In OT, the question isn't what scores worst — it's what measurably reduces loss when tested. That's the through-line of this month's DeNexus OT Cyber Intelligence Newsletter.
Reduce & Validate: controls that move the loss curve. A compensating control without a validated test result is an assertion; with a documented test and a refresh cadence, it becomes risk reduction with an audit trail. This issue breaks down attested vs. tested controls and the six controls OT practitioners say do the most work — two of which aren't controls at all until you've validated them.
OT attacks & industry news. A coordinated campaign hit more than 30 US community water systems, with Forescout identifying 4,407 internet-facing Rockwell/Allen-Bradley controllers exposed across seven states — a real aggregation-risk signal, handled here without overstating the public-health impact. Plus a reported Iran-linked UK power-plant shutdown and what it says about smaller operators.
Regulation moving from advisory to action. Project Watershed 250 pairs public policy with practical water-sector support; the US bulk-power emergency order gives DOE a broader supply-chain intervention tool; and Australia's CI Fortify turns OT isolation into a tested resilience capability rather than a paper control.
Events & research. Upcoming: Fortinet OT Day, the ICS Cybersecurity Conference, and our Sep 16 (CRQ & QVM) webinar, Sep 23 (UWA) webinar — plus four newly published research reports and the DeNexus Learning Hub.
