The OT Incident Impact Score and the Value of Near Misses

Klaus Mochalski and OT security veteran ⁠Dale Peterson⁠ (⁠S4 Events⁠) discuss the long-standing discrepancy between predicted cyber doom and the actual lack of catastrophic OT incidents. Discover how the crowdsourced OT Incident Impact Score helps eliminate media FUD, and learn why tracking "near misses" is the true key for asset owners to understand and mitigate real-world threats.

Duration:

25 min

Guest in this episode:

Dale Peterson

OT Security Expert - S4x Events

FAQ

Facts on the topic

Why hasn't the predicted "cyber doom" in OT security happened yet?

Historically, the industry got two major predictions wrong: we overestimated how quickly and effectively we would secure industrial environments but we also vastly overestimated the catastrophic impact of actual cyberattacks. While the threat is real, the reality has shown fewer massive, long-term disruptions than the media and vendors predicted.

What is the OT Incident Impact Score and who is it actually for?

The OT Incident Impact Score is a crowdsourced metric designed to objectively measure the real-world severity of OT security incidents. Interestingly, as Dale Peterson points out, this score isn't meant for seasoned OT security professionals. Instead, it is built to eliminate media FUD (Fear, Uncertainty, Doubt) and give journalists, government officials, and non-technical stakeholders a realistic, hype-free understanding of an incident's actual impact.

How does European regulation factor into measuring OT incident severity?

Modern regulations in Europe (such as NIS2) emphasize that an incident's impact shouldn't just be measured by the initial breach, but by its duration and reach. A minor technical glitch that lasts for days or affects multiple critical sectors can have a far greater societal impact than a deeper breach that is contained within minutes.

Why should OT asset owners track "Near Misses" instead of just actual incidents?

If you only look at successful attacks with a high impact, you are looking at a very small and incomplete dataset. "Near misses" (close calls or failed attack attempts) are the real goldmine for risk analysis. Tracking where adversaries tried to break in and where your defenses just barely held up gives asset owners full transparency and the precise data needed to fix vulnerabilities before a real disaster occurs.