{"$schema": "https://c3voc.de/schedule/schema.json", "generator": {"name": "pretalx", "version": "2026.3.0.dev0", "url": "https://pretalx.com"}, "schedule": {"url": "https://pretalx.com/bsides-ot-uk-2025/schedule/", "version": "0.4", "base_url": "https://pretalx.com", "conference": {"acronym": "bsides-ot-uk-2025", "title": "BSides OT UK 2026", "start": "2026-04-10", "end": "2026-04-10", "daysCount": 1, "timeslot_duration": "00:05", "time_zone_name": "Europe/London", "colors": {"primary": "#012169"}, "rooms": [{"name": "Track 1", "slug": "5578-track-1", "guid": "90704e5d-ed04-5f9a-ba18-e83ae2aa5d43", "description": null, "capacity": null}, {"name": "Track 2", "slug": "5579-track-2", "guid": "bbf7a377-a180-5fc5-b59a-868866a5d5f1", "description": null, "capacity": null}, {"name": "Rookie, Student and Careers Track", "slug": "5453-rookie-student-and-careers-track", "guid": "90e924a3-cb58-5355-ab4b-63e482996712", "description": "Small Lecture Theatre for Rookie, Student and Career Talks", "capacity": null}, {"name": "Workshops", "slug": "5454-workshops", "guid": "d3328c05-007e-5075-9742-ad56901bff4f", "description": "Small Room for Workshops", "capacity": null}, {"name": "Cyber Escape Room", "slug": "5455-cyber-escape-room", "guid": "b6f6cece-1314-58d8-8375-3bd369a31336", "description": "Small Room for Workshops", "capacity": null}], "tracks": [{"name": "Main Track", "slug": "6643-main-track", "color": "#001dff"}, {"name": "Careers Track", "slug": "6644-careers-track", "color": "#0d6401"}, {"name": "Student Track", "slug": "6675-student-track", "color": "#ff0002"}, {"name": "Rookie Track", "slug": "6645-rookie-track", "color": "#6d039c"}, {"name": "Workshop", "slug": "6674-workshop", "color": "#0083a4"}], "days": [{"index": 1, "date": "2026-04-10", "day_start": "2026-04-10T04:00:00+01:00", "day_end": "2026-04-11T03:59:00+01:00", "rooms": {"Track 1": [{"guid": "bcc8fce8-fa8b-5a4c-b6cc-ef8d761121f7", "code": "BCERFV", "id": 93763, "logo": null, "date": "2026-04-10T08:30:00+01:00", "start": "08:30", "end": "2026-04-10T09:00:00+01:00", "duration": "00:30", "room": "Track 1", "slug": "bsides-ot-uk-2025-93763-registration-and-coffee", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/BCERFV/", "title": "Registration and Coffee", "subtitle": "", "track": null, "type": "General", "language": "en", "abstract": "Welcome to BSides OT UK 2026 in Bristol!\n\nCollect your badge, lanyard, and all the swag and head on in for a quick cup of tea/coffee and a pastry before the day begins!\n\nNow's your moment to do some quick hellos to old friends, meet some new people, and review the brilliant schedule to decide your fate for the rest of today!", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/BCERFV/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/BCERFV/", "attachments": []}, {"guid": "a22c4d08-471a-5488-b6a6-2648fab2e571", "code": "GQZD9R", "id": 93764, "logo": null, "date": "2026-04-10T09:00:00+01:00", "start": "09:00", "end": "2026-04-10T09:15:00+01:00", "duration": "00:15", "room": "Track 1", "slug": "bsides-ot-uk-2025-93764-welcoming-remarks", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/GQZD9R/", "title": "Welcoming Remarks", "subtitle": "", "track": null, "type": "General", "language": "en", "abstract": "Welcome to BSides OT UK 2026 in Bristol!\n\nThe team behind today's event will take to the stage to provide information for the remainder of today's activities, and issue an ever-lengthening list of thank yous to everyone involved in making today possible (you included, you lucky thing!).\n\nLet's kick off the first-ever BSides OT UK! \ud83c\udf89", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/GQZD9R/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/GQZD9R/", "attachments": []}, {"guid": "e77e3a57-3d65-5f08-acd8-92e57a9153c0", "code": "J93LEL", "id": 93766, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/J93LEL/image_ixRxDPD.png", "date": "2026-04-10T09:15:00+01:00", "start": "09:15", "end": "2026-04-10T09:55:00+01:00", "duration": "00:40", "room": "Track 1", "slug": "bsides-ot-uk-2025-93766-opening-keynote", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/J93LEL/", "title": "Opening Keynote", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "Our opening keynote for the inaugural BSides OT UK will be delivered by Kevin White.\n\nKevin is the Head of Cybersecurity for the Energy businesses of SSE Group and specialises in Operational Technology.\n\nHe has worked in sectors as diverse as food, nuclear and utilities and in technologies that range from industrial networks to cloud-based analytics. He currently focusses on securing the energy-generating assets of SSE in the race towards NetZero.", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/J93LEL/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/J93LEL/", "attachments": []}, {"guid": "c120abd8-1e11-5f50-9002-63da3fb13ad7", "code": "XBSGRD", "id": 89286, "logo": null, "date": "2026-04-10T10:00:00+01:00", "start": "10:00", "end": "2026-04-10T10:40:00+01:00", "duration": "00:40", "room": "Track 1", "slug": "bsides-ot-uk-2025-89286-square-pegs-and-round-holes-what-actually-works-in-ot-security", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/XBSGRD/", "title": "Square Pegs and Round Holes: What Actually Works in OT Security", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "Having spent several years securing downstream oil infrastructure from cyber attacks, I can confidently say that traditional IT approaches to cyber security do not translate well into OT environments. We can spend a decade trying to force that square peg into a round hole, or we can do something different. After all, have those IT approaches even worked in IT?...