This session provides a grounded view of the current OT cyber threat landscape, combining regional adversary activity with the regulatory and compliance pressure shaping industrial security programs. Attendees will learn how threat groups are targeting critical OT infrastructure, how those risks manifest across industries, and how governments are responding through evolving policies, standards, and enforcement. The session connects threat activity to regulatory expectations, helping attendees understand not just what they are up against, but how requirements are shifting in response.

With a clear picture of the threat landscape in place, this session turns to the question of program readiness. Attendees work through a structured self-assessment of their OT cybersecurity program against the SANS ICS 5 Critical Controls. Starting with a practical overview of the Five Critical Controls and the OT Maturity framework, participants will benchmark where their program stands today. The goal is give you an honest picture of where progress is being made, where gaps exist, and what to prioritize next — and a foundation for the sessions that follow, where those insights will be put to work.

Whether you are building the foundations of your OT security program or looking to accelerate an established one, this session takes participants inside the Dragos Platform to explore its purpose-built capabilities for OT environments. Attendees will see how the platform turns raw industrial data into actionable intelligence, powered by the Dragos Intelligence Fabric and how new AI capabilities help security teams investigate threats faster and prioritize with confidence. The session closes with a forward look at the product roadmap and where the platform is headed to meet the evolving requirements of securing OT infrastructure.

OT security programs succeed when their core functions work together — but understanding how asset visibility, vulnerability context, and threat detection connect in day-to-day operations is easier said than done. This workshop gives participants a practical walk through of real workflows analysts use to keep industrial environments secure and operational. Attendees will leave with a clearer picture of how these capabilities fit together and how to put them to work in their own programs.

This session presents findings from a research initiative conducted by NORCE and the Norwegian University of Science and Tecnhology (NTNU) using the Dragos Platform to evaluate its detection capabilities against staged cyberattacks on an industrial drilling control system. By deploying Dragos in a controlled Hardware in the Loop research environment, the study put the Platform’s intrusion detection and threat characterization capabilities to the test — assessing how effectively it can identify adversary behavior at each stage of an attack chain, reduce false positives, and surface actionable insight for OT security teams operating in high-stakes upstream energy environments.

This interactive workshop translates threat activity into realistic threat scenarios. Using scenario-based cards based on real-world attacks, participants will work through how adversaries operate in industrial environments and evaluate how their own organizations would detect and respond. By stepping through these scenarios, participants will uncover gaps in visibility, detection, and response, and gain a clearer understanding of how real-world threats could impact their operations.

This session introduces participants to the fundamentals of incident response in industrial settings — no prior IR experience required. Through a guided, discussion-based case study, attendees will get their first look at how incidents unfold in OT environments, what responders look for, and how to think through an investigation step by step. The session is designed to build confidence and foundational awareness, giving new practitioners a clear mental model of the incident response process before they ever touch a tool.asurable progress in the near term.

When a security incident hits an OT environment, knowing where to start makes all the difference. This session introduces participants to the fundamentals of incident response in industrial settings — no prior IR experience required. Through a guided, discussion-based case study, attendees will get their first look at how incidents unfold in OT environments, what responders look for, and how to think through an investigation step by step. The session is designed to build confidence and foundational awareness, giving new practitioners a clear mental model of the incident response process before they ever touch a tool.