodden in security consulting circles. The guest repackages standard CISO playbooks (people-process-technology, asset discovery, anomaly detection) without fresh angles or contrarian takes. The Purdue model reference is textbook, not novel thinking.

“Capabilities that would have existed in the IT world that could be tailored to an OT world.”

“People are your first line of defense. They're not the weak point, they're the first line of defense.”

Hossein Al Shadoki is a KPMG partner and global lead for OT/IoT, giving him relevant seniority and broad exposure. However, the transcript reveals mostly consulting rhetoric and anecdotal examples rather than deep operational expertise. He speaks as an outside advisor citing 'clients' rather than as a practitioner who built or operated OT systems at scale.

“a partner at KPMG Middle east and global lead for OT and IoT”

“As a consultant you must have seen some real success stories too. Can you give us an example, maybe without naming names”

The episode is sparse on concrete data, named companies, timelines, and metrics. References to client engagements are vague ('a couple of years ago,' 'one of my clients,' 'a large global client'). No specific attack vectors, incident data, or measurable outcomes are provided. Terminology definitions are specific but add little operational value.

“Recently one of my clients came in and the ultimate goal”

“A uh, couple of years ago we were engaged with a client where they really want to take over the visibility”

Host Joe Robertson asks reasonable setup questions and shows familiarity with the domain, but rarely challenges or pushes back on vague claims. Follow-ups are mostly affirming ('So what you're saying is...') rather than probing. The guest's lengthy, repetitive answers go largely unchecked, and no substantive disagreement or skeptical questioning surfaces.

“So part of the solution is sociological, not just technological.”

“You mean you can put in place security tools that actually slow down production, which doesn't sound like really the objective I uh, would think.”