By John Moore, CEO
I’ve hired both kinds of security professionals — the ones who cut their teeth patching Windows servers and hardening firewalls, and the ones who learned their trade on a plant floor, tracing conduit and understanding what happens when a PLC stops responding mid-cycle. What surprises most IT leaders stepping into OT is how little the transition resembles a lateral move. It isn’t a new toolset bolted onto old instincts. It’s a different discipline wearing a familiar name.
The mindset shift is the hard part, not the technology
In IT, confidentiality usually comes first. We patch aggressively, we isolate compromised systems fast, and we accept downtime as the cost of doing security right. In OT, that hierarchy flips. Availability is king. A control system that goes offline isn’t an inconvenience — it can mean a halted production line, a pressure vessel left unmonitored, or a safety system with no eyes on it. I’ve watched sharp IT security professionals recommend a “standard” incident response step — isolate and patch — that would have shut down a live process and created a safety incident worse than the intrusion itself.
The leaders who make this transition well don’t arrive with answers. They arrive with questions for the operations team, the plant engineers, the people who’ve kept these systems running for twenty years without calling it “cybersecurity.” That humility is the actual prerequisite, more than any certification.
A threat model built on different assumptions
OT environments often run hardware and protocols that predate modern security thinking entirely — some of it decades old, much of it never designed to be networked, let alone defended. Patching isn’t a monthly ritual; it might require a scheduled outage months in the making. Segmentation looks different when a single network change can disrupt a physical process. And the attacker’s objective often isn’t data theft — it’s manipulation or disruption of a physical outcome. That’s a fundamentally different risk calculus than the one most IT security careers are built on.
The skills gap is real, and it’s not just technical
The talent shortage in OT security gets discussed as a headcount problem, but the deeper issue is that we’re asking one profession to develop two literacies at once: cybersecurity fundamentals and an understanding of industrial processes, engineering constraints, and safety culture. Very few programs teach both. Most OT security leaders I know are self-taught hybrids — IT people who spent years absorbing plant-floor context, or engineers who backed into security out of necessity.
For organizations, that means the hiring pipeline everyone wishes existed doesn’t yet. For individual IT professionals eyeing this path, it means the fastest way in isn’t another certification — it’s time spent alongside operations teams, learning how a process actually works before trying to secure it.
What the transition actually requires
Three things, in my experience: a willingness to defer to operational expertise instead of overriding it, fluency in risk language that accounts for safety and uptime rather than just data loss, and patience for a threat landscape that changes on a much longer timeline than IT’s does. None of that shows up on a resume. All of it shows up in the first six months on the job.
Critical infrastructure needs more people who can bridge these two worlds. Building that bridge starts with recognizing that OT security isn’t a specialty within IT security — it’s its own discipline, one IT professionals are well positioned to grow into, but only if they’re willing to unlearn as much as they learn.
John Moore is CEO of ITRoundTable, Inc. and MoreMeetings.co, and hosts private peer roundtables connecting Fortune 1000 IT, OT, and AI security executives.
Resources:
- ITRoundTable Executive Insights & Best Practices Report — itroundtableonline.com
- Learn more about ITRoundTable’s private peer roundtables for security executives — itroundtableonline.com
- Connect with ITRoundTable — MoreMeetings.co