@BEERISAC: OT/ICS Security Podcast Playlist

Anton Shipulin / Listen Notes

A curated playlist of Operational Technology (OT) and Industrial Control Systems (ICS) cybersecurity podcast episodes in any language, compiled by ICS security enthusiasts. Missing something? Contact Anton Shipulin on LinkedIn. Subscribe for updates!

  1. 17h ago ·  Video

    Is Critical Infrastructure Ready for AI Attacks? with Booz Allen's Brad Medairy

    Podcast: Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure (LS 30 · TOP 5% what is this?)Episode: Is Critical Infrastructure Ready for AI Attacks? with Booz Allen's Brad MedairyPub date: 2026-10-20Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationCan cyber defenses built around human attackers keep pace with AI? Brad Medairy, president of Booz Allen's National Cyber Practice and a McCrary Institute senior fellow, joins Frank Cilluffo to discuss what his team's testing reveals about AI's ability to conduct cyber operations and navigate industrial systems. They examine how these capabilities lower barriers for attackers, why deploying defensive AI requires trust and human accountability, and what executives should do to assess readiness. The conversation also explores active cyber defense and the need to keep essential services running through a compromise. Main topics AI-driven cyber operations Frontier model testing U.S.–China capability gaps Industrial systems at risk AI attack simulations Human oversight and accountability Deception and active defense Operating through compromise Board oversight and readiness Key quotes "Today, with an agentic attack, with an AI-enabled cyber operator that can operate at speed and scale, I think the defender does not have the advantage. It can't move at that pace." — Brad Medairy The way that we've seen models be able to rip apart these [OT] environments, understand the protocols, understand the control system, it's really phenomenal in terms of the capabilities that they provide… the risk to critical infrastructure is at an all-time high." — Brad Medairy "I don't think that we're going to defeat the threat of the future that's so transformative by just automating past operating models and approaches." — Brad Medairy "These adversary capabilities are progressing much faster than cyber defenses. And so you're gonna have to continually assess your environment, continually assess your controls, continually evolve your program." — Brad Medairy "We're inventing new operating models, we're inventing new technologies for cybersecurity. And I think now is our time to really define the future. It's going to take… really working this problem together." — Brad Medairy Resources discussed Booz Allen's Cyber Weapons Index McCrary Institute–Booz Allen joint paper: "AI-enabled threats demand mission-speed resilience – here's how to build it" McCrary Institute–Booz Allen joint paper: "Outpacing AI-enabled cyber threats: A playbook for government CISOs" About the Guest: Brad Medairy is president of Booz Allen's national cyber business, leading the development of defensive and offensive cyber solutions to address America's toughest cyber challenges. His work spans AI, machine learning, cloud innovation, and intelligence tradecraft. He leads thousands of cyber operators, security researchers, and software engineers who secure supply chains, protect critical infrastructure, and defend 5G networks, space systems, and advanced weapons platforms. His team counters sophisticated adversaries for customers including the intelligence community, U.S. Cyber Command, FBI, CISA, and the Department of War. The podcast and artwork embedded on this page are from Frank Cilluffo / McCrary Institute, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

    Is Critical Infrastructure Ready for AI Attacks? with Booz Allen's Brad Medairy
  2. 17h ago

    137: From Conference to Change: Asset Owners on What They Actually Did After Level Zero

    Podcast: (CS)²AI Podcast Show: Control System Cyber SecurityEpisode: 137: From Conference to Change: Asset Owners on What They Actually Did After Level ZeroPub date: 2026-10-20Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationFrom Conference to Change: Asset Owners on What They Actually Did After Level Zero Asset owners from UPS and Southern California Edison get specific about what changed after Level Zero: a talk that became a deployed AI harness, a team member who went on to NIMS certification after the tabletop, and ideas borrowed across sectors. Christian Harter, Blake Gilson, and Brian Foster debate who should attend (almost everyone), how to prepare (don't just show up), why the hallway track matters most, and why more asset owners should take the stage. They close on AI: powerful, but it needs an operator. Guests: Blake Gilson (IT Planning & Strategy Manager, ExxonMobil); Brian Foster (Grid Security – Enterprise Sr Advisor, Southern California Edison) Host / moderator: Christian Harter (BISO OT & Director of OT Security and Engineering, UPS) Chapters: 00:41 Panel introductions 02:02 What stuck from Level Zero 04:48 Bringing a team (UPS brought 16) 09:12 What actually changed afterwards 14:49 Send a group or one person? Budgets and training 19:28 Who should attend 23:12 How to prepare 24:38 The hallway track 30:11 What to preserve and grow: asset owner stories 43:19 Where AI ends and humans begin 49:40 A new class of worker Recorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections." Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back. Questions: info@levelzeroconference.com · Sponsorship: sponsor@levelzeroconference.com Produced by CS²AI (Control System Cyber Security Association International). The podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

