12:00 – 12:25
Operational Technology (OT) environments are increasingly connected and exposed, yet many organizations still lack dedicated OT security monitoring capabilities. In this talk, we explore how Fox-IT, operator of one of Europe's longest-running Security Operations Centers (SOCs), leverages existing monitoring capabilities to gain meaningful visibility into OT environments. Across a large and diverse customer base, we observe OT-related network traffic in more than 50% of monitored environments. By analyzing this traffic with standard sensors, we can identify anomalies and potential risks in OT systems. Often without deploying specialized OT security tooling.
This matters because it challenges a common assumption in OT security: that effective monitoring requires complete visibility and purpose-built solutions. While dedicated OT tools undoubtedly add value, our experience shows that even partial visibility can produce actionable insights. Many organizations delay OT security improvements due to perceived complexity or cost. This talk demonstrates that meaningful detection and risk reduction can start with capabilities already in place. Simple monitoring, when combined with proper analysis and context, can uncover misconfigurations, unsafe communications, and early indicators of compromise.
Attendees will gain practical insight into the types of OT traffic visible through existing monitoring, supported by real-world metrics and observations from our SOC operations. We will share anonymized data points on protocol usage, common anomalies, and detection patterns, illustrating how much can be learned without full asset inventories or protocol coverage. The audience will leave with a clearer understanding of how to pragmatically enhance OT visibility today. Leveraging existing investments, while building a roadmap toward more mature, dedicated OT security monitoring.