The UAE-based cybersecurity leader CPX has released a groundbreaking whitepaper, “Securing Operational Technology with Trust and Collaboration” (July 2025), urging a global rethink of how industrial systems are secured. As OT environments become increasingly digitized, the report calls for abandoning IT-centric methods and adopting tailored, trust-based strategies led by multi-disciplinary experts to protect critical infrastructure across MEA and beyond.
Operational Technology (OT) powers the world’s most vital systems from power grids and oil refineries to transportation and healthcare infrastructure. Unlike IT systems, OT environments prioritize availability, safety, and real-time performance. As digital transformation accelerates, convergence with IT, IIoT, and AI introduces new attack surfaces that cannot be protected by conventional security controls.
Cyberattacks like Shamoon (2012) on Saudi Aramco, Triton (2017) targeting petrochemical safety systems, and the Matrix Botnet (2024) weaponizing smart OT devices have reshaped global awareness of OT vulnerabilities.
“OT is not just IT with more wires. Applying unmodified IT controls to OT can cause production halts, equipment damage, or even endanger lives,” the whitepaper cautions.
Real-World Lessons: OT Attacks That Changed Everything
CPX’s report outlines several key incidents that redefined OT security:
- Saudi Aramco (2012): Shamoon wiped 30,000+ workstations.
- Triton (2017): Disabled petrochemical plant safety systems.
- 3CX (2023): Supply chain attack with OT pivot capability.
- Schneider Electric (2024): 40GB of sensitive OT data breached.
- Change Healthcare (2024): Paralysis of U.S. healthcare OT.
- Norwegian Dam (2025): Valve manipulation via weak OT auth.
Each case highlights the consequences of misaligned security assumptions, poor segmentation, and lack of tailored OT frameworks.
Why IT Controls Don’t Work in OT
Misapplied Policies = Industrial Disasters
| IT Control | OT Risk |
|---|---|
| Frequent patching | Can halt critical systems |
| Antivirus agents | Incompatible with legacy controllers |
| Vulnerability scans | May crash fragile devices |
| Blanket compliance policies | Often misaligned and unsafe |
Many organizations rely on IT standards like ISO/IEC 27001 or NIST 800-53, which are ill-suited for OT’s deterministic demands.
The Role of the Trusted Advisor
8 Competencies That Matter
CPX introduces the concept of a “Trusted Advisor” an OT cybersecurity leader who bridges engineering, operations, and risk disciplines. The eight required competencies include:
- Industrial process expertise (e.g., mechanical, electrical).
- Secure digital transformation enablement.
- ICS mastery (SCADA, PLCs, MES, RTUs).
- OT vs IT/IOT/IIOT fluency.
- Risk-based security approaches.
- Tailored classification of OT systems.
- Governance over AI/automated decision tools.
- Pragmatism over perfection.
These advisors anchor trust between CISOs and engineers, guiding realistic and resilient security design.
Engineering Cybersecurity by Design
From Procurement to Production
The whitepaper stresses embedding security early in the EPC (Engineering, Procurement, Construction) lifecycle, aligning with IEC 62443, NIST SP 800-82, and ISO/IEC 30141.
Best Practices:
- Include cybersecurity clauses in RFPs.
- Validate configurations in FAT/iFAT/SAT stages.
- Simulate attack scenarios.
- Align controls to business risk—not just compliance checklists.
The MEA Perspective: Local Relevance, Global Impact
Across the Middle East and Africa, oil, gas, and manufacturing sectors are prime OT targets. The 2017 Triton attack on Saudi petrochemical systems, the increasing digitalization of the UAE’s smart grids, and regulatory efforts like NESA (UAE) and Egypt’s CERT have placed OT security under intense scrutiny.
“Cybersecurity must be embedded in infrastructure projects from day one,” said a CPX spokesperson, emphasizing that secure digital transformation is non-negotiable for economic resilience.
The Case for Collaboration
No One Secures OT Alone
Securing OT demands a multi-stakeholder ecosystem:
- Asset owners provide operational context.
- Vendors and integrators must secure-by-design.
- Cybersecurity providers like CPX and Saintynet Cybersecurity must tailor solutions to OT realities.
- Regulators set sector-specific policies and enable threat intel exchange.
- Academia drives innovation and skills development.
CPX positions IEC 62443 as the lingua franca of OT collaboration, with zoning, roles, and control strength mapping guiding partnership alignment.
10 Proactive Actions for OT Cyber Defenders
- Map all OT assets and dependencies, including shadow systems.
- Segment networks using IEC 62443 zones and conduits.
- Avoid aggressive IT scans on sensitive control systems.
- Develop OT-specific incident response playbooks.
- Train OT and IT teams together in tabletop exercises.
- Choose vendors with secure development lifecycles (IEC 62443-4-2).
- Use outcome-based specs (e.g., “authenticated only” access).
- Invest in behavior-based anomaly detection.
- Simulate real-world threats regularly with red teams.
- Adopt a maturity model to track cybersecurity evolution.
Conclusion: Cybersecurity Is a Shared Responsibility
Securing operational technology is no longer optional it is foundational to industrial safety, economic continuity, and national security. As CPX’s whitepaper makes clear, trust and collaboration must replace outdated compliance checklists. Only through cross-functional engagement, tailored strategies, and empowered Trusted Advisors can organizations adapt to the rising tide of threats in the digital industrial age.
OT cybersecurity isn’t a bolt-on it must be built in, led by those who understand both risk and reality.
Source List
- Securing Operational Technology with Trust and Collaboration – CPX
- IEC 62443 Overview – ISA.org
- NIST SP 800-82 Rev. 2 – ICS Security Guide
- Saudi Aramco Shamoon Attack (2012) – Wired
- Triton Malware Analysis – Mandiant
- Change Healthcare Ransomware Impact – CyberCory.com
- Matrix Botnet Analysis – Bleeping Computer
- CPX Company Overview – CPX.net
