Industrial Cybersecurity Insider

There are a handful of genuinely practitioner-level observations - metric gaming via controlling the red/yellow/green status, and the proposal-language gap in OEM/integrator RFPs - but the episode is padded with circular restatements of the same IT/OT friction point and closes with clichés like 'not a matter of if but when.'

“if you're the one that's in control of the red, yellow, green status, then you'll pay. You'll say, green, I did what I said I was going to do. And they'll just ignore the other 70, 80% of the assets”

“the hundreds of proposals that we do in a quarter, none of that stuff is in there”

The specific framing of CISOs gaming compliance metrics by owning the measurement methodology is a fresh and underappreciated angle, but the episode leans heavily on well-worn IT/OT oil-and-water tropes and ends with recycled cybersecurity axioms that circulate everywhere.

“when it's everybody's responsibility, that means it's nobody's responsibility”

“it's not a matter of if, but it's a matter of when”

Dino references hands-on experience at Rockwell, in the channel, and running a systems integration practice, giving him credible practitioner standing, but both speakers appear to be mid-tier consultants promoting their own firm rather than senior operators who have led OT security at scale inside a major asset-owning organisation.

“my time at Rockwell and in the channel with this. I know this problem pretty well”

“we've been looking at this seven ways to Sunday for years. And not just us as part of the design group or our prior OT cybersecurity”

There are a few concrete data points - 130 missing OT assets in a beverage-industry case, the 20-30% capture-rate estimate, a $2M modernisation project figure, and named acquisitions (Armis/ServiceNow, Dragos/Accenture) - but all are anecdotal, unverified, and surrounded by vague hand-waving rather than systematic evidence.

“missing 130 OT assets for a tool that they've had for years”

“they're capturing maybe 20, 30% of the assets in the plant and missing a big chunk of them”

Craig plays devil's advocate briefly on the 'green' metric question, which is the most incisive host moment, but the interview is overwhelmingly agreement-based - Craig repeatedly says 'yep,' 'right,' and 'no doubt' without probing the firm's own commercial conflicts or pressing Dino for hard failure-mode examples.

“for a devil's advocate, though, I'm the CISO and I'm going to say, well, yeah, but 20%, if that's the number you say I have, is better than no percent”

“Yep. No, without doubt. We see that all the time. Yeah. Yeah.”