​OT Cyber Security Thought Leadership / White Papers






 These articles draw on more than 20 years of OT cybersecurity consulting experience and close collaboration with clients across critical infrastructure and industrial sectors. They reflect my strategic perspective on translating complex cyber risk into business decisions that strengthen operational resilience and enterprise performance. The insights focus on turning emerging risk into actionable investment priorities and measurable organizational outcomes.

OT/ICS White Papers / Articles
Tom's 2026 OT Cybersecurity Predictions : This paper distills emerging cyber-physical risks into clear business implications for critical infrastructure leaders. The paper connects threat trends across AI, IoMT, and industrial environments to investment priorities, operating models, and resilience metrics demonstrating a strategic approach to aligning cybersecurity with enterprise risk and operational performance.

OT Tool Vendor Acquisitions :This article examines over a decade of OT cybersecurity acquisitions to reveal how the market is shifting from point solutions to integrated platforms aligned with safety, uptime, and enterprise risk. It reflects Tom’s ability to interpret industry signals, anticipate strategic direction, and advise leaders on technology investment decisions that support long-term operational resilience. 

OT Cybersecurity 2.0 :This paper introduces the concept of OT Cybersecurity 2.0, outlining the strategic shift from compliance-driven programs to operational resilience. It demonstrates Tom’s ability to guide organizations toward data-driven risk decisions, align cybersecurity with uptime and safety, and position cyber investment as a driver of business continuity and enterprise value.

​Why OT Cyber Risk Still Struggle to get funded :This paper explores why OT cyber initiatives often struggle to secure funding and outlines a leadership approach that translates technical risk into operational and financial impact. It highlights Tom’s ability to bridge engineering, cybersecurity, and executive priorities while guiding investment decisions that strengthen resilience and protect business performance.

What I Wished They Told Me When I Started in OT Cybersecurity : This paper takes a candid look at the realities of OT cybersecurity that never appear in frameworks or training—drawn from years of hands-on experience across plants, refineries, utilities, and critical infrastructure environments.

IoMT is OT Cybers Fastest Growing Blind Spot :This paper examines why the rapid growth of connected medical devices has created one of healthcare’s most significant and often overlooked cyber-physical risks, operating at the intersection of IT, OT, and clinical engineering where governance gaps can directly impact patient safety. It outlines a practical leadership framework for integrating IoMT into OT cybersecurity strategies to improve visibility, strengthen resilience, and align cyber risk with clinical and operational outcomes.

 AI Will Not Fix Your OT Cyber Program  :Artificial intelligence is increasingly marketed as a fast solution to long-standing OT cybersecurity challenges. This paper examines why AI cannot compensate for weak architecture, poor segmentation, or immature response processes inside industrial environments and how deploying it prematurely can create false confidence and new operational risk. AI can strengthen OT security, but only when built on disciplined design, governance, and architectural readiness.

Beyond the OT Cyber Assessment: Why Most Programs Stall  :OT cybersecurity assessments have become standard practice across critical infrastructure, yet many programs stall once the final report is delivered. This paper examines why assessments alone rarely translate into sustained risk reduction, how technical findings often fail to align with executive decision-making and funding cycles, and what organizations must do to bridge the gap between insight and execution. True OT cybersecurity maturity begins after the assessment — through ownership, operational integration, and disciplined implementation that measurably reduces risk and protects uptime and safety.

When IT Security Meets Operational Environments :Enterprise cybersecurity convergence is accelerating, but operational technology environments operate under fundamentally different constraints. This paper explores why traditional IT security controls cannot simply be deployed into OT networks without engineering adaptation, and how misaligned implementation can unintentionally introduce operational instability. It provides practical examples of controls that require modification and reinforces a core principle: in cyber-physical systems, security must be engineered to preserve safety, availability, and deterministic performance while advancing enterprise risk reduction.

Why Most Ot Cyber Roadmaps Fail in Year Two :Standards like NIST CSF 2.0, IEC 62443, and NIST SP 800-82 are often viewed as compliance burdens that slow progress. This paper explains why the opposite is true. When applied together, these frameworks provide structure that helps organizations translate cyber risk into operational, safety, and financial impact enabling faster decisions, smarter investments, and stronger governance across industrial environments.

Where Cyber Meets Concrete: What to Look for During a Physical Cyber Walkdown :Physical cyber risk in OT environments is often overlooked because many security assessments focus primarily on networks, architectures, and digital controls. This paper explores why physical cyber walkdowns remain a critical part of OT cybersecurity, highlighting how simple conditions such as unlocked cabinets, exposed ports, unattended systems, and weak access controls can undermine even the most sophisticated cyber architectures.

​The Portability Myth: Why IT Security Doesn’t Translate to OT :The assumption that IT security controls can be directly applied to OT environments continues to create operational risk. This paper explains why enterprise tools often fail on the plant floor, where uptime and safety are critical, and how misaligned controls can disrupt processes, erode trust, and stall OT cybersecurity programs before they deliver real resilience.

Third-Party & Remote Access:The Real OT Cyber Battleground :Third-party and remote access has become the primary OT cyber battleground, introducing risk through persistent vendor connections, shared credentials, and limited visibility. This paper explains why securing access is not just a technical issue but a governance and resilience priority, directly impacting safety, uptime, and enterprise operations.

