You Deserve to be Hacked

The episode contains genuine practitioner knowledge - particularly that OT can crash under a standard vulnerability scan, and that monitoring rather than patching is the pragmatic strategy - but the density is diluted by paraphrasing, filler affirmations, and broad scene-setting that pads large portions of the runtime.

“nine times out of 10, you can't even perform a simple vulnerability scan on a piece of OT just because IT can't handle the traffic. Or for other reasons, it will just stop working”

“OT testing isn't about breaking things. It's about proving whether an attacker could, um, so we focus more on paths rather than payloads”

The safety-vs-security tension unique to OT - where emergency access requires universal override, making traditional credential security counterproductive - is a genuinely non-obvious framing, and the 'paths not payloads' articulation is crisp; however, most of the content (segmentation, patching gaps, legacy risk) is standard OT security discourse.

“the reason they have that is because in an emergency anyone needs to be able to access that piece of technology and turn it off. And I think that's why access control around operational technology is a very different mindset”

“legacy OT isn't insecure because it's old, but it's because of the fact that it was never meant to be defended because it wasn't supposed to be connected”

Amy has credible engineering depth (aircraft wiring, EV charging PCB design, hospital scanner hands-on) and James offers real red-team anecdotes from OT engagements; however, James works for Covert Swarm, the podcast's own sponsor company, which blunts independence and raises promotional conflict.

“I started my career wiring aircraft. I kind of appreciate the thing that scarily there is some aircraft still flying with wiring that I put in some two decades ago as a technician”

“I've seen various pieces of OT that when we've done a simple penetration test, not even a test, uh, where we've aimed at OT or IoT, and we found just via a, you know, simple port scan devices that, that the owners of the business didn't even know were there really”

The episode offers several concrete illustrative anecdotes - open WiFi at a food processing plant, browsing BBC on a hospital scanner terminal, hotel HVAC default codes - but lacks any hard metrics, named vendors, CVEs, breach statistics, or dollar figures that would let a listener act with precision.

“it was, was a health foods processing plan. And on, on that network you could, you could go anywhere just via an open wireless network”

“I've got an open browser there just from browser connected to the Internet. We're in the UK BBC.co.uk”

The host keeps the conversation moving and occasionally prompts for concrete examples ('Could you bring that to life for us?'), but rarely challenges claims, allows guests to give safe non-answers, and frequently paraphrases what was just said rather than probing further - producing a collegial chat rather than a rigorous interrogation.

“Could you bring that to life for us? So how, in the engagements that you've been involved in, how easy is it to pivot from an IT network into a connected OT environment typically?”

“I think one of the things that we always aim to do on this podcast is to try and avoid panic whilst acknowledging the reality of the risks”