The energy sector’s OT cybersecurity talent is retiring faster than it can be replaced

A ransomware hit lands a chemical plant in a safe state. Nobody is hurt, the site holds steady, and the operators begin the restart. The systems stay down.

Every attempt to bring them online meets encrypted processes and altered configurations. The outage runs into weeks, and the losses travel down the supply chain in both directions. Refineries, chemical plants and pipeline operators carry this exposure across control systems that run 20 to 40 years.

Marco Ayala has spent more than two decades inside industrial control system security. He is technical director for global energy at ABS Consulting, and he puts the risk with the discipline he thinks owns it.

“Reliability, uptime and safety are paramount. Cybersecurity affects all these outcomes, making it an engineering problem.”

The bill for getting it wrong has grown. Cyberattacks on U.S. utility companies climbed nearly 70 percent over a single year.

Dragos and Marsh McLennan put worst-case global OT cyber losses at $329.5 billion across all sectors. Waterfall Security counted a 146 percent year-over-year rise in OT sites hit by attacks with physical consequences.

Operators spend the cybersecurity money elsewhere. OT security draws roughly 20 percent of it, and laptops and enterprise tools take the rest.

Recovery is where the plans break

Shankar Somasundaram runs Asimily, which inventories connected devices across industrial sites. He watches the restart expose what the recovery plan assumed.

“I’ve seen plants with a backup of a controller, but the engineer who knew why it was configured the way it was is long gone. So the backup is restoring a state no one can confirm is actually still correct. Plants end up reverse-engineering their own process under immense pressure (mid-outage!), which is the worst possible time to learn how your plant functions,” he told Help Net Security.

The written recovery estimate rarely survives contact with a live restore.

“We have seen recoveries take a few days longer than planned, while others have been months over schedule.”

He returns to one distinction that recovery plans blur.

“Backups that have never been restored against a live controller can and often do behave differently than expected the moment it matters most. So until you’ve run that restoration for real, you have more of a guess than a hardened recovery capability.”

The vendor becomes the next constraint.

“More often than not, critical systems require the original integrator or manufacturer physically at the plant to restore operations safely, and who’s to say that person is available on your timeline? Your backup plan may have assumed a phone call would solve something, when the reality is you’re looking at a two-week wait for someone to hop on a plane.”

The low-priority device opens the door

The way in tends to sit where the security attention is thinnest. Somasundaram sees the same pattern across sites.

“Plants may very well lock down their core OT devices but then treat IoT devices (the facility cameras, sensors, building systems, etc.) as an afterthought because the risk feels smaller. But IoT devices make just as good a launchpad into the rest of the plant’s network as anything else (and often a better one because nobody’s watching it quite as closely).”

These intrusions stay off the public record.

“Say you have an attacker who got in through one of these overlooked IoT devices, poked around, and got caught mid-process. Production never stopped and nothing was provably lost, so it gets filed away as a non-event instead of the warning it actually was.”

Hidden assets, reachable from the internet

Ayala runs cold-eye reviews and keeps meeting the same blind spot.

“When I walk a site for a cold-eye assessment, the most common thing plant staff have stopped seeing is the steady accumulation of temporary workarounds on security controls, open and unlocked panels, and “temporary” network connections that have been in place for a year or more.”

He raises it. One room answered him this way.

“We’ve been running like this for several years without an issue. We will get to it and make sure this time.”

His reply reframes the calm.

“I tend to point out that the absence of a cyber event so far is not proof of safety, only proof that the site has not yet been seriously tested.”

At one facility, cellular routers and packaged OEM gear had accumulated on the lower levels of the OT environment, absent from the network drawings.

“During an incident, encryption malware made it onto one of the HMIs and began spreading laterally. Fortunately, it was caught early before it could impact primary control systems. What finally moved the C-suite was seeing that their trusted enterprise network monitoring tools had completely missed the lower-level assets because they were outside normal visibility.”

Ayala has a read on what carries a room like that.

“Technical arguments alone rarely work; showing leadership that critical process assets were invisible to their existing tools and directly reachable from the internet changed the conversation immediately.”

The hard part of the review is the conversation, and he lets the room sit in it.

“Sometimes you have to let the silence that follows the hard question do the work.”

Physics repeats itself

Ayala’s argument runs through a recent ABS Consulting white paper, “OT Cyber Resilience and Business Continuity for Global Energy Facilities.” It leans on process safety as the template, with ISA/IEC 62443 for control-system security running alongside IEC 61511 for safety instrumented systems. Apu Pavithran, CEO of Hexnode, marks where the comparison gives way.

“For example, a valve predictably fails based on known parameters, but an attacker prefers novel techniques to disrupt in new ways. The digital world breaks in far less predictable (and far more targeted) ways than the physical.”

Engineers carry one mechanical habit into software, and it does the most damage.

“For one, it’s a fallacy to think that certification is one-and-done. Unlike machinery built to last decades, the constant evolution of software and sheer speed of new vulnerabilities mean teams need to constantly check and recheck for patches.”

Insurers are writing the rules now

Insurance carriers run annual OT security audits of refining and chemical sites, and the findings feed straight into premiums. Pavithran sees underwriting stepping into the space a mandate would occupy.

“Plenty of industrial sites still sit outside any binding cyber mandate and underwriting is surprisingly effective at filling this regulatory vacuum.”

Operators stumble on proof.

“Most can describe their security efforts yet struggle to continuously prove them. Insurers want a current asset inventory and a patch cadence with exceptions documented.”

An underwriter reaches the verdict on one condition.

“In the eyes of an insurer, no record means no evidence of control.”

The people who can do this are retiring

The sector is being told to run a three-to-five-year resilience roadmap at every site at once.

The work needs someone fluent in control rooms and in networks, a person who has stood on the floor during a process upset in the small hours. That profile takes fifteen or twenty years to grow, and the technicians who carry it are aging out.

Pavithran favors building the replacements inside the plant.

“Second, a lot of what makes that person valuable doesn’t travel with them. They know their specific plant but real site knowledge comes on the job. Realistically, the next generation should come from internal conversion rather than external recruitment.”

He has watched the sector cross a shift this size once already.

“Today’s veterans were yesterday’s novices facing a major move from airgapped environments to always-on machinery.”

One question at the walkdown

A plant can own the monitoring, pass the audit, and stay exposed in places nobody has checked. Somasundaram would set the paperwork aside and test one thing.

“What I’d want to know is whether anyone can tell me what’s really on the plant’s network and what those things are allowed to talk to. I would ask to see the asset inventory and check it against reality. In a ceremonial program, that inventory is a spreadsheet that was accurate the day someone built it and has been drifting ever since, with devices on the floor that never made it in and old entries still sitting on the list long after the equipment is gone.”

He weighs the answer for one thing.

“Ask how they know their inventory is current, and a real program describes an ongoing process…a ceremonial one describes the last audit, in the past.”

Download: The High-Performance Team Playbook