• Understanding vulnerabilities: Once critical relationships with suppliers, vendors or partners are identified, what steps can be taken to understand the specific vulnerabilities each relationship introduces to the organization?
• Assessing potential risks: How should organizations evaluate the risks associated with these critical relationships, and what contingency plan do you have in place in the event that a trusted partner becomes unreliable or is exploited?
• Developing a mitigation strategy: What approaches should we take to integrate these insights into a comprehensive supply chain security strategy, and how should we adjust relationships to reduce risk?
• OT-specific concerns: How should we approach network segmentation, access control, and other OT-specific security practices to prevent disruptions from spreading across critical supply chain nodes?
.
– Moderator: Roger Caslow, CISO, HSRD
– Danielle Caruso, Director Information Security & Corporate Security, Central Hudson Gas & Electric
– Reynaldo Gonzalez, Principal Cybersecurity Architect, Cummins
– Justin Powell, Senior Cybersecurity Engineer, Secomea
– Ryan Subers, Director of Security Strategy and Risk Management, Fortress Information Security
.

• How do we break through the hype and identify practical AI applications that could truly strengthen OT security?
• What are scalable, real-world use cases of AI enhancing cybersecurity posture in OT environments?
• How can leaders strategically think about AI adoption in the next few years to drive measurable impact?
.
– Moderator: Brad Nash, OTCRM SOC Supervisor, ExxonMobil
– Jake Margolis, CISO, Metropolitan Water District of Southern California
.

Threat intelligence is only as powerful as the decisions it informs. In this interactive session, we explore how security teams can translate observations about threat actors into concrete, practical strategies for strengthening your organization’s architecture. Attendees will learn how to:

• Identify patterns and behaviors of active threat actors impacting their sector
• Select and apply the right tools to capture actionable intelligence
• Make informed, risk-based decisions that guide architectural improvements

Through real-world examples and collaborative discussion, participants will leave equipped to let threat intelligence directly inform security decisions, turning insights into tangible defenses and making their organizations more resilient.
.
– Christopher Trifiletti, FBI (Retired), InfraGard St. Louis
.

A Minimum Viable Facility (MVF) strategy focuses on moving to an availability and supply chain-focused approach to cyber recovery. IT and OT Security teams can better partner with plant operations to identify the essential functions and systems that ensure a cyberattack remains a contained incident, rather than a catastrophic shutdown. In this session, we’ll be:.

• • Defining the essential processes that keep your plants operational and your supply chain intact
  • Understanding the difference between creating an MVF and traditional Business Continuity Management/Disaster Recovery (BCM/DR) approaches for OT environments
  • Sharing three practical steps you can take to start building your own MVF with particular attention to securing the IT backbone of your OT environments
  • Examining real-world examples and lessons learned from successfully implementing MVF strategies in various sectors

.– Jason Cook, Field CTO, Rubrik
.

Most operators already have some level of visibility inside individual facilities. They understand their devices, maintain inventories, and monitor operational environments. The real exposure begins when security and governance stop at the site boundary.
Risk does not arise simply from unknown assets, but from inconsistent configurations across locations, uneven firmware baselines, fragmented backup policies, and change processes that are not enforced enterprise-wide. A protected site does not translate into a protected organization.
This session examines the shift from local oversight to enterprise-scale governance—where configuration versioning, structured change management, and reliable recoverability create systemic resilience across distributed critical assets. Because in critical infrastructure, risk does not remain isolated. It propagates.
Security for critical assets begins not with discovery, but with enterprise-level control, consistency, and the ability to recover under pressure.
.
– Oliver Yates, CRO, AMDT
.

• What guiding principles have helped you determine which OT security tools are worth adopting? How do you select capabilities and design your RFP process?
• What are the barriers for including cybersecurity into technology procurement for other departments in your organization?
• How can we ensure that new security solutions integrate effectively with existing OT systems and processes?
• What are the most common pitfalls teams encounter when testing and validating solutions for their OT security tech stack – and how can they be avoided?
• How do you select metrics for continuous improvement in a world with a dynamic threat landscape and consistently upgraded suites of OT security tools?
• How do you relay and demonstrate ROI to your leadership for the value of your OT security investments over time?
.
– Moderator: Anthony Perry, Director IT – OT/IoT Security, FedEx
– Bemi Anjous, CISO, Noble Drilling
– Michael Tetto, CISO, Eversource Energy
– Scott Rosenberger, Head of Generation Cybersecurity, Vistra Corp
– Andy Krapf, Director of OT, Loudoun Water

.

Cloud platforms provide scalable analytics, unified visibility, and actionable insights from diverse operational data across multiple sites. Leveraging ML and AI on top of these platforms enables predictive maintenance, optimized asset utilization, dynamic load balancing… However, this increased connectivity also introduces new cyber-physical risks to OT systems. We explore:
• Where does your organization currently stand in its Cloud and AI journey?
• How can we maintain segmentation to securely leverage Cloud and AI, protocols, tunnelling, etc.?
• How can we safely leverage cloud connectivity and AI integration in OT operations while ensuring that critical safety systems remain fully reliable and isolated?
.
– Moderator: Dennis Hackney, OT Security Principal, Chevron
– Courtney Miller, Manager, OT Security & Infrastructure, Nexus Water Group
– Joey Philippi, Director of OT, WaterBridge
– Randy Petersen, SCADA Superintendent, San Jacinto River Authority
.

T1: Water + Wastewater
– Moderator: Andy Krapf, Director of OT, Loudoun Water and Cybersecurity Advisory Committee, Water-ISAC
.
T2: Oil & Gas
– Moderator: Connie Devine Duncan, Deputy CISO, Phillips 66 and Board Member, ONE-ISAC
.
T3: Electric Utilities
– Moderators: Matthew Duncan, VP, Security Operations & Intelligence, E-ISAC & Michael Tetto, CISO, Eversource
.

• What strategies have helped you focus on progress over perfection in OT security, ensuring continuous improvement without overwhelming the team?
• Considering limited budgets, which approaches have proven most effective for assessing OT risk and targeting high-impact mitigation actions?
• With the OT talent gap growing, what initiatives around talent acquisition, cross-disciplinary training and collaboration can ultimately deliver real value?
• Lastly, what top 3 actions should we prioritize today, with the goal of building long-term cyber resilience?
.
– Moderator: Cynthia Baughman, Water Utilities Technology Director, City of Garland
– Doug Short, CIO & CISO, Trinity River Authority
– Duane Flinchum, Director, Automation Operational Technology, Vantage Data Centers
– Emilie Hudson, VP OT Cybersecurity, BP
– Foad Godarzy, AVP of IT, OT and Information Security, Pattern Energy Group
.