This was supposed to be a textbook case of deploying essential OT cybersecurity. The partner did their homework, approached the customer for a PoC, deployed an industrial EDR in a lab environment and on one of the sites, validated its capabilities, secured the budget and in a few months the customer has purchased the licences for the whole infrastructure.
Then, during the design phase, the team responsible for the actual production lines operation asked a simple question: “How are you so sure that this will not impact the system?”
The deployment was immediately put on hold. The licences had been paid for, but no one could say when – or even if – the system would go live.
This was not a technology failure. It was a governance failure: the system integrator and the security team had tested the product without involving the people who were actually responsible for the environment in which it was supposed to operate.
A successful PoC is not enough
In enterprise IT, a successful PoC is often the last step before procurement. If the product performs as expected, the company proceeds with the rollout.
Operational technology works differently. A production network is not simply another infrastructure segment. It is part of the manufacturing process, where every switch, server and controller may be connected to a running line that operates in a real physical dimension — and it is not just about downtime cost anymore, the real-world damage may happen when things go awry.
For the CISO, a new security platform means expanding visibility into assets and mitigating potential threats. For the head of production, it is an unfamiliar system that someone wants to put on top of the infrastructure that is already operating reliably.
Both perspectives are valid. But if the first actual discussion between security and operations happens after the licences have been purchased, the project management during the PoC has actually failed.
In industrial cybersecurity, it is not enough to prove that the technology works. The deployment must be planned in a way that explicitly ensures zero impact on the production, and every necessary step must be taken to prove to all stakeholders. If the owners of the operational infrastructure first hear about the project during the implementation phase, the company is not buying an outcome—it is buying an expensive governance and possibly technical risk.
The people who could say “no” were never asked
When the production team started to go into the details of the planned deployment, a shower of predictable questions followed.
How would the platform be connected? Does it require Internet connection? Could it create additional network load? Could it load the assets excessively? What would happen if it were misconfigured? How would the company roll back the change? Who would be accountable if the line stopped?
The project team did not have the answers that would be sufficient to alleviate the OT operation team concerns. The production unit therefore chose the safest option available to it: it refused to authorise the deployment until every question had been answered in full with technical proofs if needed.
The result was a familiar corporate paradox. The company had purchased a security platform but could not use it to secure anything. The project still existed on paper, but the investment was effectively stranded: the licence was not producing value, while the expected benefits remained on presentation slides.
Production’s caution has a price tag
From the cybersecurity team’s perspective, the production team’s veto on the project may look like a resistance to changes. But operations leaders are evaluated on actual production output, its quality and the absence of the unplanned downtime – not on how quickly a new security platform is deployed.
Their caution reflects the economics of operational risk. According to IBM, the average cost of a data breach in the industrial sector reached $5.56 million in 2024, while unplanned manufacturing downtime can cost as much as $125,000 per hour. At that price, requiring every change to be planned and reviewed is not technological conservatism. It is basic risk management.
Doing nothing is equally risky. Dragos tracked ransomware activity affecting approximately 3,300 industrial organisations in 2025, with manufacturing accounting for more than two-thirds of the victims. Its incident response team observed significant operational disruption in every OT ransomware case it handled that year.
There should not be a choice between security and uninterrupted production. The objective of a successful project should be incorporating security into the production environment without introducing unacceptable operational risk.
The CISO trap
Projects like this usually begin with good intentions. The CISO identifies a genuine security gap, obtains funding, runs a successful PoC and purchases the technology.
Then the CISO has to explain why the investment produced no result.
Instead of seeing the risks reduced as promised the management sees a technology purchased but never utilised. The CFO asks why the money was spent. Production views the project as an attempt to interfere with their area of responsibility, making further collaboration strained. The cybersecurity team cannot deliver what it had promised and in the worst case scenario it becomes a game of shifting blame amidst ongoing cybersecurity incidents.
This matters because responsibility for OT security is increasingly moving to senior security leadership. In Fortinet’s 2025 survey of more than 550 OT professionals, 52% of organisations said the CISO or CSO was responsible for OT cybersecurity, up from 16% in 2022. Across all C-suite roles, the figure reached 95%.
Greater responsibility does not give the CISO unilateral authority to introduce changes to a production environment. It makes the CISO accountable for creating a governance model that includes the people responsible for production.
Naturally, a failed deployment damages future investments. After paying for a technology that never went live, the company management will view the next cybersecurity initiative with increased scepticism.
The failure happened before procurement
The project did not fail when production refused the deployment. It began to fail when the PoC was run without including all prospective stakeholders and making sure that every one of them had their chance to review the goals, plans and the outcomes of the PoC.
An OT pilot must validate more than product functionality. Before purchasing a licence, the company should know:
- who can authorise the connection to the production network;
- where and how the system will be connected;
- what operational risks it creates;
- who approves the architecture;
- who will respond to alerts;
- how the system will be disconnected or rolled back;
- who is accountable if something goes wrong.
If production and OT engineering were not involved in answering these questions, the PoC was all about the simple technology test. It has not tested the company’s readiness and capability to make the deployment successful.
Rather than focusing the PoC success criteria around the fact that the technology, solution or product works as expected, the outcome of the PoC should be a unified understanding among the cybersecurity, IT, OT engineering and production teams: “We know how to deploy and operate this system to achieve desired outcomes without creating unacceptable risk.”
The lesson
Cybersecurity, engineering and production work with the same industrial assets but are accountable for different outcomes. Security understands the threats. OT engineers understand the infrastructure. Production understands the business impact of every change.
All three must be involved from the beginning — not asked to approve a completed architecture just before launch.
Companies do not lose money only by selecting the wrong technology. They also lose money by buying the right technology but making mistakes in organising the deployment process.
Industrial cybersecurity does not begin with purchasing licences or even having a PoC. But even in the case of deploying solutions everything begins with a mutual understanding and agreement on deployment objectives, plan, expected outcomes and rollback procedures between the the people responsible for security and the people responsible for keeping production running.
If the latter are not at the table, it is too early to spend the money.