\n\nIn this talk I'll take you through several lessons we learned out in the field, securing critical OT infrastructure. We'll talk about how went about securing OT networks, how we utilised zero day vulnerabilities to our advantage, why we don't consider patching systems to be that important, how we handle topics like security testing, and how to implement effective detection capabilities all without disrupting operations or compromising safety.\n\nThis talk is us learning out loud in the field of OT security, sharing our experiences in order to contribute to collective shared wisdom. I hope to leave you with some insights and examples from our own journey that you can take away and use on, and maybe challenge, your own approaches to OT security.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "SEFLM7", "name": "John Fitzpatrick", "avatar": "https://pretalx.com/media/avatars/SEFLM7_aZ7rN1j.webp", "biography": "John has spent many years leading some of the most formidable offensive and defensive cyber teams globally. Currently focused on securing downstream oil infrastructure, his career spans critical industries from finance to defence. Formerly MWR, John is now the founder of Lab539, has the world's largest collection of supercomputer related CVEs, and spends his free time tracking and disrupting AiTM and other adversarial infrastructure.", "public_name": "John Fitzpatrick", "guid": "12b40dc4-f9fd-5985-89f8-4a6e0373db69", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/SEFLM7/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/XBSGRD/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/XBSGRD/", "attachments": []}, {"guid": "0f6e0d6c-6387-5200-a63b-589f68a509b5", "code": "T3HKBL", "id": 89233, "logo": null, "date": "2026-04-10T11:00:00+01:00", "start": "11:00", "end": "2026-04-10T11:20:00+01:00", "duration": "00:20", "room": "Track 1", "slug": "bsides-ot-uk-2025-89233-modernising-ot-in-the-soc", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/T3HKBL/", "title": "Modernising OT in the SOC", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "Modern SOCs are being asked to monitor OT environments that behave nothing like the IT systems they\u2019re used to. This talk cuts through the hype to show what it really takes to bring OT visibility, detection, and response into a SOC without disrupting safety\u2011critical operations. Attendees will leave with a practical, realistic view of how to evolve their SOC for converged IT/OT threats.", "description": "Operational Technology has become the new frontline of cyber risk, yet most Security Operations Centres are still built around IT\u2011centric assumptions, tools, and workflows. As industrial environments modernise\u2014introducing IIoT devices, converged networks, and cloud\u2011connected control systems\u2014the SOC must evolve with them.\n\nBut what does \u201cmodernising OT in the SOC\u201d actually look like in practice?\nThis talk explores the practical, cultural, and architectural shifts required to bring OT visibility, detection, and response into a modern SOC without disrupting the safety\u2011critical environments it protects. We\u2019ll break down the unique challenges of OT telemetry, asset discovery, protocol analysis, and incident response, and contrast them with traditional IT approaches that often fall short. Expect real\u2011world examples, lessons learned from the field, and a candid look at what works\u2014and what absolutely doesn\u2019t\u2014when trying to operationalise OT security.\n\nAttendees will walk away with a clear understanding of:\n- How to build OT\u2011aware detection and response workflows that respect operational constraints\n- Why traditional SIEM/SOAR approaches struggle with OT data\u2014and how to adapt them\n- The role of passive monitoring, network segmentation, and ICS\u2011specific threat intelligence\n- How to align engineers, operators, and SOC analysts around shared outcomes\n- Practical steps for maturing OT security without requiring a full rip\u2011and\u2011replace\n\nWhether you're an OT engineer, SOC analyst, or security leader, this session will give you a grounded, realistic roadmap for bringing OT into the SOC in a way that\u2019s safe, scalable, and future\u2011ready.", "recording_license": "", "do_not_record": false, "persons": [{"code": "MSNQTC", "name": "Andi Hudson", "avatar": null, "biography": "Andi is Kyndryl\u2019s Global Security Operations & Response Portfolio Lead, shaping how organisations worldwide modernise their SOC, detection, and incident\u2011response capabilities. With deep experience across