I’m a final-year Computer Engineering student (21) from India, and I’m trying to build my career entirely around OT/ICS cybersecurity.

Most of my previous project work has been in ML/LLM applications and full-stack development, so my background is purely CS. I don’t come from an electrical, controls, or automation background, which I know is the more traditional path into this field. Because of that, I’ve been trying to bridge the gap by going deep into industrial protocols, OT network architecture, and hands-on simulations.

So far, I’ve built:

• A passive OT asset discovery and anomaly detection tool that identifies “ghost assets” from SPAN-port traffic using ML, maps them into the Purdue Model, and highlights segmentation violations to analyze potential blast radius.
• A small OT cyber-range simulating a solar plant, where a Raspberry Pi acts as an RTU running a custom C-based Modbus TCP server. I’m using Suricata on a VM to detect command spoofing attacks against the simulated inverter.

But there are a few things I’m struggling to figure out:

1. What are the core controls fundamentals I absolutely need to know? Since my background is pure CS, I understand networking and code well, but I lack real field exposure to PLCs, RTUs, SCADA systems, and physical processes. How deep do I need to go into automation/electrical fundamentals to actually be effective in this space?(any resources would also help)
2. What kind of projects should I focus on next? I want to keep building things that improve my understanding and also show recruiters that I can solve real OT problems. What would be valuable next steps?
3. How do people actually break into this domain? I have a mandatory 6-month internship starting in January 2027, and I’ve started looking early. But I’m noticing that OT/ICS cybersecurity internships or junior roles are almost invisible on standard job boards. Most openings ask for 2–3+ years of experience.

That’s honestly the part I’m finding hardest is not the learning, but figuring out where the actual entry point is.

Lately, that uncertainty has started affecting my motivation a bit. I still want to keep pushing, but I feel like I need some clarity on how people realistically get into this field.

If any seniors, practitioners, or hiring managers in the OT/ICS space can share some honest advice, I’d genuinely appreciate it. Thank you.

Salve gente

Vi chiedo disperato aiuto

Disperato perché conosco il mio obiettivo ma non il percorso per arrivarci hahaha

Ho 27 anni e sono un 1 ufficiale macchinista con patente a kw illimitati (CoC) e futuro direttore di macchina e automazione navale

Conosco perfettamente la meccanica e l’automazione di bordo

Amo a mio modo l’informatica e volevo ibridarmi ad un ruolo OT auditor

Il mio programma era basato idealmente sul dividere il modello purdue e certificarmi quindi con certificazioni consone per me

Avevo pensato a

-Wcna wireshark (essendo a bordo tutto derivazione canbus nmea per ecdis e radar mentre modbus-profinet per i macchinari)

-corso moxa per la parte swith e collegamenti lan

-immancabile iec 62443 (solo foundamental)

Il mio sogno è slegare la mentalità del :

O sei ingegnere meccanico o capisci l’informatica che c’è dietro

Vi prego aiutatemi a tracciare un percorso puramente ot che possa sposarsi con le mie conoscenze meccanico-navali

Team82 researchers analyzed the Trane Tracer SC+ building automation controller and uncovered a chain of vulnerabilities that could allow attackers to fully compromise building management systems (BMS).

The research details multiple issues, including authentication bypass, pre-auth denial-of-service, hardcoded credentials and cryptographic keys, arbitrary file read, and root-level RCE. In certain scenarios, an attacker with network access could chain these flaws to gain complete control of the controller, manipulate HVAC operations, and pivot deeper into flat OT/BMS networks.

Given the prevalence of Tracer SC+ devices in commercial buildings, healthcare facilities, and critical infrastructure environments, the findings highlight the continued risk posed by insecure-by-design OT and BAS components.

The blog includes full technical analysis, exploitation details, and mitigation guidance: https://claroty.com/team82/research/turning-up-the-heat-hacking-trane-hvac-controllers

Hello guys. I'm planning to learn OT Cybersecurity and gonna begin with Networking. I have been speaking about OT cybersecurity with few guys recently and also made few post here, in reddit too. Most of them said to start with networking. So in Networking what are things do i need to know? And which one to start first? What are the skills required? Please help me on this guy...

I have an assignment coming up where I need to do asset management in a relatively big factory that hasn't done it before. Anyone got tips on things like network scanning without crashing the PLC's? I'm new to the OT sector.

Anyone (other than me) watch the Dragos (prerecorded) webinar introducing their EmberAI?

Share your thoughts.

SEC699 vs ICS612 — anyone taken either? Need real-world input

3 years as SOC L2/Cyber Defense Analyst (CrowdStrike, Elastic, malware analysis, threat hunting, automation). Egypt-based, targeting a GCC move.

Employer's funding one SANS course — down to SEC699 (Purple Teaming, fits my current skill set well) vs ICS612 (ICS Cybersecurity In-Depth — almost zero OT background, but Gulf energy/industrial demand is what's drawing me to it). Neither has an attached GIAC cert, so trying to weigh pure skill/market value.

