PrOTect It All

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep130/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

You do not need to scare anyone to get OT security funded. Shaun Six, President of UTSI International, makes the case for selling the value instead of the fear.

Shaun spent about a decade on the operator side before his company fell into cybersecurity, and he and Aaron cover the ground in between: who is leaving the OT workforce and who is coming in, losing engineers to venture-funded apps, where to put the X and what OT expertise is actually worth, a one-page budget the board will read, and why a water district's cyber budget competes with a police cruiser. The last third is post-quantum readiness for long-lived control systems: pair the retiring expert with a junior, and build the inventories, including a cryptographic bill of materials, while you are out in the plant.

Key takeaway

You do not need to scare anyone to get OT security funded or understood. Put what you spent, what you got and what you are asking for on one page. Pair the people who are about to retire with the people who are just arriving and have them do the inventory together. And while you are out there, build the lists (including cryptographic) that tell you what is actually in the plant.

Chapters

0:00 Intro

0:19 Welcome and introduction

0:55 From oil and gas operator to CEO: how UTSI fell into cybersecurity

2:16 Deploying connected equipment, and learning the exposures later

3:54 Aaron: learning from the intern, and "stop when unsure"

7:34 Why OT people are humbler: the risk profile starts with people

9:33 The workforce gap: who is leaving and who is coming in

11:12 Quantum at the conference: a myth on one side, a research team on the other

12:46 Losing engineers to venture-funded apps

13:42 Getting people into OT: Mike Holcomb, ICS Village and community colleges

15:49 Entry level with five years of experience

17:00 Physical I/O on the show floor, and the pay problem

18:22 Maslow's hierarchy and the 16 critical infrastructure sectors

20:33 The value gap: the expert with the hammer, and the five-day assessment

24:38 Where to put the X, fixed price, and the three-day fix

26:57 Quantifying the value: a trusted advisor, not selling fear

28:42 The one-page budget for the board

29:42 Water districts and city council budgets

31:08 Selling availability and reliability, not "cyber"

33:09 Cyber safety is physical safety: educating the board

34:30 Water: a lower-cost assessment for utilities

36:07 How Shaun got into quantum: the box he could not test

37:29 A book for CISOs: quantum and cryptography for non-specialists

38:51 Why AI and quantum are accelerating each other

41:59 Timelines for post-quantum plans

43:47 "Moore's law is dead" and the book behind the term

44:06 Aaron: what should listeners ask their boards this budget season

45:01 Insurance, assessments and standard frame...

Chapters

(00:00:00) - Introduction to Sean and UTSI
(00:00:56) - Sean's Background in OT and Cybersecurity Origins
(00:03:46) - Lifelong Learning and Valuing All Voices
(00:06:30) - OT Safety Culture and Questioning Attitude
(00:07:11) - Knowledge Gap and Aging Workforce in OT
(00:11:03) - Quantum Readiness Awareness Gap in Industry
(00:12:52) - Attracting Talent and Competing with Tech Salaries
(00:14:09) - Training Programs and Bridging Entry-Level Gaps
(00:18:04) - Maslow's Hierarchy and the Value of Critical Infrastructure
(00:20:21) - Quantifying Expert Value - The X Marks the Spot
(00:24:40) - Fixed Pricing, ROI, and Justifying Cyber Spend
(00:28:20) - Building a One-Page Budget for the Board
(00:29:32) - Water Utilities and Underfunded Infrastructure Risk
(00:35:37) - Deep Dive into Quantum Computing Risks
(00:38:34) - AI Acceleration of Quantum and Cryptographic Attacks
(00:44:09) - Practical Steps: Assessments, Bills of Material, and Frameworks
(00:48:02) - Resources, Talks, and Closing Thoughts

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep129/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

The small water utility down the road cannot afford a big consultancy, and it still has to be defended. Erin Burns is building a company around that problem.

Erin is an Army veteran with roughly two decades in cyber operations and the founder of EVR:RDY Defensive Operations Group. He and Aaron take on the question every transitioning veteran asks, how do I get into OT, and the problem behind it: automation is closing the entry-level door just as small utilities need defenders most. They get into hiring troubleshooters instead of job reqs, engineering a low-cost data diode, why a tool nobody runs is worse than no tool, the air gap myth, and how Erin's team weaponized sneaker net to get packet capture out of sites that will never allow remote access.