IT and OT, Andi is known for turning complex operational challenges into clear, effective security outcomes", "public_name": "Andi Hudson", "guid": "f5739c55-61df-56bc-99c6-e09355db65b3", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/MSNQTC/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/T3HKBL/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/T3HKBL/", "attachments": []}, {"guid": "73f2d21b-f9cb-5413-8e09-4a86b3189d96", "code": "LH3TPR", "id": 89918, "logo": null, "date": "2026-04-10T11:25:00+01:00", "start": "11:25", "end": "2026-04-10T11:45:00+01:00", "duration": "00:20", "room": "Track 1", "slug": "bsides-ot-uk-2025-89918-do-you-even-bench-bro", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/LH3TPR/", "title": "Do you even bench, bro?", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "In a world of AI slop and next-gen nonsense, how do you know the thing you bought is actually secure? How do you firewall the unfirewall-able?\n\nThis is a love letter to bench testing and vulnerability research in an industry where transparency never trends. You'll see intended functionality abused for firmware-level backdoors, controller logic swapped with segregation-busting implants, and why \"secure\" in OT just means \"nobody looked too closely (yet)\".\n\nIn short: 2 basement gremlins, 1 crusty PLC, and unlimited Monster.", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "MZMHBV", "name": "Adam Bromiley", "avatar": "https://pretalx.com/media/avatars/MZMHBV_Ht5laAg.webp", "biography": "Adam is a security consultant at Pen Test Partners who specialises in industrial control systems and embedded hardware security. He's worked on everything safety-critical: from high-speed rail to aircraft, power stations, and gas distribution. His embedded work has seen him break driverless cars, slot machines, and drones and has led to the responsible disclosure of numerous vulnerabilities in industrial controllers. Adam enjoys hands-on and boots-on-the-ground testing, reverse engineering, and providing practical security advice for complex real-world systems.", "public_name": "Adam Bromiley", "guid": "5bb3f48d-e745-5892-aef6-5fa92b20b56f", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/MZMHBV/"}, {"code": "VB9VCC", "name": "Sam Thom", "avatar": "https://pretalx.com/media/avatars/VB9VCC_Me1BOcI.webp", "biography": "Sam is a security consultant at Pen Test Partners who focuses on the weird stuff - hardware, IoT and Operational Technology. He's poked and prodded Industrial and embedded systems across various industries like automotive, IoT, IIoT, chemical, water, power, gas, manufacturing and his favourite of all - the alcohol industry. Sam enjoys tearing down operational systems on the bench almost as much as owning them in the field.", "public_name": "Sam Thom", "guid": "a3622b95-f6bf-5df6-877d-ad460d94c2cd", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/VB9VCC/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/LH3TPR/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/LH3TPR/", "attachments": []}, {"guid": "d1f9a331-6935-5bd4-bd01-af8e8680c5e5", "code": "8XA8QV", "id": 85812, "logo": null, "date": "2026-04-10T12:00:00+01:00", "start": "12:00", "end": "2026-04-10T12:40:00+01:00", "duration": "00:40", "room": "Track 1", "slug": "bsides-ot-uk-2025-85812-acme-windpharm", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/8XA8QV/", "title": "Acme Windpharm", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "The talk will cover the basics of windfarms and their operations, I\u2019ll briefly discuss prior research in this area, noting that those findings are still valid today. Then the core of this talk will focus on identified security threats and their mitigations based on real life assessments. The impact these threats can have both in terms of windfarm operation and the physical damage that can be caused. I will show how physical and remote access to the windfarm can be gained, and by investigating the vulnerabilities found, I will show that there is an over-reliance on security boxes and buzzword solutions that has left general, basic, security hygiene lacking. So much so that that in some cases, not only have systems not been patched, but they were installed insecurely in the first place. I will then discuss the recent 2019 UK outage and the part played by windfarms in that, from the initial outage to their impact on restoration as a result of how micro generation is modelled within control systems.\n\nThere will be two key takeaways from this talk. Firstly, I will be busting the myth that \u2018cutting off the supply\u2019 is the most interesting attack that can be performed. It is the most likely, and one of the simplest attacks, but it is not the most interesting. Secondly, I will cover a point often glossed over in other talks. When an attacker \u2018takes control\u2019 it is often simply left at that, as if taking control was the \u2018win condition\u2019. This talk will cover some of the more interesting cyber physical attacks that can be performed on a wind farm and look at some of the ways that actual physical damage could be caused.