This session provides a grounded view of the current OT cyber threat landscape, combining regional adversary activity with the regulatory and compliance pressure shaping industrial security programs. Attendees will learn how threat groups are targeting critical OT infrastructure, how those risks manifest across industries, and how governments are responding through evolving policies, standards, and enforcement. The session connects threat activity to regulatory expectations, helping attendees understand not just what they are up against, but how requirements are shifting in response.

With a clear picture of the threat landscape in place, this session turns to the question of program readiness. Attendees work through a structured self-assessment of their OT cybersecurity program against the SANS ICS 5 Critical Controls. Starting with a practical overview of the Five Critical Controls and the OT Maturity framework, participants will benchmark where their program stands today. The goal is give you an honest picture of where progress is being made, where gaps exist, and what to prioritize next — and a foundation for the sessions that follow, where those insights will be put to work.

Whether you are building the foundations of your OT security program or looking to accelerate an established one, this session takes participants inside the Dragos Platform to explore its purpose-built capabilities for OT environments. Attendees will see how the platform turns raw industrial data into actionable intelligence, powered by the Dragos Intelligence Fabric and how new AI capabilities help security teams investigate threats faster and prioritize with confidence. The session closes with a forward look at the product roadmap and where the platform is headed to meet the evolving requirements of securing OT infrastructure.

OT security programs succeed when their core functions work together — but understanding how asset visibility, vulnerability context, and threat detection connect in day-to-day operations is easier said than done. This workshop gives participants a practical walk through of real workflows analysts use to keep industrial environments secure and operational. Attendees will leave with a clearer picture of how these capabilities fit together and how to put them to work in their own programs.

What hundreds of OT deployments at global scale reveal that no single program can.

Most OT security programs stall at the same place: they can see everything and withstand nothing. After running programs across hundreds of clients, thousands of sites, and dozens of countries, the pattern is unmistakable: visibility has become the industry's comfortable plateau, and the next decade belongs to resilience and scale.

This session takes the view from altitude. Dragos provides the engine: asset visibility, detection, and OT threat intelligence at the technical core. Accenture wraps it into a program: governance, consequence-driven risk, and the industrialized delivery that turns one successful pilot into a defensible fleet across 200 plants, 30 countries, and 12 languages. Together we'll show what global scale reveals that no single deployment can: why maturity misleads, why visibility is necessary but never sufficient, and how enterprises actually move from seeing the risk to surviving it,  at scale, and at speed.

This session presents findings from a research initiative conducted by NORCE and the Norwegian University of Science and Technology (NTNU) using the Dragos Platform to evaluate its detection capabilities against staged cyberattacks on an industrial drilling control system. By deploying Dragos in a controlled Hardware in the Loop research environment, the study put the Platform’s intrusion detection and threat characterization capabilities to the test — assessing how effectively it can identify adversary behavior at each stage of an attack chain, reduce false positives, and surface actionable insight for OT security teams operating in high-stakes upstream energy environments.

This interactive workshop translates threat activity into realistic threat scenarios. Using scenario-based cards based on real-world attacks, participants will work through how adversaries operate in industrial environments and evaluate how their own organizations would detect and respond. By stepping through these scenarios, participants will uncover gaps in visibility, detection, and response, and gain a clearer understanding of how real-world threats could impact their operations.

This session introduces participants to the fundamentals of incident response in industrial settings — no prior IR experience required. Through a guided, discussion-based case study, attendees will get their first look at how incidents unfold in OT environments, what responders look for, and how to think through an investigation step by step. The session is designed to build confidence and foundational awareness, giving new practitioners a clear mental model of the incident response process before they ever touch a tool.asurable progress in the near term.

When a security incident hits an OT environment, knowing where to start makes all the difference. This session introduces participants to the fundamentals of incident response in industrial settings — no prior IR experience required. Through a guided, discussion-based case study, attendees will get their first look at how incidents unfold in OT environments, what responders look for, and how to think through an investigation step by step. The session is designed to build confidence and foundational awareness, giving new practitioners a clear mental model of the incident response process before they ever touch a tool.