What do five recent incidents teach about managing invisible OT risk?
Session 6 · ERQI Global Virtual Risk Summit
A spicy take on OT risk management
David White & Kristin King
Overview
In this session, David White and Kristin King walked through five recent cases, from patented blueberries to a Swiss dairy to a national economy, to ask what they teach about managing risk in operational technology (OT). The same themes kept returning: OT is invisible until it fails, its dependencies go unmapped, accountability often sits with parties outside the victim's walls, and limited disclosure leaves the field learning from too few cases.
Session 6 recording, ERQI Global Virtual Risk Summit 2026
Why OT is different
King described OT as the systems that power the modern world, from tractors to elevators to production lines, and argued that its risk has to be assessed facility by facility, sometimes section by section. Her pet peeve is bolting frameworks onto systems that will not cooperate, and her advice is simple: if you don't know, ask. She cares less about data than about people getting home safely. White's complaint is that OT is invisible. It cannot be rebooted, it runs for decades, and society takes it for granted, so it gets too little risk management attention. He framed the shift as moving from confidentiality, integrity and availability to safety, reliability and performance.
The cases
Driscoll's was not an OT incident. The grower entered the Chinese market holding patents on its blueberry plant DNA, and clippings were used to propagate genetically identical plants. White noted that Driscoll's has filed 23 lawsuits and won about three so far, and called it a strong quantification case study, since royalties are set per hectare. In the Swiss dairy case, ransomware cut a farmer off from real-time monitoring, and a pregnant cow in distress was lost. King did not fault the farmer. White called it irresponsible to sell such equipment without support for segmentation and firewalling. King noted that the farmer likely has continuity and safety plans, so cyber can be attached to what already exists.
For United Natural Foods, King asked whether a company can still verify its product is safe after a compromise; if not, it has to go. On Jaguar Land Rover, White cited five weeks of stopped production, a government loan of 1.5 billion pounds, and a 1.9 billion pound loss to the UK economy that the Bank of England linked to a quarterly decline in GDP. He argued that regulation missed a company whose outage moved GDP, and noted that The New York Times reported no ransom demand. King drew a parallel to JBS.
The fifth case was the campaign against more than 100 internet-exposed water utility PLCs. White placed liability on the system integrators behind the exposed devices and urged listeners to treat water as part of their supply chain. King argued for normalizing the discussion of strange events.
“If you don't know, ask.”
Kristin King, on assessing risk in operational technology
Key takeaways
1
Assess OT in its own context
King argued that OT risk has to be judged facility by facility, and sometimes section by section. An oil rig and a fish farm are both industrial, but they are different problems.
Watch at 4:512
Map IT and OT dependencies
White's view is that most large enterprises could not run their OT estate without IT. Few have done the dependency analysis that would tell them.
Watch at 35:143
Expand secure by design
White argued that secure by design has to cover the product in its context and its target user. Selling connected equipment without that support, in his view, leaves the risk with users who are not security experts.
Watch at 24:294
Look past the victim
Many small water utilities depend on third-party system integrators for upgrades. White argued that the exposed devices raise a significant liability risk for those integrators.
Watch at 51:355
Disclosure shapes what gets measured
White closed by noting how inconsistent the five cases were in what was reported and measured. King and White both argued that more disclosure would help the field learn.
Watch at 1:00:16