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "APZZDG", "name": "Colin Cassidy", "avatar": "https://pretalx.com/media/avatars/APZZDG_iJ5yX6z.webp", "biography": "Colin Cassidy used to be a senior software engineer at GE for 15 years working on their Distribution Management System (DMS) which runs most of the UK's electrical distribution network.  He is currently atoning for all his software development sin as a Principal security consultant with IOActive.   Colin has performed a number of security audits for ICS operators including one of the UKs largest Distribution Network Operators, several windfarms, container ships, shipping terminals, and AMI/smart meter infrastructure. Colin has also presented and Blackhat and Defcon on vulnerabilities found in Industrial Ethernet Switches.  In his spare time, he searches for spare time.", "public_name": "Colin Cassidy", "guid": "2b8f5c32-d9bd-5279-b06b-f952742c8b00", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/APZZDG/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/8XA8QV/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/8XA8QV/", "attachments": []}, {"guid": "6699646f-5811-5420-bb7f-b7fdf52e8e13", "code": "D3EXLF", "id": 89836, "logo": null, "date": "2026-04-10T13:40:00+01:00", "start": "13:40", "end": "2026-04-10T14:20:00+01:00", "duration": "00:40", "room": "Track 1", "slug": "bsides-ot-uk-2025-89836-beyond-isolation-modern-ot-needs-modern-defences", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/D3EXLF/", "title": "Beyond Isolation: Modern OT Needs Modern Defences", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "The threats facing Operational Technology our outpacing the delivery of secure solutions in our critical infrastructure. Organisations deploying OT must now accept that connectivity is no longer an edge-case, and the \u201cwalled garden\u201d model no longer reflects the way our industrial environments operate. To accelerate transformation and meet the threat we must challenge some of these beliefs to build critical infrastructure suitable for a modern threat environment.\n\nIn this talk, David G2 a NCSC Cyber Physical Security Architect will introduce explain the context behind three new pieces of NCSC guidance - **Creating and Maintaining a Definitive View of Your OT Architecture**, **Secure Connectivity Principles for OT**, and **PAWs for OT**. Articulating how these documents fit together to support a realistic, defensible security posture for modern industrial environments.\n\nDo not fear this won\u2019t be a guidance recital.\n\nThis talk aims to challenge some long\u2011held beliefs, exploring why the traditional prioritisation of Availability, Integrity and Confidentiality (AIC) is often poorly suited to modern OT environments; why safety considerations are more nuanced than simply being \u201cthe most important factor\u201d; how patching can be possible in practice; and how isolation is frequently misunderstood. We will examine why these beliefs emerged, what threats they can blind organisations to, and how they limit our ability to modernise, operate efficiently, and defend at scale\n\nThe aim is for attendees to leave with:\n- A practical model for understanding their OT estate, as a system not just as assets.\n- Pragmatic approaches for securely enabling necessary connectivity rather than creating bespoke routes for all new connectivity.\n- Why Privileged Access Workstations (PAWs) matter more than ever and how they translate to the OT environment.\n- Clear, achievable steps for uplifting brownfield environments without waiting for the next lifecycle refresh.\n- A forward-looking vision that looks for operators to demand more of their vendors and integrators, drives vendors to raise their security baseline, and creates space for startups to innovate rather than replicate the past.\n\nThe threats are already here, the the old rules won't save us.", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "CA9VQT", "name": "David G2", "avatar": null, "biography": "I am a NCSC Senior Cyber Physical Security Architect with experience supporting major CNI projects across multiple sectors including electricity, water and gas. I have also led the production of several Operational Technology (OT) focused pieces of NCSC guidance including Privileged Access Workstations (PAWs), Creating and maintaining a definitive view of your operational technology (OT) architecture, Secure connectivity principles for operational technology (OT) and Cloud-hosted supervisory control and data acquisition (SCADA).", "public_name": "David G2", "guid": "adc52a07-56ba-56cb-ac98-7643944f59a7", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/CA9VQT/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/D3EXLF/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/D3EXLF/", "attachments": []}, {"guid": "35b3457c-21c8-598b-908e-bba764f7de97", "code": "ZJL8CG", "id": 88183, "logo": null, "date": "2026-04-10T14:20:00+01:00", "start": "14:20", "end": "2026-04-10T14:40:00+01:00", "duration": "00:20", "room": "Track 1", "slug": "bsides-ot-uk-2025-88183-lessons-learned-from-the-yard-greenfield-projects-are-hard-too", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/ZJL8CG/", "title": "Lessons