​Operationalizing Trust - Governing AI in OT Environments Before It Governs You :AI in OT is often deployed faster than it is governed, creating a growing gap between capability and control. This paper shows how aligning NIST CSF 2.0, IEC 62443, and emerging AI governance frameworks enables organizations to operationalize trust—translating AI risk into safety, uptime, and business impact while ensuring intelligent systems operate within defined authority and control boundaries.The OT + AI Consequence Pyramid™: Understanding How AI Accelerates Operational Risk from Data Compromise to Physical Impact :

The OT + AI Consequence Pyramid™: Understanding How AI Accelerates Operational Risk from Data Compromise to Physical Impact :AI is rapidly being embedded into OT environments, but the risk is no longer just cyber—it’s the impact of corrupted intelligence on physical operations. This paper introduces the OT + AI Consequence Pyramid™, showing how attacks progress from data and model compromise to decision corruption and real-world consequences, and why governing AI is essential to protecting safety, uptime, and operational resilience.

From Algorithms to Operations: How AI Will Be Applied in OT And the Risks Operators Must Manage :Artificial Intelligence is rapidly entering Operational Technology (OT) environments, bringing new opportunities for predictive maintenance, anomaly detection, process optimization, and operator decision support. This white paper explores how AI is being applied across industrial operations, the cyber-physical risks it introduces, and the governance, safety, and cybersecurity controls organizations must establish to deploy AI responsibly in critical infrastructure and industrial environments.

NERC CIP: A Practitioner’s Guide for OT Executives :NERC CIP is the mandatory cybersecurity standard governing North America's Bulk Electric System. This executive guide explains what NERC CIP is, why it matters, how audits and enforcement work, and how organizations can build sustainable compliance programs. It also explores emerging requirements such as CIP-015, supply chain security, AI impacts, and the relationship between NERC CIP, IEC 62443, NIST 800-82, NIST CSF, and the Purdue Model.

CMMC Explained: What it is, Why it Matters and How it Compares (including OT implications) :This whitepaper breaks down CMMC the Cybersecurity Maturity Model Certification required across the Defense Industrial Base  and explores what it specifically means for organizations with Operational Technology (OT) environments. It covers the three CMMC levels, the core control domains assessors evaluate, and the unique challenges OT presents (legacy systems, flat networks, passive monitoring needs, uptime constraints). It also contrasts CMMC's pass/fail compliance model with traditional OT maturity assessments like NIST 800-82, and shows how CMMC fits alongside frameworks like NIST 800-171, NIST CSF, and IEC 62443. Written by Tom Jackson, a senior OT/ICS cybersecurity executive with 20+ years of experience helping critical infrastructure organizations move OT security programs from assessment into execution.

Intro to OT Cybersecurity: The Complete Series :Seven parts, one argument: industrial security isn't IT security with new acronyms — it's a different discipline built around availability and physical consequence instead of confidentiality. This reference compiles the full series into a single document: the fundamental IT/OT divide, the market and industry forces driving urgency, the regulatory landscape (NERC CIP, IEC 62443, NIST), how organizations actually close the gap between finding a risk and funding a fix, Defense in Depth and Zero Trust adapted for live control systems, and where AI genuinely fits into an environment that has never tolerated a one-size-fits-all playbook. Includes a full glossary, a "key numbers at a glance" reference pulled from all seven parts, and sourced citations throughout.


​
  

OT/ICS Podcast
Ironscales "Cyber Security Heroes" Podcast episode 8  "Safeguard Operational Technology and Protect your Kingdom
In this episode of Cyber Security Heroes (episode 8), I discuss why Operational Technology (OT) cybersecurity requires a different mindset than traditional IT security. We explore the evolution of IT/OT convergence, the growing impact of cloud, IoT, and ransomware, and practical strategies for building resilient cybersecurity programs that protect critical infrastructure.
Topics include:
  • Understanding Operational Technology (OT) and why it matters
  • Key differences between IT and OT cybersecurity
  • The evolution of IT/OT convergence
  • Cloud, IoT, and ransomware impacts on industrial environments
  • Building an effective OT cybersecurity lifecycle
  • Common challenges including segmentation, remote access, and patch management
  • Practical advice for security professionals working with operations teams
  • The future of cyber resilience in critical infrastructure 

Click here to listen to a summary of Episode 8



Technical OT/ICS Reference documentation
A key challenge when addressing OT/ICS Assessments is cross referencing the NIST 800-82 OT standard to the more widely used NIST 800-53 IT standard. I created the attached spreadsheet to include;  a NIST 800-82 v NIST 800-53 cross reference, NIST 800-82 to NIST Cyber Security Framework (CSF) mapping as well as a NIST 800-82 based assessment questionnaire form for use in the field with clients.


​

​OT/ICS Cyber security publications done at Schneider Electric

Excerpt from a video marketing campaign focused on OT Cyber Security and the OT team.
  • Tom Jackson video - OT Cyber Security Life-cycle Methodology


OT/ICS Cyber security sales training materials. Focused on OT basics and OT/ICS cyber solutions for a global sales force
Technical Sales Briefs on key OT cyber security market sectors
OT/ICS Cyber Security Solution guides. Technical overviews of specific cyber solutions along with their application, market segment, and value.
Monthly OT cyber security newsletter distributed to sales team and key accounts. Focusing on key OT topical issue for that month. I published this series during my tenure at Schneider 2011-2015 - over 50 volumes.
​ 
Sample of a 4-part newsletter series on the OT Cyber Life-cycle Methodology Feb-May 2015
All monthly newsletter by years