The great divide: Why IT and OT Cyber still don’t talk - and how we change that

As IT and OT systems become increasingly connected, critical infrastructure organisations face a growing wave of cyber threats that traverse both domains. Recent attacks have shown how threat actors exploit IT-OT pathways, and how geopolitical tensions are turning infrastructure into a frontline target.

And yet, despite the growing technical interdependence, many organisations still manage IT and OT cyber risk in silos, with parallel uplift programs, disconnected governance, and separate playbooks.

This session explores the cultural, operational, and structural factors that keep IT and OT apart, and what it takes to work better together. Drawing from real-world assessments and uplift engagements in critical infrastructure sectors, this talk will share practical lessons from both public and private organisations. It will highlight points of friction, stories of successful collaboration, and tools that helped bridge the gap, not through top-down governance, but by building trust, alignment, and shared understanding.

1. Introduction

We begin with a look at the threat landscape and why the IT/OT divide matters more now than ever. From ransomware targeting public utilities to healthcare outages triggered by IT system breaches, attackers don’t respect boundaries, but our teams still often operate as if they do. This session is not about blaming either side. It’s about understanding how we can work better together

2. Two Worlds, One Risk Surface

We explore the core differences in mindset, investment priorities, risk tolerance, and operational priorities between IT and OT teams, and why these differences are valid. We look at how language and incentives differ, and how this impacts everything from vulnerability management to incident response.

3. Where Things Break Down

- Shadow systems and undocumented assets beyond the view of both IT and cyber teams

- Unclear roles and responsibilities

- Breakdowns in communication and collaboration, often due to lack of trust or differing expectations

- Misalignment in uplift processes, with OT teams feeling “done to” rather than included

- Limited cyber budget for OT (or sometimes vice versa where OT takes priority), leading to mismatched security maturity

- Shortage of OT-aware cybersecurity skills, especially in leadership and project roles

4. What Works

We shift to sharing anonymised examples of what worked, with 2 success stories from the field.

5. Tools for Bridging the Divide

- A governance forum model: who needs to be in the room, what needs to be shared, and how to ensure OT voices are heard early

- Joint uplift planning templates: aligning timelines, ownership, and budget

- Co-developed playbooks and tabletop scenarios: building clarity and muscle memory before the breach

- Operational risk translation mapping: making IT and OT concerns visible in one language

- Questions to ask in stakeholder engagement to surface operational tensions before they stall progress

6. Closing Reflections – From Ownership to Co-Design

This talk closes by reframing convergence as a shared resilience journey, not a takeover. The challenge is not to integrate for integration’s sake, but to co-design solutions where trust, safety, and strategic clarity all align.