Key takeaway

The utilities that cannot afford a big consultancy still have to be defended. If you mandate a standard, fund it, and build the people pipeline the same way you build the product: with problem solvers, hands-on apprenticeship and tools small operators will actually use. A tool nobody uses is worse than no tool.

Chapters

0:00 Cold open

0:25 Intro

0:46 Meet Erin Burns

2:26 The question every transitioning vet asks

3:23 Hard hats and factory floors

5:43 Automation is closing the entry-level door

8:03 Ignore the job req

11:06 A pilot with local water sites

12:17 Automate to lower the noise floor

14:19 No juniors means no seniors

16:36 The operator wearing every hat

17:55 Engineering a low-cost data diode

19:28 Dave's network and the XP box

21:44 School lunches, police cruisers and cyber

26:19 A tool nobody runs

27:11 Why investors hate this model

28:53 The cellular modem nobody questioned

30:51 How many air gaps have you seen?

34:38 The historian under the tablecloth

36:31 What do you do with packet capture?

39:50 The air gap myth

46:04 Two different runbooks

49:50 Who defends the sites that can't pay?

53:57 Where to find Erin and EVR:RDY

55:20 Outro

About the guest

Erin Burns is an Army veteran with roughly two decades in cyber operations and defensive work, and the founder of EVR:RDY Defensive Operations Group, a company focused on affordable OT/ICS defense for critical infrastructure operators with limited budgets and resources. He came up through special forces support and early military cyber, became a cyber warrant officer, and by his account spent five years on an Army cyber team defending OT environments, on factory floors and in hard hats. He is now building EVR:RDY around that experience, with a focus on water utilities and other sites that cannot afford commercial tooling.

EVR:RDY: https://evrrdy.com

EVR:RDY pilot program: https://evrrdy.com/pilots

Erin on LinkedIn: https://ww...

Chapters

(00:00:00) - Cold open: they deserve to be defended
(00:00:25) - Intro
(00:00:47) - Meet Erin Burns
(00:02:26) - The question every transitioning vet asks
(00:03:23) - Hard hats and factory floors
(00:05:43) - Automation is closing the entry-level door
(00:08:03) - Ignore the job req
(00:11:06) - A pilot with local water sites
(00:12:17) - Automate to lower the noise floor
(00:14:19) - No juniors means no seniors
(00:16:36) - The operator wearing every hat
(00:17:55) - Engineering a low-cost data diode
(00:19:28) - Dave's network and the XP box
(00:21:44) - School lunches, police cruisers and cyber
(00:26:19) - A tool nobody runs
(00:27:11) - Why investors hate this model
(00:28:53) - The cellular modem nobody questioned
(00:30:51) - How many air gaps have you seen?
(00:34:38) - The historian under the tablecloth
(00:36:31) - What do you do with packet capture?
(00:39:50) - The air gap myth
(00:46:04) - Two different runbooks
(00:49:50) - Who defends the sites that can't pay?
(00:53:57) - Where to find Erin and EVR:RDY
(00:55:20) - Outro

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep128/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go?

Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework.

He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell.

What you will take away

Why trust is something you delegate, not a security control, and how to put a limit on it

What Zach's blast radius framework measures: reach, scope crossing, standing privilege, human concentration, automation visibility and recoverability

Why the same PLC with the same vulnerabilities is not the same risk on a turbine as it is on an ice machine

Why attacks now look like a normal workday from a cloud address, not a foreign IP in the logs

Why one any-any rule undoes 477 good ones, and why a firewall starts from deny

Why you verify every piece of work an AI agent hands back, however good the prompt was

In this episode

5:03 Sleeping under the conference table

8:30 The open proxy everyone borrowed

10:24 From K-12 to defense contracting

12:59 How careers really get built

16:36 Where is the puck going?

