Water Attacks, Typhoons, and Worst-Day Planning in OT | OT Office Hours

Water Attacks, Typhoons, and Worst-Day Planning in OT | OT Office Hours

by Dan Gunter (CEO, Insane Cyber) & Samantha Becker (Head of Sales & Marketing, Insane Cyber) · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Dan Gunter (CEO, Insane Cyber) & Samantha Becker (Head of Sales & Marketing, Insane Cyber) 👥 2K 📅 September 25, 2026 ⏱ 52 min 👁 32 📄 expert opinion 🧭 2026-10-15
Available in: English (current) Français

Keywords

OT securityincident responsePLC attackstyphoon APTworst-day planning

Summary

This episode of OT Office Hours features a discussion between Samantha Becker and Dan Gunter of Insane Cyber on recent OT security incidents and preparedness. They begin by analyzing the recent cyber attacks on water municipalities, emphasizing that focusing on the sophistication of attacks is less useful than understanding asset owners’ constraints such as limited budgets and staff. They note that internet-exposed PLCs often exist due to overlooked engineering connections or legacy configurations. The conversation then shifts to adversary groups like Typhoons, which use living-off-the-land techniques to evade detection. The hosts stress the importance of fostering collaboration between security and engineering teams rather than adversarial relationships. They explore the concept of a ‘worst day’ scenario, distinguishing between adversary-driven and process-safety-driven organizations. A key point is the oversubscription of incident response retainers; in a large-scale event, even firms with retainers may not have immediate capacity, so teams need contingency plans. They draw an analogy to FEMA’s Waffle House Index to categorize incident severity and response readiness. The discussion concludes with advice on in-house triage and preparation, including maintaining clear procedures, building relationships, and planning for worst-case scenarios. Throughout, the hosts provide practical insights based on their field experience but do not cite specific data or external sources.

206 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of this video lies in the practical, experience-based insights from two professionals with significant background in OT and incident response. Dan Gunter’s military and OT experience brings credibility to the discussion. The argumentation is logical and well-structured: they present a problem (water attacks and Typhoon activities), then discuss underlying issues (attack surface, resource constraints), and offer actionable advice (relationship building, worst-day planning). The use of analogies like the Waffle House Index effectively illustrates complex concepts. However, the arguments are not supported by empirical data or published research; they rely on anecdotal observations and unverified assertions. The reasoning is coherent, but the lack of concrete examples or statistics weakens the persuasive force. Overall, the video offers valuable qualitative insights but lacks rigorous substantiation.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite any external sources, publications, or data. It is a conversational discussion that relies entirely on the hosts’ expertise and anecdotal experiences. This limits its scientific rigor and makes it difficult to verify claims. The title accurately reflects the content, covering the three main topics mentioned: water attacks, Typhoons, and worst-day planning. The alignment between title and content is strong. No public comments were provided, so no audience reception analysis is possible.

215 words

Title / Content Match

The title accurately reflects the content, which covers recent attacks on water systems, the tactics of Typhoon APT groups, and strategies for planning for worst-case scenarios in OT environments.

Quality & Reliability

7/10

The discussion draws on deep field experience in OT cybersecurity and incident response, but lacks external data or references, relying on anecdotal evidence and general industry knowledge.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Contribution & Novelties

This video contributes original perspectives on OT incident response by drawing parallels to emergency management (Waffle House Index) and highlighting the practical challenges of IR retainers and oversubscription. It also emphasizes the importance of security-engineering collaboration and the need for worst-day planning tailored to organizational risk profiles. However, it does not introduce new research or data, but rather synthesizes existing knowledge from practice.

Pour aller plus loin :

  • MITRE ATT&CK for ICS — A knowledge base of adversary tactics and techniques specific to industrial control systems, relevant to understanding living-off-the-land attacks discussed in the video.
  • NIST Cybersecurity Framework — A framework for improving critical infrastructure cybersecurity, which underpins much of the planning and procedural advice given.
  • Waffle House Index — An informal metric used by FEMA to assess disaster impact, which the hosts usefully apply to OT incident response scenarios.

140 words

Radar Profile

The radar profile shows moderate scores across all dimensions, indicating a balanced but not deeply technical presentation. The video is informative and accessible, but lacks the quantitative rigor found in research-driven content. It is best suited for viewers seeking practical, experience-based insights in OT security.

Reliability 5/10