TL;DR

• OT cybersecurity must balance protection with continuous uptime.
• IT-focused tools can disrupt critical OT operations.
• Fit-for-purpose OT security solutions reduce implementation risk.
• Effective cybersecurity strategies now assume systems are already compromised.
• Modernization and assessment are key starting points for improvement.

Why this matters now

One of the primary challenges of deploying cybersecurity technology in operational technology (OT) infrastructure is that most cybersecurity solutions are designed for IT enterprises. This often means those solutions can be disruptive, potentially causing outages that are unacceptable in a 24x7x365 OT environment.

This challenge is one that Emerson’s Nicholas Janouskovec has spent much of his career addressing. In a recent interview in ITTech Pulse, he explores how teams can introduce cybersecurity tools without introducing new failure points.

Finding the right mix

The biggest challenge in securing OT technologies is finding the right balance between security and uptime. When an IT system goes down, it is typically an inconvenience—but when an OT system fails, the consequences can be far more serious.

“If a control system suddenly stops working, it can mean power disruption, water delivery disruption, or even environmental or safety incidents. Any update action taken brings risk of negative consequences on the targeted endpoints. Those risks must be accounted for. However, a poor cybersecurity posture can also create the same risk of unavailable systems leading to outages, so implementing solutions is always a careful balancing act. We cannot take control away from the team operating the plant, but we also must implement and update solutions to mitigate risk.”

This highlights the dual risk OT teams must manage—both from outages and from vulnerabilities.

Takeaway: OT cybersecurity requires balancing system availability with protection against threats.

The solution lies in adopting fit-for-purpose cybersecurity tools designed specifically for OT environments. As an example, Janouskovec points to Emerson’s recent partnership with OPSWAT™:

“OPSWAT is dedicated to and focused on OT environments. Their willingness to collaborate with us and make the necessary adjustments to develop products that allow for better scheduling and feedback on process status is critical to providing the control necessary to implement effective cybersecurity solutions—informed by feedback from users—that meet the needs of OT.”

Purpose-built tools help ensure security measures align with operational realities.

Takeaway: OT-specific cybersecurity solutions minimize disruption while improving protection.

In many industries, this challenge is further complicated by regulatory requirements, making cybersecurity not just a best practice, but a necessity.

Cybersecurity strategies are changing

In addition to operational complexity, teams are facing an increasingly aggressive threat landscape. The rise of ransomware and AI-driven attack methods has significantly increased both the volume and sophistication of cyber threats.

Traditional approaches—such as relying solely on firewalls and antivirus software—are no longer sufficient.

“Today, the most effective strategy is to assume the attacker is already inside and that systems are already compromised, then build layers of defense and recovery to mitigate that challenge as well. Teams must develop ways to recover and rebuild/backup and restore quickly. They also need ways to prevent lateral movement and stop movement between networks. And, most importantly, they must also operate under the assumption all those protections will fail at some point and have a higher-level plan for coming back from that disaster.”

This reflects a shift toward a resilience-based cybersecurity model rather than a purely defensive one.

Takeaway: Modern OT cybersecurity assumes compromise and focuses on layered defense and rapid recovery.

Fortunately, the same AI that is strengthening cyber threats is also helping adapt and improve the security technologies layered into OT infrastructure. Industrial control system cybersecurity is increasingly adopting AI technology to help zero-trust solutions adapt to the constantly changing threat landscape. Combined with traditional defense layers, secure-by-design automation solution development practices, and tools like Emerson’s Power and Water Cybersecurity Suite, these technologies help teams stay ahead of emerging threats and ensure safe, secure operations.

Staying up to date

So, how do teams begin improving their cybersecurity posture? The first step is modernization.

“Unsupported solutions are unlikely to receive patches, meaning attack surfaces will remain live until systems are replaced.”

Legacy systems represent a significant vulnerability, particularly when they can no longer receive updates or patches.

Takeaway: Legacy systems increase risk and must be modernized to maintain security.

The most effective path to modernization is to conduct a cybersecurity assessment. By understanding their current state, teams can identify gaps, prioritize improvements, and build a roadmap for stronger defenses.

Working with an experienced automation solutions provider, organizations can then implement layered defenses, modernize infrastructure, and move toward a zero-trust architecture.

Ultimately, strengthening cybersecurity is an ongoing process—not a one-time project—and there is no wrong time to begin.

Takeaway: Assessments and incremental improvements are key to building a strong, sustainable cybersecurity posture.