PrOTect It All

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep128/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go?

Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework.

He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell.

What you will take away

Why trust is something you delegate, not a security control, and how to put a limit on it

What Zach's blast radius framework measures: reach, scope crossing, standing privilege, human concentration, automation visibility and recoverability

Why the same PLC with the same vulnerabilities is not the same risk on a turbine as it is on an ice machine

Why attacks now look like a normal workday from a cloud address, not a foreign IP in the logs

Why one any-any rule undoes 477 good ones, and why a firewall starts from deny

Why you verify every piece of work an AI agent hands back, however good the prompt was

In this episode

5:03 Sleeping under the conference table

8:30 The open proxy everyone borrowed

10:24 From K-12 to defense contracting

12:59 How careers really get built

16:36 Where is the puck going?

23:22 A heat map for the smoker

25:41 Verify everything the agent does

32:31 Attacks that look like a normal workday

34:33 The work laptop on the home network

39:15 Security is never done

41:39 Where the word firewall comes from

43:33 The same failure, five years apart

44:21 What blast radius measures

46:28 The turbine and the ice machine

49:43 When the right account does the wrong thing

51:53 A firewall with one any-any rule

54:08 Where to find Zach's research

About the guest

Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks.

Blast Radius white paper and scoring workbook: https://github.com/ridgestoneco/blast-radius

LOLMgmt white paper: https://zenodo.org/records/21255394

Zach on LinkedIn: https://www.linkedin...

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep127/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity.

Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table.

His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do.

What you will take away

Why agent sprawl is already here, and why the real question is who owns an agent when the person who built it leaves

How to say no to a risky request and still give the business a path, so the work does not go to shadow AI

Why you fork a community MCP server and keep only the 20 of its 107 tools you actually need

The vendor due diligence question the questionnaire never asks: who can read the key, and can you get the log

Why physical segmentation is coming back for truly critical systems, and why OT never left it

How security review can finally run at the speed AI-built code is written

In this episode

2:42 Plan for when something breaks

6:31 The risks people are ignoring

10:03 Build it yourself and you support it forever

12:51 200 agents to 900 in three months

20:40 Defending at machine speed

21:46 Physical segmentation is coming back

24:06 107 tools and you only need 20

26:46 How the conversation changes by industry

30:11 Still working on the fundamentals

31:17 Third parties and the weakest link

36:25 A guardrail, not a stop sign

41:46 Bring only the data you need

49:30 Did AI write the book?

51:20 Security finally at development speed

About the guest

Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, a global technology consulting and services firm specializing in cybersecurity, cloud, data and AI, and software development. With more than 25 years of experience in technology, Ben has led enterprise architecture, cybersecurity strategy, regulatory compliance, incident response and large-scale business transformation initiatives. In his dual CTO and CISO role, he helps organizations balance innovation with security, evaluating emerging technologies from both a business and a risk perspective.

ProArch: https://www.proarch.com

Ben on LinkedIn: https://www.linkedin.com/in/ben-wilcox/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep126/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Shadow IT used to be a server in a closet. Today it is Linda from sales uploading confidential quotes to whatever AI tool she found first, and your corporate data leaving with it.

Jack Smith has spent more than 25 years in enterprise IT, across infrastructure, networks, datacenters, cloud and incident management, and he hosts the IT Horror Stories podcast. His argument is that AI is not a new problem, it is the latest version of an old one, and that the reflex to block it at the firewall has never worked and will not work now.

Aaron and Jack get into where AI genuinely helps, where it quietly does not, and the question of what happens when a system that gives a different answer every time is asked to make a decision that has to be the same every time.

What you will take away

Why blocking AI tools fails the same way blocking USB sticks and webmail failed

The difference between a tool that optimises your work and a tool you hand your work to

Why analytics and diagnosis are the strong case for AI, and treatment is not

The training gap: staff get GDPR training and security training, and no AI training at all

A one question test anyone can apply before pasting company data anywhere

In this episode

1:19 Twenty five years, from floppy disks to AI

10:45 Shadow IT used to be a box in a closet

12:31 Why blocking it never works

19:53 You cannot throw people in the deep end

21:48 When a wrong answer can kill someone

25:40 The answer everybody hates: training

27:54 Never give AI your production environment

41:20 Ask who owns your AI policy

44:38 Who actually gets rich

47:08 The Times Square test

About the guest

Jack Smith has spent more than 25 years working in enterprise IT across infrastructure, networks, datacenters, cloud and incident management. He hosts IT Horror Stories, a weekly podcast about real-world IT incidents, what went wrong, how they were fixed, and what we can learn from them.

IT Horror Stories podcast: https://ithorrorstories.eu/

"AI Is The New Shadow IT": https://ithorrorstories.eu/#rant07

Jack on LinkedIn: https://www.linkedin.com/in/franky/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep126/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

YouTube: https://www.youtube.com/@PrOTectITAll

Email: info@protectitall.co

X: https://twitter.com/protectitall

Facebook: https://facebook.com/protectitallpodcast

To be a guest or suggest a...

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep125/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

A wireless engineer sat in a parking lot, connected to a plant's crane anti-collision network, and had everything he needed to stop the cranes inside 20 minutes. Nobody inside the fence ever knew he was there.

