Getting Started in OT/ICS Cybersecurity 2026 (Part 7): How to Actually Manage OT Vulnerabilities

Value of the Information & Strength of the Argument

The video provides high practical value by addressing OT-specific challenges that differ from traditional IT. It clearly explains why standard IT vulnerability management cycles (scan-patch-rescan) are inapplicable in OT environments due to availability and safety concerns, and offers alternatives like coordinating with engineering and using maintenance windows. The argumentation is grounded in real-world examples and the presenter’s extensive experience, making the case for a risk-based approach that communicates impacts in dollars and safety. The discussion of unauthenticated protocols like Modbus being more critical than many CVEs is a valuable insight. However, the argumentation relies heavily on anecdotal evidence and personal judgment, lacking external citations or quantitative studies.

Scientific Rigor, Source Quality, Title Accuracy

The video demonstrates strong subject-matter expertise, but the scientific rigor is limited by the absence of formal citations. The presenter references industry resources like ISACs, OT Threat Feed, and the ICS Advisory Project, but these are mentioned conversationally without links or detailed reference. The title accurately reflects the content. No public comments were provided, so no analysis of viewer feedback was possible.

The title accurately reflects the content, focusing on practical vulnerability management in OT/ICS environments, and the 'Part 7' indicates a structured series.

8/10

The video provides thorough and practical guidance on OT/ICS vulnerability management, based on the author's extensive experience. While it is expert opinion rather than peer-reviewed research, the technical details are accurate and align with industry standards. The lack of explicit external citations in the video is offset by the author's clear expertise.

• 00:00The Foundation of OT Security: Why an accurate asset register is critical for threat and vulnerability management.
• 01:03Speaking the Language of Leadership: Translating cyber threats into business risk, impact, and dollars to secure financial support.
• 03:22The Risk Calculation Formula: Understanding threats, vulnerabilities, probability, and impact in an industrial context.
• 08:08CVEs vs. Inherent Protocol Risk: Why unauthenticated protocols like Modbus often pose a bigger threat than documented CVEs.
• 18:45IT vs. OT Vulnerability Management: Why the standard IT scan-patch-rescan cycle fails in OT environments and requires coordination with engineering.
• 34:00Real-World Attack Breakdowns: Analyzing the 2024 Frosty Coop incident via MikroTik routers and recent attacks on US water treatment facilities.
• 54:47The Dangers of Active Scanning: Why Nessus and Nmap scans can crash OT environments, disrupt availability, and cause PLCs to physically smoke.
• 1:03:20FAT and SAT Testing: Leveraging Factory Acceptance Testing (FAT) as the primary safe window for active, aggressive scanning on industrial equipment.
• 1:12:45Building OT Threat Intelligence: How to use resources like OT Threat Feed, the ICS Advisory Project, and industry-specific ISACs to filter out the noise.
• 1:23:08Indicators of Compromise (IoCs): Using file hashes, IP addresses, and malicious domains to track threat actors like Volt Typhoon.

• Getting Started in OT/ICS Cybersecurity (OnDemand) — Course page for the full training, mentioned as a resource in the video description.
• Mike Holcomb - OT/ICS Cybersecurity Resources — Author's website offering free resources, mentioned in the description.
• Mike Holcomb - Main Site — Author's main site for more information, mentioned in the description.