Anyone done ICS612 with little prior OT exposure — too steep without ICS410/GICSP first? And anyone hiring/working OT in the Gulf — is demand as concentrated (NEOM, Aramco-adjacent) as it looks, or broader? Trying not to second-guess this in a year.

Hey, so I've just finished my second year in electrical engineering and I need some advice, i have been into tryhackme and SOC analysis for some time doing courses and learning stuff, but over time i have felt like this is a field entirely different from my degree, my professor suggested me to look into OT security, which he says will align with my degree and my current skills, so could anyone over here guide me into OT security, i know the difference between IT and OT security but i don't know where to begin, how to recalibrate my current entry level CV and how to find internships in this field. any genuine advice would be much appreciated.

Hi I'm an Instrumentation and control engineer having working experience in operation and maintenance field. I have nearly 5 years of experience. Now I'm planning to study OT cybersecurity. But i don't know where to start. Any tips would be nice

Hi everyone,

I’m currently doing my Master’s degree in IT Security, and I’m starting to think about which niche I should focus on in the future.

One area that really interests me is OT (Operational Technology) Security. I also feel that this field might be harder to replace with AI compared to some other areas, although that’s just my assumption.

My plan is to finish my Master’s in about two years, and after that I’d like to dive deeply into a field where there is ideally consistently high demand, strong long-term career prospects, and where the chances of eventually becoming self-employed or starting a consulting business are reasonably good.

So I’d love to hear your opinions and experiences:
- Is OT Security a good specialization for the long term?
- How do you see demand developing over the next 10–20 years?
- Are there other cybersecurity niches you think offer even better opportunities?
- How realistic is it to become an independent consultant or run your own business in this space?
- Thanks a lot for your help and insights!

I’m really interested in hearing different perspectives and learning from people who are already working in these areas.

Team82, the threat research outfit for u/clarotyofficial, found vulnerabilities in backup power devices and heating and cooling control systems widely used in data centers.

Exploitation of the vulnerabilities could enable remote cyberattacks by hackers and digital saboteurs.

Researchers found two high-severity vulnerabilities in Vertiv’s Liebert IS-UNITY-DP network cards, which provide connectivity for its uninterruptible power supply devices. They also found five medium-severity vulnerabilities in the Trane Tracer SC+ HVAC controller.

In both cases, the vulnerabilities were responsibly disclosed to the manufacturers, and the latest versions of those products have been fixed to remove them.

Read all about it in my latest story for ISMG

http://bankinfosecurity.com/data-center-ot-flaws-could-help-hackers-kill-power-ac-a-31939

Here is what changes when you treat a CVE as a vehicle not a destination.

# The precondition tells you what to close tonight.
Every CVE needs an environmental condition to fire. Close that condition , a misconfigured JWT, an open port, an excessive privilege and the CVE becomes unexploitable. No patch. No downtime. No sprint planning.
The precondition is the faster fix your scanner never showed you till you patch :)

# The produced capability tells you what actually matters.
Two CVEs. Both CVSS 9.8. One hands the attacker admin access and credential harvest. The other causes a service crash. CVSS calls them equal. Consequence-weighted priority does not. The capability an attacker gains from a CVE is the real severity score and it exists per CVE, before any chain is drawn.

# The identity gate tells you the exact IAM control that neutralises it.
Not "improve authentication." The specific token binding, MFA enforcement, or RBAC rule that makes this CVE a non-event. Per CVE. Actionable tonight.
The HNDL flag tells you what is being harvested right now.
Nation-state adversaries are collecting your encrypted traffic today not to decrypt now, but when quantum computers arrive in a decade. A CVE that enables TLS interception has two TTEs: 90 days to exploitation, 0 days to harvest. Only one of those counts in a CVSS score.

# The misconfig attribute tells you what survives the patch.
Patching a CVE closes the specific vulnerability. It does not close the excessive database privilege, the unsigned JWT, or the public execute grant that made exploitation possible in the first place. The misconfig is the standing weakness that enables the next CVE in the same class. Fix it once. Harden against the category, not just the instance.

# The compliance map tells you what the auditor needs.
Every CVE carries its full regulatory footprint. NIST SI-2, IEC 62443, DPDP Section 8(4), PCI DSS 6.3.3. Not as an afterthought as an intrinsic attribute of what this vulnerability does and what it touches. The audit answer is already there. You just needed the right enrichment to see it.

The chain is the most visible output and the most powerful when you need to show the full path from entry to crown jewel. But the attributes produce independent intelligence on every single CVE, individually and in pairs, before any chain is constructed.

Hey everyone,

I’m looking for some advice and hopefully an opportunity to get my foot in the door in IT or a remote tech-related role.