Learned from the Yard (Greenfield projects are hard too)", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "Implementing ICS/OT cybersecurity in greenfield projects should be easier than existing brownfield projects. However, greenfield projects present their own challenges to implementing ICS/OT cyber security, especially if not properly planned. Chris will present challenges and lessons learned implementing ICS/OT cybersecurity on multiple large and complex offshore greenfield projects.", "description": "Attendees will gain a better understanding of the unique challenges faced implementing ICS/OT cybersecurity on capital projects.", "recording_license": "", "do_not_record": false, "persons": [{"code": "SSVRT8", "name": "Christopher Robinson", "avatar": "https://pretalx.com/media/avatars/SSVRT8_fbOl4MO.webp", "biography": "Chris Robinson is an Offensive Security Certified Professional (OSCP) and Global Industrial Control Systems Professional (GICSP) with an advanced Computer Science degree and years of Information Technology (IT) and Operational Technology experience specializing in IT and Industrial Control Systems (ICS) cybersecurity.\n \nChris is Principal Consultant focusing on OT/ICS cybersecurity at DNV Cyber and an instructor for SANS Institute, teaching the ICS410 (ICS/SCADA Security Essentials) course and is a co-author for the ICS612 (ICS Cyber Security In-Depth) course. Chris is experienced in conducting penetration tests, security assessments, and network architectures for ICS systems such as electricity generation and transmission, automotive manufacturing systems, mass telecommunications systems, and chemical processing. Additionally, Chris is an expert assessor, helping clients design program and strategies, improving IT/ICS cybersecurity in accordance with IEC 62443, NIST 800-82, NIST CSF, and NERC CIP. Chris regular presents at various cybersecurity industry events on multiple topics, such as penetration testing and IEC 62443.", "public_name": "Christopher Robinson", "guid": "a130f3d9-bf3f-56f9-91a1-223057bc1fcc", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/SSVRT8/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/ZJL8CG/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/ZJL8CG/", "attachments": []}, {"guid": "2e7dcb5b-537e-5edb-a747-dc0d8909a348", "code": "QYFGZB", "id": 89872, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/QYFGZB/image_hmQG8KC.webp", "date": "2026-04-10T14:40:00+01:00", "start": "14:40", "end": "2026-04-10T15:00:00+01:00", "duration": "00:20", "room": "Track 1", "slug": "bsides-ot-uk-2025-89872-insider-attack-below-the-detection-threshold-in-water-treatment-ot", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/QYFGZB/", "title": "Insider Attack below the Detection Threshold in Water Treatment OT", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "Insider threats in water treatment plants are often misunderstood as overt acts of sabotage. In reality, the most credible risk comes from low and slow actions that stay below detection thresholds.\n\nThis short talk examines real-world case studies of insider activity in critical national infrastructure, introduces a simplified water treatment process model, and explores attacker goals such as water quality degradation, service disruption, and loss of public trust. We\u2019ll walk through plausible attack scenarios that do not trigger alarms, signature-based detection, or traditional IT security controls.\nThe session concludes with practical countermeasures focusing on process aware monitoring, assurance techniques that work in live OT environments and signposts a supporting white paper for deeper technical detail.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "UEV7FT", "name": "Andy Richings", "avatar": null, "biography": "I\u2019m Andy Richings, a Principal Security Engineer at Synoptix, working on Secure by Design projects for defence, space, and critical national infrastructure. I focus on threat modelling, cyber assurance, and security architecture for complex software and OT-adjacent systems, including water treatment environments. My work is about making cyber risk visible, traceable, and manageable in systems society depends on.", "public_name": "Andy Richings", "guid": "bf11d001-165b-5ea5-89c9-6a87a5ee3d95", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/UEV7FT/"}, {"code": "TLMUFM", "name": "Sarad", "avatar": null, "biography": "Researcher at Swansea University", "public_name": "Sarad", "guid": "b2e0a21a-5ae8-5d95-aeeb-dfa530ae1a8a", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/TLMUFM/"}, {"code": "VUL3BA", "name": "George Edmond", "avatar": null, "biography": "2 years at Synoptix\n4 years of Cyber Security", "public_name": "George Edmond", "guid": "e4c364f8-cc26-5c2d-829a-77392011aa6d", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/VUL3BA/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/QYFGZB/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/QYFGZB/", "attachments": []}, {"guid": "81b77994-c161-5206-93b4-6188edc9fb73", "code": "RSN7HX", "id": 88534, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/RSN7HX/magnet_quench_1_6_RLarcXC.webp", "date": "2026-04-10T15:20:00+01:00", "start": "15:20", "end": "2026-04-10T16:00:00+01:00", "duration": "00:40", "room": "Track 1", "slug": "bsides-ot-uk-2025-88534-when-absolute-zero-gets-too-hot-to-handle-cyber-risks-for-cryogenic-failure-in-mri", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/RSN7HX/", "title": "When absolute zero gets too hot to handle - Cyber Risks for Cryogenic Failure in MRI", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "What if the superconducting magnet of an MRI machine breached containment?