    137: From Conference to Change: Asset Owners on What They Actually Did After Level Zero
  3. 1d ago

    Trust Is Not a Security Control: Blast Radius and the Management Plane

    Podcast: PrOTect It All (LS 27 · TOP 10% what is this?)Episode: Trust Is Not a Security Control: Blast Radius and the Management PlanePub date: 2026-10-19Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationWork with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep128/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go? Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework. He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell. What you will take away Why trust is something you delegate, not a security control, and how to put a limit on it What Zach's blast radius framework measures: reach, scope crossing, standing privilege, human concentration, automation visibility and recoverability Why the same PLC with the same vulnerabilities is not the same risk on a turbine as it is on an ice machine Why attacks now look like a normal workday from a cloud address, not a foreign IP in the logs Why one any-any rule undoes 477 good ones, and why a firewall starts from deny Why you verify every piece of work an AI agent hands back, however good the prompt was In this episode 5:03 Sleeping under the conference table 8:30 The open proxy everyone borrowed 10:24 From K-12 to defense contracting 12:59 How careers really get built 16:36 Where is the puck going? 23:22 A heat map for the smoker 25:41 Verify everything the agent does 32:31 Attacks that look like a normal workday 34:33 The work laptop on the home network 39:15 Security is never done 41:39 Where the word firewall comes from 43:33 The same failure, five years apart 44:21 What blast radius measures 46:28 The turbine and the ice machine 49:43 When the right account does the wrong thing 51:53 A firewall with one any-any rule 54:08 Where to find Zach's research About the guest Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks. Blast Radius white paper and scoring workbook: https://github.com/ridgestoneco/blast-radius LOLMgmt white paper: https://zenodo.org/records/21255394 Zach on LinkedIn: https://www.linkedin.com/in/zacharymiller0111/ Learn more about PrOTect IT All: Work with Aaron: https://protectitallpod.com/work/ The book: https://protectitallpod.com/book/ This episode: https://protectitallpod.com/ep128/ The OT Security Starter Kit: https://protectitallpod.com/starter-kit/ YouTube: https://www.youtube.com/@PrOTectITAll Email: info@protectitallpod.com X: https://twitter.com/protectitall Facebook: https://facebook.com/protectitallpodcast To be a guest or suggest a guest or episode, email info@protectitallpod.com. Please leave us a review on Apple or Spotify: Apple: https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124 Spotify: https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4 The podcast and artwork embedded on this page are from Aaron Crow | Operational Technology & Cybersecurity Host, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

    Trust Is Not a Security Control: Blast Radius and the Management Plane
  4. 2d ago ·  Video

    Pushing Cyber Planning Beyond Prevention with Stephanie Crowe and Nick Andersen

    Podcast: Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure (LS 30 · TOP 5% what is this?)Episode: Pushing Cyber Planning Beyond Prevention with Stephanie Crowe and Nick AndersenPub date: 2026-10-06Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationKeeping power, water, and other essential services running requires planning for what happens when cyber defenses fail. On this episode of Cyber Focus, Frank Cilluffo speaks with Stephanie Crowe, head of the Australian Cyber Security Centre, and Nick Andersen, acting director of the Cybersecurity and Infrastructure Security Agency (CISA), about how two close allies are preparing critical infrastructure to operate through compromise. The conversation examines how governments and industry identify their most critical systems, turn shared intelligence into joint action, and prepare for attacks that cross sectors and borders. Crowe and Andersen also discuss how AI is changing cyber defense and what that means for infrastructure investment, workforce skills, and decisions in the boardroom. Main Topics Operating through cyberattacks Protecting critical assets and dependencies China's infrastructure prepositioning CI Fortify and joint industry planning U.S.-Australia and Five Eyes cooperation AI defense and aging infrastructure AI's energy demands Workforce skills and boardroom decisions Key Quotes "You have to be able to fight through compromise now, which is a really different way of thinking about the cyber threat." — Stephanie Crowe "We've come a long way from thinking about our number one cyber risk being data breaches and theft of information into a world where service disruption is now the thing that we have to really consider and plan in our cyber risk management." — Stephanie Crowe "And just to be completely honest, Australia really bailed us out when we were in the middle of our shutdown… Australia led from the front." — Nick Andersen "If the Congress decided that in the next budget that CISA needed to be quintupled in size, we're still not going to have enough resources to be able to meet every single area that we'd like to be able to stray into with our attention." — Nick Andersen "We know that we're seeing exceedingly aggressive, well-orchestrated campaigns, in particular from entities like China, that are engaged in a significant way to preposition across our critical infrastructure to hold it at risk at a time and place of their choosing." — Nick Andersen Links and Resources Cybersecurity and Infrastructure Security Agency (CISA) Australian Cyber Security Centre: Guidance and Resources About the Guests: Stephanie Crowe is Deputy Director-General of the Australian Signals Directorate and Head of the Australian Cyber Security Centre. She has held senior roles in signals intelligence and cybersecurity, leading efforts to strengthen Australia's cyber defenses, build threat intelligence capabilities, and support industry during major cyber incidents. Nick Andersen is Acting Director of the Cybersecurity and Infrastructure Security Agency (CISA), where he leads efforts to reduce risks to America's cyber and physical infrastructure. A U.S. Marine Corps veteran, he has held senior cybersecurity roles at the Department of Energy, the White House, and in the private sector. The podcast and artwork embedded on this page are from Frank Cilluffo / McCrary Institute, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