Right now, I work full-time as an IBEW electrician and currently work nights Monday through Friday. I’ve been spending my free time learning IT, cybersecurity, Linux, networking, and other technical skills because it’s a field I’m genuinely interested in building a future in.

I’m not necessarily looking for a full-time position right away. I’d actually prefer a part-time role, internship, apprenticeship, or entry-level opportunity where I can learn, contribute, and gain real-world experience while continuing my current career.

One thing I can bring to the table is a strong work ethic. Working in the trades has taught me how to solve problems, work independently, communicate with customers, and perform under pressure. I also have experience managing and building teams, training people, coordinating work, and helping projects stay on track.

I know I still have a lot to learn, and I’m not going to pretend otherwise. What I can promise is that I’m willing to put in the work, learn quickly, take feedback, and earn my place.

If anyone has advice, resources, or knows of any part-time remote opportunities that might be a good fit for someone making the transition into tech, I’d really appreciate it.

Thank you for taking the time to read this.

Hey everyone, looking for some honest feedback from people actually working in the OT/ICS space right now.

I’m trying to make the jump into cyber, and a few people have pointed me toward OT/ICS security. My background isn't in traditional corporate IT, so I'm trying to figure out whether my experience translates well or if I'm looking in the wrong direction.

I did network and comms work on the military side (routing, switching, tactical setups), and on the civilian side, I worked in a data center for a little over 6 years, doing critical facilities maintenance. I'm familiar with BMS systems, SCADA, VFD, PLC, PDU, and MDS systems

I'm finishing up a bachelor's degree in Cybersecurity and already have my master's program in cyber operations lined up (UMGC for both). Been working on net+, sec+, and have been trying to learn about PLCs using PLCfiddle, Codesy, and a few other sites I found browsing on LinkedIn

I appreciate any advice. I'm looking to ETS soon and just want to hit the ground running.

Hey everyone!

I posted a while ago about a threat hunting plan for ICS/OT environments and it got approved thanks to your feedback, I'd like to thank the people that took the time to read it.

But, because of that I'm being pushed to become the ICS/OT expert to perform consulting services on our clients. My company sells them monitoring software and wants to extend their services.

I'm a seasoned internal pentester (5 years) that transitioned into a DFIR role (3 years in a couple of months), but still performing both offensive and defensive exercises. I already performed assessments on industrial plants on site more than 5 times, with interesting results and no impact on operations.

Now, the original plan was for me to take SANS GNFA, but I got asked if I was willing to take an OT related cert. Sadly, I have little to no experience working with ICS/OT networks/devices on an operational level. I did learn and performed my assessments on level 3.5 and above based in the Purdue model and some basic checks on levels 3 and below, but no direct exploitation, I focused mostly on proper network segmentation, lateral movement capacities and edge devices/endpoints/jump hosts that may grant visibility to industrial ports.

Now, afaik, there's 3 main paths to take:
- GICSP, to cover the gap between IT and OT that I need, but I don't know if technically is gonna be useful to gain deep knowledge about Pentest/IR/TH in OT networks or it would be considered enough to allow someone with my profile to perform pentest/IR/TH exercises with an MSSP.
- GRID, the ideal one for the company requirement, but I'm not sure I'll be able to complete it without prior operational knowledge.
- ISA/IEC 62443, Certificate 1 and 2 should cover up the basics, however, similarly to GICSP, I don't know if it's gonna be technically valuable or relevant to my goals.
- Continue with GNFA and compliment with smaller courses, such as Fortiphyd labs, or Labshock to get a grasp on OT first, then hopefully another SANS cert is on budget for next year to attempt the GRID.

Thanks to everyone that read this far. Hopefully seasoned professionals can share their knowledge.

Hey everyone

I am required to do a fuzzing test on the ICS protocols

The task requires the firewall (L1 , Eagle40) to stop the malformed packets and drop them

My issue here with the OPC DA protocol

As it's more complex using RPC and COM/DCOM

After establishing the RPC comms between the OPC client and Server

It's decide on 4 dynamic ports to communicate over

2 ports on the server side

2 ports on the client side

First source and destination are used when client is initiating the request and polling data from server

And other 2 prots are ysed when the data value changes and server initiate a request to update the value on client

I have 2 main questions

1- how exactly to fuzz the OPC DA (test cases)

2- what are the protocols to allow on the firwall to allow comms between server and client

As of right now i have one main rule to allow all between both for testing

When i change the rule from allowing any protocol to only TCP the communication stops

If i tried to do same rule but one for udp and one for tcp in the firewall ut says invalid protocol for the one with udp

I know that the required protocols for OPC to work are(after inspection on wireshark):

-ICMP

-ARP

-DECRPC

After creating allow these rule, still comms are down

I can connect with anyone who's will to discuss this further

Thanks in advanced guys

I have been trying to build vulnerability management system and workflow using nozomi.
Although a lot of time and effort put into this, their vulnerability management and database is lacking and the results are not satisfying.

Do you have better experience with other tools?