\n\nWhat if the checks and controls of an MRI machine are connected to the network?\n\nIn this short talk I explore the cyber-physical risks of cryogenic systems, with the particular example of MRI superconducting magnets.\n\nMRI magnets rely on cryogenic cooling - liquid helium near absolute zero - to maintain superconducting magnetic fields. Superconducting relies on the coil being so cold that it has no electrical resistance, so massive currents (hundreds of amps) can flow through it and sustain magnetic fields almost hundreds of thousands of times that of the Earth. If that coolant warms up at any point the superconducting property is lost, the conductor becomes resistive and heats up, and a truly vicious cycle of heating and increasing resistance develops so the nitrogen or helium boils - called a 'quench'. The boiled gas is hundreds of times bigger than the liquid so creates intense pressure: so much that your ears will probably pop but worse, you probably can't open the door: and it forces the oxygen out of the room so you suffocate, while also getting instant frostbite. The collapse of the magnetic field can stress the magnet's structure and permanently damage the coils: which cost tens of thousands of pounds to replace while you lose weeks worth of imaging throughput. Even a controlled quench costs thousands and risks damage. These things are prevented by failsafe systems: constant monitoring, automatic venting, secure supply chains, early warnings, regular maintenance and checks.\n\nBut what if they're not? What if someone or something interferes with the complex and supposedly resilient supply chain and safety monitoring systems? Then small anomalies can cascade and we have cryogenic bombs waiting to go off.\n\nCryogenics is now a cyber\u2011physical risk surface: pervasive networking and the Internet of Things now means system failures - through accident or attack - can cause failures in ordering systems, delivery delays, failing fail-safes so that Operational Technology is increasingly exposed to cyber risks in cryogenic monitoring and control.\n\nThe mitigations are obvious - and routine - but we all know that awareness and caution are not at all routine in cyber security, and restating the obvious is part of the toolbox of any cyber security professional so I will discuss mitigations including diversified helium and spares strategy, raised refill thresholds, network segmentation, encrypted telemetry with certificate lifecycle management, MFA for vendors, runtime physics\u2011based validation of sensor data, \u201calarm\u2011the\u2011silence\u201d watchdogs, manual overrides, and blended quench\u2011plus\u2011cyber table-top drills, as useful tools that can help prevent incidents and avoid us breaking out into a sweat about liquid helium.", "description": "What if the superconducting magnet of an MRI machine breached containment?\n\nWhat if the checks, controls and fail-safes of an MRI machine are connected to the network?\n\nIn this short talk I explore the cyber-physical risks of cryogenic systems, with the particular example of MRI superconducting magnets.\n\nMRI magnets rely on cryogenic cooling - liquid helium near absolute zero - to maintain superconducting magnetic fields. If the cooling system fails the liquid helium boils: if safety systems work, it should vent safely but if they don't, the cold gas can fill the room with such pressure that the doors probably won't open, the oxygen is forced out so anyone trapped inside suffocates while getting frostbite. These risks are rare because we have containment systems, monitoring and fail-safes: but what if someone or something interferes with those systems? Then small anomalies can cascade and we have cryogenic bombs waiting to go off.