Cyber security | 30 September 2026

Asset Guardian CEO Stephanie Calder recently joined Tommy McCarthy on Cyber News Global’s "Let’s Talk Cyber" to discuss whether organisations are overcomplicating OT cyber security, and why getting the fundamentals right remains so important.

From board-level accountability and asset visibility to incident response and recovery, the conversation explored some of the practical challenges organisations face when managing cyber risk across operational environments.

Click the image below to watch the video on YouTube.

OT cyber security is a business risk

OT cyber security has traditionally been treated as an IT or engineering responsibility, but the potential consequences extend much further.

An incident affecting an operational environment can interrupt production, impact revenue, introduce safety concerns and disrupt critical infrastructure. That makes visibility at board level increasingly important.

Boards do not necessarily need the technical detail behind every vulnerability or system. What matters is having a clear understanding of what is critical, where the organisation is exposed and who is accountable for addressing that risk.

This becomes more difficult when responsibility is spread across IT, engineering, operations and leadership without clear ownership.

Survey findings published in Cyber News Global following the Scottish OT Cyber Summit 2026 reflect some of that challenge. 71% of delegates said their processes for handling an IT-focused cyber incident were more mature than those for an OT-focused incident, while only 9% felt their approach was at a similar level across both.

Visibility before complexity

One of the strongest themes from Stephanie and Tommy’s conversation was the importance of knowing what is actually running across the operational environment.

Organisations can have access to extensive vulnerability information and sophisticated security technologies, but without an accurate view of their assets, software and systems, it can be difficult to understand which risks genuinely apply.

The practical starting point is simpler: identify what you have, understand the associated risk and take action.

That does not remove the complexity of OT cyber security, but it helps organisations avoid becoming stalled by the pursuit of a perfect solution before the fundamentals are in place.

Resilience means being ready to recover

The discussion also turned to what happens when prevention is no longer enough and an organisation has to recover from an incident.

Reliable software backups, controlled configuration changes, tested disaster recovery plans and clearly defined business continuity processes all become critical when operations need to be restored safely.

Again, the Summit survey suggests there is still work to do. When delegates were asked whether they could coordinate an effective response if their primary communications systems were compromised, only 13% said their approach was planned, tested and assured. Half had plans in place but said they were not yet fully tested and assured.

For organisations responsible for operational technology, resilience therefore starts well before an incident occurs. Understanding the environment, assigning clear ownership, controlling change and knowing how systems will be restored all form part of the same picture.

The message from Stephanie and Tommy’s conversation is a practical one: organisations do not need to solve every aspect of OT cyber security at once. They need to establish the fundamentals and start making progress.

For further discussion and findings from the Scottish OT Cyber Summit 2026, read Cyber News Global Issue 23 here.

Where should you start?

Explore the practical steps organisations can take to strengthen OT cyber resilience, from asset visibility and ownership to change control and recovery readiness.

Read: Stop Overcomplicating OT Cyber Security