In this episode of Protect It All, host Aaron Crow talks with Scott McNeil, Industrial Network and Security Architect II at Global Process Automation (GPA), about the part of the OT network most plants never look at: the airspace. Scott has spent more than 20 years in networking and wireless, the last ten of them entirely in OT, and he sits in the integrator's seat, working across every manufacturer's gear without a product to sell.

The conversation starts where most plants actually are: one flat network, off the shelf gear on the floor, and no budget. Scott's argument is that the low hanging fruit costs time and effort, not money, and that a stable network is the foundation for everything security asks for later: segmentation, inventory, monitoring, then a firewall between OT and IT. He walks through war driving your own plant, why a hidden SSID is not security, the wild west of industrial wireless protocols, wireless that was abandoned in power plants years ago and is still on the air, and where wireless earns its place.

The second half is about vendors and access. Do not take the vendor's word for it, ask the questions before the gear ships, and treat every third party connection as your own exposure. Scott's rule for remote access is simple: this is my house, vendors connect on my terms, every session logged, with an approve or deny button before anyone gets in. Aaron adds the zip tie in the fan story, a backup switch that had silently failed months earlier and nobody knew until monitoring went on, and the two close on shrinking the wireless footprint that leaves your site and on Scott's podcast, The Industrial Wi-Fi Shop.

In this episode, you'll learn:

Why a stable network comes before any security project, and what to fix first

How to war drive your own plant and what a passive scan of your airspace tells an attacker

Why hiding the SSID and relying on obscurity is not a control

Which industrial wireless protocols are standards based and which are proprietary risk

The questions to ask a wireless vendor before you sign

How to run vendor remote access on your terms: logged sessions, approve or deny, no standing tunnels

Why monitoring finds failures you did not know you had

Tune in to hear why your industrial airspace deserves the same design, monitoring, and ownership as any wired connection.

About the guest:

Scott McNeil is an Industrial Network and Security Architect II at Global Process Automation (GPA), where he helps manufacturers design, secure, and modernize the OT networks that keep critical processes running: architecture, IT/OT convergence, segmentation, resilient connectivity, and industrial wireless. A longtime wireless engineer, he created and co-hosts The Industrial WiFi Shop Podcast with Jeremy Baker, speaks regularly at OT and industrial cybersecurity events, holds a bachelor's degree in Industrial Technology from East Carolina University with multiple wireless and network certifications, and serves on the UNC Wilmington Cybersecurity Advisory Board.

Important Links:

LinkedIn of Scott McNeil:

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep124/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

NIS2, the EU Cyber Resilience Act, and CIRCIA are converging between now and 2027, and for the first time the law is pushing cybersecurity requirements upstream into product design and supply chain. What does that actually change on the plant floor?

In this episode of Protect It All, host Aaron Crow talks with Tobias Nitzsche, Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, about the shift regulation is driving in OT: responsibility moving from the server rooms into the boardrooms, and from the operator to the manufacturer.

Tobias makes the case that what gets regulated are fundamentally the basics: risk assessment, asset inventory, cyber hygiene, and detection. The industry has preached these for a decade. Now the law demands them, which makes compliance the business case that finally unlocks long-overdue modernization budget. His advice: do not treat legislation as a paper exercise. Treat it as a utility.

The second half is about recovery, the foundation most plants skip. Aaron and Tobias dig into the vendor-install backup that has never been tested, recovery targets that ignore how long a plant really takes to come back, retain values operators tuned for years that live nowhere else, redundant controllers that are not cyber resilience, and vendor SLAs that send a system engineer when you needed a cyber expert. Tobias's practical pattern: keep a replica of your critical systems, restore into the bubble, and be as intrusive as you like there, scanners and all, without touching production.

Also in this one: NIS2 Article 20 and personal liability for executives, why a cyber incident does not need a nation state (bad firmware counts), where AI belongs in the Purdue model and where it does not, AI as the daily brief for the one-person water utility, Aaron's Exchange 5.5 story about the week the executives lost their email, borrowing the safety engineers' hazard studies as risk input, and why you should never fire up a wireless pineapple on an airplane.

In this episode, you'll learn:

How NIS2, the Cyber Resilience Act, and CIRCIA move accountability to executives and manufacturers

Why 24-hour incident reporting starts with detection, and why you can't wing it

How to reframe your next modernization budget ask around compliance

What a real recovery plan needs: tested backups, plant-realistic RPO and RTO, and captured retain values

Why redundant controllers protect against failure, not compromise

How to test restores and run scanners safely in a replica instead of production

Where AI helps an understaffed operator and where it should never take control

Tune in to hear how the biggest regulatory wave in industrial cybersecurity history can become the budget unlock OT has been waiting for.

About the guest:

Tobias Nitzsche is Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, where he translates the fast-moving regulatory landscape, including NIS2, the EU Cyber Resilience Act, and CIRCIA, into how products are designed and projects are delivered for critical infrastructure. Before this role he was ABB's Global Cyber Security Practice Lead, capping more than 20 years across IT and OT security. Having sat on both sides of the table, first delivering cybersecurity services to critical infrastructure operators and now shaping...