\n\nCryogenics is now a cyber\u2011physical risk surface: pervasive networking and the Internet of Things now means system failures - through accident or attack - can cause failures in ordering systems, delivery delays, failing fail-safes so that Operational Technology is increasingly exposed to cyber risks in cryogenic monitoring and control. In this talk I explore those risks, their mitigations, and summarise safe practices that can avoid us breaking out into a sweat about liquid helium.", "recording_license": "", "do_not_record": false, "persons": [{"code": "NPM9UF", "name": "Chris Bore", "avatar": "https://pretalx.com/media/avatars/NPM9UF_j0opIUu.webp", "biography": "Chris has a PhD in MRI from the early days before it was called that: and a subsequent career that swirled around signal processing, security, and medical imaging systems. Now mostly retired he enjoys attending, and sometimes speaking at, BSIDES events.", "public_name": "Chris Bore", "guid": "3c97e92d-5cd7-5db2-877d-0a1ed8db8f9d", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/NPM9UF/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/RSN7HX/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/RSN7HX/", "attachments": []}, {"guid": "fcbfb1f0-3c1d-5740-b2ae-0b7201b97ee6", "code": "JDANZB", "id": 88809, "logo": null, "date": "2026-04-10T16:00:00+01:00", "start": "16:00", "end": "2026-04-10T16:40:00+01:00", "duration": "00:40", "room": "Track 1", "slug": "bsides-ot-uk-2025-88809-mind-the-gap-security-on-paper-reality-on-the-wire", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/JDANZB/", "title": "Mind the Gap: Security on Paper, Reality on the Wire", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "In OT environments, it is easy for cybersecurity programs to look robust on paper, but what happens when those same environments are put under the lens provided by a penetration test? In this talk we examine the results of pairing an OT Cybersecurity Maturity Assessment with an OT Penetration Test at the same facility, revealing a consistent pattern: the documented controls and expected risk posture don\u2019t match what is actually happening on the wire.\n\nWe will walk through anonymized case studies across several sites at multiple organizations in multiple geographical locations, highlighting that the results we expected based on governance were not always upheld by the reality we found with technical assessments. The goal of this talk is to demonstrate how  gaps can form between OT security program standards and actual operational reality. Attendees will walk away with practical recommendations on how to test and validate expectations and risk.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "CXYTNP", "name": "Mandie Grosskopf", "avatar": "https://pretalx.com/media/avatars/CXYTNP_pjuSpXU.webp", "biography": "Mandie has a passion for expanding traditional InfoSec governance to include complex and non-traditional environments, including OT, IoT, IoMT, IIoT, and more. She leads governance design and expansion across sectors such as Healthcare, Manufacturing, Maritime, and Pharmaceuticals, with a strong focus on incident response and post-incident remediation. Mandie also supports clients through gap analysis and strategic roadmap development as they work towards compliance with the EU Cybersecurity Resiliency Act.\n\nMandie currently holds certifications in GIAC Response and Industrial Defense (GRID), Network+, Security+, Cybersecurity Analyst+, and Security Analytics Professional.", "public_name": "Mandie Grosskopf", "guid": "793fec80-f32c-5a47-b42f-848d3964f630", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/CXYTNP/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/JDANZB/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/JDANZB/", "attachments": []}, {"guid": "b75b037c-b637-5b07-ac25-a0d3feb8a6c0", "code": "R7KGEJ", "id": 93760, "logo": null, "date": "2026-04-10T17:00:00+01:00", "start": "17:00", "end": "2026-04-10T17:40:00+01:00", "duration": "00:40", "room": "Track 1", "slug": "bsides-ot-uk-2025-93760-ot-security-a-national-security-perspective", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/R7KGEJ/", "title": "OT Security: A National Security Perspective", "subtitle": "", "track": null, "type": "Panel", "language": "en", "abstract": "**No photos or recording for this session. Chatham House Rule.**\n\nA panel with representatives across government, regulators, and industry.", "description": "", "recording_license": "", "do_not_record": true, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/R7KGEJ/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/R7KGEJ/", "attachments": []}, {"guid": "a87cd275-5adc-5399-92bf-a1b0dd6be0c3", "code": "MW8DCP", "id": 93765, "logo": null, "date": "2026-04-10T17:40:00+01:00", "start": "17:40", "end": "2026-04-10T18:00:00+01:00", "duration": "00:20", "room": "Track 1", "slug": "bsides-ot-uk-2025-93765-closing-remarks-raffle-drawing", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/MW8DCP/", "title": "Closing Remarks & Raffle Drawing", "subtitle": "", "track": null, "type": "General", "language": "en", "abstract": "Phew! What a day!\n\nThe BSides OT UK organising team will take to the stage to close out an awesome day, and to draw the raffle prizes - tickets at the ready!