The Air Gap Myth: Why Your Plant Is More Exposed Than You Think

The Air Gap Myth: Why Your Plant Is More Exposed Than You Think

by Industrial Cybersecurity Insider · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Industrial Cybersecurity Insider 👥 208 📅 September 30, 2026 ⏱ 31 min 👁 3 📄 expert opinion 🧭 2026-10-01
Available in: English (current) Français

Keywords

OT securityIT/OT convergenceair gap mythvendor agnosticincident response

Summary

In this podcast episode, host Dino Busalachi interviews Matt Pike from Rockwell Automation about the persistent challenges in industrial cybersecurity. They discuss the historical background of IT and OT convergence, emphasizing that legacy systems were never designed for modern security pressures. The conversation highlights why the IT/OT gap remains open, citing cultural resistance and the misconception that tools alone can solve people and process issues. Pike explains Rockwell’s vendor-agnostic approach to visibility, enabling asset discovery across heterogeneous environments like Siemens, Honeywell, and Emerson. They stress the importance of secure-by-design principles in both greenfield and brownfield projects, and the need to embed cybersecurity language into RFQs and integrator contracts. The discussion covers incident response planning, which is often neglected, and the growing role of AI in both attacks and defenses. Pike debunks the air gap myth, noting that data reaching historians creates unmonitored east-west paths. Finally, they address funding cybersecurity through capital projects and advise starting with asset visibility rather than buying tools, because you cannot secure what you cannot see.

170 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information lies in its practical, real-world perspective from an insider at a major automation vendor. Matt Pike provides concrete examples of common pitfalls, such as CISOs relying on familiar IT tools for OT environments and the absence of response plans. The argumentation is coherent and experience-based, although it is not backed by quantitative data or formal studies. The emphasis on visibility as a prerequisite for security is well-reasoned, and the discussion of AI’s impact on both attackers and defenders adds timely relevance. The reasoning is solid overall, but it remains anecdotal and opinion-driven, limiting its scientific rigor.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite external scientific sources; the only references are the podcast’s own platforms and a corporate cybersecurity page. No peer-reviewed literature or standards bodies are mentioned, though the conversation touches on IEC 62443 as a background standard. The title is accurate, as the air gap myth is a central theme. The content aligns with the title, providing insights that challenge assumptions about plant security. The lack of verifiable sources and the subjective nature of the opinions reduce the overall rigor, but the practical experience of the guest adds credibility within an industry context. No comments were provided to analyze.

218 words

Title / Content Match

The title accurately reflects the core discussion: the air gap is a myth in many plants, and the real exposure lies in hidden assets and poor visibility.

Quality & Reliability

6/10

Podcast interview with an OT security practitioner from Rockwell Automation, offering practical insights based on experience, but lacking formal references or empirical data. The reliability is moderate; the information is subjective and context-dependent.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Contribution & Novelties

The video provides a candid industry perspective on why OT cybersecurity lags behind IT, emphasizing the importance of asset visibility over tool adoption and debunking the common air gap assumption. It advocates for a vendor-agnostic approach and stresses the need for incident response planning. This is a practical contribution to the discourse on industrial cybersecurity, though it is anecdotal rather than research-based.

Pour aller plus loin :

  • IEC 62443 — The international standard for industrial automation and control systems security, referenced implicitly in the conversation.
  • NIST Cybersecurity Framework — A widely adopted framework for improving cybersecurity posture, relevant to the strategic advice given.
  • Air gap (networking) — The concept and its limitations as discussed in the episode.
  • Purdue Enterprise Reference Architecture — A model for OT network segmentation, useful for understanding east-west blind spots.

134 words

Radar Profile

The radar chart shows a balanced profile with moderate scores across quantitative information, quality, technical level, and reliability. The strengths lie in practical qualitative insights, while weaknesses are in formal referencing and empirical data, reflecting the opinion-based nature of the podcast.

Reliability 6/10