    Pushing Cyber Planning Beyond Prevention with Stephanie Crowe and Nick Andersen
  5. 4d ago

    Cesar Tascon with EY

    Podcast: The Industrial Talk Podcast Network (LS 39 · TOP 2% what is this?)Episode: Cesar Tascon with EYPub date: 2026-10-16Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationIndustrial Talk/BCC is talking to Cesar Tascon, Cybersecurity Partner with EY about "OT / ICS - cyber physical and critical infrastructure security". Overview The discussion focused on adapting cybersecurity to connected operational technology while protecting safe, continuous operations. OT Risk and Approach OT security prioritizes availability and safety; outages can disrupt essential services or cause physical harm.Security must fit each organization’s assets, structure, and risk tolerance. Prioritize critical scenarios, contain incidents, and scale controls to asset criticality.Treat cybersecurity as an ongoing business process, with asset inventories, consistent practices, and rapid detection and response. People and Emerging Risks Introduce changes incrementally with operators, integrating security into existing workflows rather than imposing disruptive processes.OT security ownership depends on the organization; IT and OT responsibilities should align with its operating model.Regulations can overlap and differ in terminology. AI may strengthen attacks but also help analysts review alerts and respond faster.How should each organization assign OT security responsibilities? The transcript identifies no universal model. Outline OT Cybersecurity Context Connected devices and remote operations create significant business benefits, but expand cyber exposure.OT security differs from IT: availability and safety are central concerns, alongside confidentiality. Risk Assessment and Controls Assess assets, organizational structure, operational constraints, threats, and potential impacts before choosing controls.Prioritize critical facilities and prevent incidents from spreading across sites.Maintain asset and software information, responsibilities, backups, and restoration processes; use standards such as NIST and IEC 62443 as applicable. Operating Model and Change Assign security responsibilities according to the organization’s structure; there is no one-size-fits-all IT/OT ownership model.Involve operators and add security requirements to existing workflows to reduce resistance and preserve operations. Regulation and Shared Threats EU regulation promotes protection but may create complexity through overlapping requirements and inconsistent terminology.Coordinate across vendors, peers, sectors, and governments to address supply-chain and shared infrastructure risks. AI in Cybersecurity AI can make attacks and social engineering more convincing and scalable.Defensive uses include helping analysts process alerts and freeing time for incident response. If interested in being on the Industrial Talk show, simply contact us and let's have a quick conversation. Finally, get your exclusive free access to the Industrial Academy and a series on “Why You Need To Podcast” for Greater Success in 2026. All links designed for keeping you current in this rapidly changing Industrial Market. Learn! Grow! Enjoy! CESAR TASCON'S CONTACT INFORMATION: Personal LinkedIn: https://www.linkedin.com/in/c%C3%A9sar-tasc%C3%B3n-1198973/ Company LinkedIn: https://www.linkedin.com/company/ernstandyoung/ Company Website: https://www.ey.com/en_gl PODCAST VIDEO: https://youtu.be/JbG5VG1UbdI THE STRATEGIC REASON "WHY YOU NEED TO PODCAST": OTHER GREAT INDUSTRIAL RESOURCES: Industrial Marketing Solutions:  https://industrialtalk.com/industrial-marketing/ Industrial Academy: https://industrialtalk.com/industrial-academy/ Industrial Dojo: https://industrialtalk.com/industrial_dojo/ Business Beatitude the Book Do you desire a more joy-filled, deeply-enduring sense of accomplishment and success? Live your business the way you want to live with the BUSINESS BEATITUDES...The Bridge connecting sacrifice to success. YOU NEED THE BUSINESS BEATITUDES! TAP INTO YOUR INDUSTRIAL SOUL, RESERVE YOUR COPY NOW! BE BOLD. BE BRAVE. DARE GREATLY AND CHANGE THE WORLD. GET THE BUSINESS BEATITUDES! Reserve My Copy and My 25% Discount The podcast and artwork embedded on this page are from The Industrial Talk Podcast with Scott MacKenzie, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

    Cesar Tascon with EY
4.5
out of 5
8 Ratings

About

A curated playlist of Operational Technology (OT) and Industrial Control Systems (ICS) cybersecurity podcast episodes in any language, compiled by ICS security enthusiasts. Missing something? Contact Anton Shipulin on LinkedIn. Subscribe for updates!

You Might Also Like