Frenos

We’re on the ground at Black Hat MEA. From December 2–4, the Frenos team will be in Riyadh meeting with OT security leaders, operators, and engineers who are pushing critical infrastructure resilience forward. If you’re attending, stop by Booth H1.T80 to see how adversary modeling, digital twin analysis, and agentic AI are helping organizations understand operational risk with clarity and speed. Vivek Ponnada will be available throughout the event to walk through real-world use cases and discuss what’s top-of-mind for OT defenders today. 📍 Booth H1.T80 🗓 02–04 December 2025 📌 Riyadh, Saudi Arabia – RECC Will we see you there?

In most OT environments, the biggest blind spots aren’t PLCs or HMIs. They’re the transient devices that come and go without leaving a trace. Think about the equipment that enters your environment every week: → Vendor laptops used for quick troubleshooting → Rental hardware that connects for long enough to fix an issue → Contractor tablets, USB adapters, and diagnostics gear → Temporary VPN access spun up for a single job Individually, they seem harmless... In combination, they create an unmanaged attack surface that bypasses traditional OT visibility. And here’s the real challenge: These devices blend into operations so naturally that teams rarely question them. They’re trusted because the people carrying them are trusted. But attackers don’t need permanent access. They just need a window. Transient devices often provide it. This is why modern OT security has to account for temporary presence, not just permanent assets. Anything that touches the environment, even for five minutes, becomes part of your risk equation. Do transient devices ever get tracked or logged in your OT environment?

Security culture isn’t built in a day... especially in OT. Too many organizations think awareness month or a phishing test equals culture. It doesn’t. In OT, human risk isn’t just about data breaches. It’s about safety, production, and lives. In this week’s Frenos Fire Friday, we teamed up with KnowBe4 and James McQuiggan to talk about what real security culture looks like. One built through consistency, leadership, and daily reinforcement. Because culture isn’t a campaign, it’s a commitment. Let us know what you think 👇

Most OT teams have intrusion detection. Far fewer have intrusion understanding. Detection tells you something happened, but understanding tells you what it means. That difference is everything in industrial environments. An alert can show you a suspicious login, a blocked connection, or a policy violation. But it can’t show you: → How the attacker moved → What systems they touched → Which paths were available → What could have happened next → Or how close they came to impacting operations In OT, alerts without context create noise. Context without consequence creates false confidence. True resilience comes from understanding movement, intent, and impact, not just triggers. That’s why modern OT security is shifting toward adversary modeling. It gives operators a clear picture of how an intrusion unfolds, how far it can go, and what needs to be fixed before it matters. Detection tells you you’re under attack. Understanding tells you whether you’re vulnerable.

“AI is a black box.” That’s the pushback we hear most often from OT leaders: They don’t trust a tool that gives answers without proof. And in high-stakes environments, trust is everything. Here’s what changes when you use SAIRA: • Every attack step is documented • Each finding includes the reasoning behind it • A transparent trail shows exactly how decisions were made That’s evidentiary AI in action. Instead of more noise, teams get clarity they can act on. Instead of blind recommendations, they get confidence backed by proof. That makes all the difference when every decision carries real risk. Would you sign off on a security decision without evidence?

Too many teams confuse risk assessments with vulnerability assessments. In this week’s Frenos Fire Friday, Steve Mustard challenges the confusion between vulnerabilities, incidents, consequences, and risk, and why that confusion leaves a dangerous gap in OT security. Here’s the core issue: → Checking password length is a vulnerability assessment → Listing “PLC compromise” or “server compromise” is an incident scenario → Neither tells you the real-world consequences And without understanding consequences, you’re not assessing risk. You’re measuring technical issues, not operational impact. You can’t prepare for an incident if you don’t understand what it could do to your environment, your process, or your people. Resilience requires more than patching and monitoring. It requires knowing what matters most and how an attack would actually affect it.