23:22 A heat map for the smoker

25:41 Verify everything the agent does

32:31 Attacks that look like a normal workday

34:33 The work laptop on the home network

39:15 Security is never done

41:39 Where the word firewall comes from

43:33 The same failure, five years apart

44:21 What blast radius measures

46:28 The turbine and the ice machine

49:43 When the right account does the wrong thing

51:53 A firewall with one any-any rule

54:08 Where to find Zach's research

About the guest

Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks.

Blast Radius white paper and scoring workbook: https://github.com/ridgestoneco/blast-radius

LOLMgmt white paper: https://zenodo.org/records/21255394

Zach on LinkedIn: https://www.linkedin...

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep127/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity.

Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table.

His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do.

What you will take away

Why agent sprawl is already here, and why the real question is who owns an agent when the person who built it leaves

How to say no to a risky request and still give the business a path, so the work does not go to shadow AI

Why you fork a community MCP server and keep only the 20 of its 107 tools you actually need

The vendor due diligence question the questionnaire never asks: who can read the key, and can you get the log

Why physical segmentation is coming back for truly critical systems, and why OT never left it

How security review can finally run at the speed AI-built code is written

In this episode

2:42 Plan for when something breaks

6:31 The risks people are ignoring

10:03 Build it yourself and you support it forever

12:51 200 agents to 900 in three months

20:40 Defending at machine speed

21:46 Physical segmentation is coming back

24:06 107 tools and you only need 20

26:46 How the conversation changes by industry

30:11 Still working on the fundamentals

31:17 Third parties and the weakest link

36:25 A guardrail, not a stop sign

41:46 Bring only the data you need

49:30 Did AI write the book?

51:20 Security finally at development speed

About the guest

Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, a global technology consulting and services firm specializing in cybersecurity, cloud, data and AI, and software development. With more than 25 years of experience in technology, Ben has led enterprise architecture, cybersecurity strategy, regulatory compliance, incident response and large-scale business transformation initiatives. In his dual CTO and CISO role, he helps organizations balance innovation with security, evaluating emerging technologies from both a business and a risk perspective.

ProArch: https://www.proarch.com

Ben on LinkedIn: https://www.linkedin.com/in/ben-wilcox/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep126/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Shadow IT used to be a server in a closet. Today it is Linda from sales uploading confidential quotes to whatever AI tool she found first, and your corporate data leaving with it.

Jack Smith has spent more than 25 years in enterprise IT, across infrastructure, networks, datacenters, cloud and incident management, and he hosts the IT Horror Stories podcast. His argument is that AI is not a new problem, it is the latest version of an old one, and that the reflex to block it at the firewall has never worked and will not work now.

Aaron and Jack get into where AI genuinely helps, where it quietly does not, and the question of what happens when a system that gives a different answer every time is asked to make a decision that has to be the same every time.

What you will take away

Why blocking AI tools fails the same way blocking USB sticks and webmail failed

The difference between a tool that optimises your work and a tool you hand your work to

Why analytics and diagnosis are the strong case for AI, and treatment is not

The training gap: staff get GDPR training and security training, and no AI training at all

A one question test anyone can apply before pasting company data anywhere

In this episode

1:19 Twenty five years, from floppy disks to AI

10:45 Shadow IT used to be a box in a closet

12:31 Why blocking it never works

19:53 You cannot throw people in the deep end

21:48 When a wrong answer can kill someone

25:40 The answer everybody hates: training

27:54 Never give AI your production environment

41:20 Ask who owns your AI policy

44:38 Who actually gets rich

47:08 The Times Square test

About the guest

Jack Smith has spent more than 25 years working in enterprise IT across infrastructure, networks, datacenters, cloud and incident management. He hosts IT Horror Stories, a weekly podcast about real-world IT incidents, what went wrong, how they were fixed, and what we can learn from them.

IT Horror Stories podcast: https://ithorrorstories.eu/

"AI Is The New Shadow IT": https://ithorrorstories.eu/#rant07

Jack on LinkedIn: https://www.linkedin.com/in/franky/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep126/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Support the show: https://protectitallpod.com/go/support/podcast

YouTube: https://www.youtube.com/@PrOTectITAll

Email: info@protectitall.co

X: https://twitter.com/protectitall

Faceboo...