Physical Consequences, Supply Chain, and Building Resilience
OT failures are physical, and physical failures do not roll back. They fall in three widening rings: the recoverable outage, the equipment damage where cooked accelerators and destroyed switchgear carry year-long lead times, and the systemic ring where a facility's disruption reaches past its fence into the grid it draws from. You size the defense to that tail, not the average. And the last front is the supply chain: gear that arrives already vulnerable sits inside your trust boundary from day one, so the decisive controls happen at the purchase order. Resilience assumes failure, keeps OT able to run islanded from compromised IT, and makes incident response a rehearsed joint decision between security and the engineers who run the plant.
Knowledge check
Why should OT security investment be sized to the tail rather than the average incident, and why is supply chain the hardest layer to defend?
Show the answer
Because most incidents are recoverable outages, but the rare event, cooked accelerators or destroyed switchgear with year-long lead times, or a cascade beyond the facility, imposes physical costs that cannot be reversed or compressed by any response plan. Supply chain is hardest because equipment can arrive already vulnerable inside the trust boundary, and no amount of segmentation helps against a flaw in gear you installed yourself, so the controls must happen at procurement.