Passing an audit doesn’t mean you’re protected. A frank look at how compliance frameworks became a false sense of security in OT environments.
Let me say something that tends to make compliance officers uncomfortable.
Passing your audit does not mean your plant is secure. In fact, in some OT environments, a clean audit score and a dangerous security posture can coexist so comfortably that no one notices until something goes wrong.
I’ve seen it happen. So have most of the IT and OT security executives who participate in our roundtables at ITRoundTable. And yet the confusion between compliance and security persists — in budget conversations, in board presentations, in how teams measure progress. It is one of the most expensive misunderstandings in industrial cybersecurity.
What compliance frameworks were designed to do
Frameworks like NERC CIP, IEC 62443, and NIST SP 800-82 exist for good reasons. They establish baselines. They create audit trails. They give regulators a common language for evaluating whether organizations are doing the minimum required. That matters.
But here is what they were never designed to do: protect your specific plant, with your specific assets, your specific vendors, your specific network topology, and your specific operational dependencies from the actual threats targeting your industry right now.
Compliance is a floor, not a ceiling. Treating it as a destination is where organizations get into trouble.
The audit paradox
Here is the paradox that executives in our roundtables describe again and again. An organization invests significant time and resources in achieving compliance. The audit passes. Leadership breathes easier. Budget pressure increases. And the security team, which knows the real picture, quietly understands that the audit measured documentation, controls at a point in time, and process adherence — not whether a determined attacker could reach a critical system today.
Our April 2026 Executive Insights Report captures this tension directly: “The most persuasive internal case for investment is not fear of cyberattack alone; it is the operational consequence of an avoidable disruption.”
Compliance frameworks rarely speak the language of operational consequence. They speak the language of control categories, documentation requirements, and periodic assessments. Those things have value. But they do not tell you whether an attacker can reach your SCADA system through a vendor’s unmanaged remote access path that was installed three years ago and never reviewed.
Raw vulnerability scores are misleading you too
The compliance mindset bleeds into how many OT teams manage vulnerabilities. They pull a CVE report, sort by severity score, and work down the list. It feels disciplined. It looks measurable. It is often the wrong approach entirely.
In OT environments, a high CVE score does not indicate whether the vulnerability is reachable in your environment, exploitable given your specific configuration, or even feasible to patch within your maintenance windows. And a lower-scored vulnerability on a system that sits at the intersection of your most critical process paths can represent far more actual risk than anything at the top of that list.
What leading organizations are moving toward is exposure management — prioritizing based on reachability, operational consequences, asset criticality, and feasible remediation windows. That is a fundamentally different discipline than compliance reporting, and it requires a fundamentally different conversation with leadership.
The conversation that needs to happen
None of this means compliance is unimportant. It means compliance should be the beginning of the security conversation, not the end of it.
The shift I’d encourage every IT and OT security leader to make is this: stop translating security findings into compliance language, and start translating them into operational language. Downtime risk. Recovery time. Safety exposure. Revenue impact. Customer commitments at risk.
When you bring a finding to your leadership team framed as a CVE score or a control gap, you are asking them to care about something abstract. When you frame it as “if this exposure is exploited, here is what stops, here is how long recovery takes, and here is what it costs” — you are speaking a language they already understand.
That shift also changes what gets funded, what gets prioritized, and what gets fixed. Which is, ultimately, the point.
John Moore is the CEO of ITRoundTable, Inc., a nonprofit association that facilitates private peer roundtables for Fortune 1000 IT, OT, and AI security executives. The insights referenced in this article draw from ITRoundTable’s April 2026 Master Executive Insights/Best Practices Report, “Securing the Connected Industrial Enterprise.”