\n\nAs a reminder, all the proceeds from the raffle and the sticker stall go to our chosen charity - [The Bristol Children's Hospital Grand Appeal]([url](https://www.grandappeal.org.uk/)) - so please donate what you can, pick up some great new stickers for your laptop, and be in with the chance of winning some brilliant raffle prizes!", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/MW8DCP/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/MW8DCP/", "attachments": []}, {"guid": "38beac40-15f7-5f52-91a2-a73dacc76bfc", "code": "XWMKJK", "id": 93767, "logo": null, "date": "2026-04-10T18:30:00+01:00", "start": "18:30", "end": "2026-04-10T19:00:00+01:00", "duration": "00:30", "room": "Track 1", "slug": "bsides-ot-uk-2025-93767-after-party", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/XWMKJK/", "title": "After Party", "subtitle": "", "track": null, "type": "General", "language": "en", "abstract": "The after-party will begin at 6:30 at a nearby venue, only a few minutes' walk from the main conference venue. The location of the after-party will be announced during the closing remarks. There is a sizeable bar tab thanks to our after-party sponsors, Pen Test Partners. All attendees are welcome to attend! Make sure you keep and wear your badge; the bar staff will use it to identify attendees. Food will not be provided, but a good range of food is available to order (note that this will not be covered on the bar tab).", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/XWMKJK/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/XWMKJK/", "attachments": []}], "Track 2": [{"guid": "bf4c0c91-f0ea-5b09-8f6a-d822a2f316b6", "code": "RKQGMQ", "id": 88509, "logo": null, "date": "2026-04-10T10:00:00+01:00", "start": "10:00", "end": "2026-04-10T10:40:00+01:00", "duration": "00:40", "room": "Track 2", "slug": "bsides-ot-uk-2025-88509-ot-ownership-myths", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/RKQGMQ/", "title": "OT Ownership Myths", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "Attendees will leave able to ask more informed, stronger questions of suppliers, read assurance claims with appropriate scepticism, and make more defensible decisions about OT risk in the real world. They will gain a better understanding of where control sits in OT environments, how supplier relationships and commercial structures shape security outcomes, and why many common assumptions and frameworks around ownership, responsibility, and governance collapse in practice.\n\nThe talk explores common myths around ownership: that asset owners control patching and change, that contracts offer meaningful protection, that assurance means security, and that responsibility aligns with authority. It examines how dependency, inertia, lifecycle constraints, vendor power, and incentives often dictate security posture far more than policy or wishful thinking, and offers practical ways to reframe discussions and challenge supplier narratives.", "description": "You'll leave this session better equipped to examine supplier claims, make sense of assurance artifacts, and reason more clearly about OT supply chain risk.\n\nWe'll examine ownership myths in OT environments: ideas like \"well we can just patch it\", \"the contract protects us\", or \"we've done our due diligence\". It looks at how real-world constraints from vendor dependency to long system lifecycles often shape outcomes far more than frameworks or policy.\n\nInstead of yet another checklist of controls, we'll focus on building a more realistic model of how OT ecosystems actually function, so you can ask better questions, assess suppliers more effectively, and make stronger decisions.", "recording_license": "", "do_not_record": false, "persons": [{"code": "EGDQ3T", "name": "James Bore", "avatar": "https://pretalx.com/media/avatars/EGDQ3T_mqfy1Gw.webp", "biography": "James Bore is a security consultant, speaker, and writer with a particular interest in risk, systems, and how security works (or fails) in practice. His work spans cyber security, critical infrastructure, and supply chain risk, and he is known for taking a sceptical, systems-focused approach rather than a checklist-driven one.\n\nHe regularly speaks at community events including BSides, writes on security and risk, and spends an unreasonable amount of time designing tiny board games.", "public_name": "James Bore", "guid": "7e8e9217-609e-57d3-a2f9-527876d5dbff", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/EGDQ3T/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/RKQGMQ/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/RKQGMQ/", "attachments": []}, {"guid": "4d8b863e-2857-5104-9834-47cbd700d625", "code": "CWZKFV", "id": 89216, "logo": null, "date": "2026-04-10T11:00:00+01:00", "start": "11:00", "end": "2026-04-10T11:20:00+01:00", "duration": "00:20", "room": "Track 2", "slug": "bsides-ot-uk-2025-89216-grayzone-warfare-from-it-systems-to-ot-effects", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/CWZKFV/", "title": "Grayzone Warfare: From IT Systems to OT Effects", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "In Grayzone Warfare: From IT Systems to OT Effects, Ian Thornton\u2011Trump CD examines how modern cyber conflict operates in the space \u201cbetween peace and war,\u201d where adversaries pursue strategic advantage without crossing traditional thresholds of armed conflict. Using his established insights into hybrid warfare and cyber\u2011physical risk, Thornton\u2011Trump reveals how attacks that begin in enterprise IT environments increasingly cascade into operational technology (OT), critical infrastructure, and industrial control systems.\n\nThis session presents cyber incidents as components of intentional grayzone campaigns that blend espionage, disruption, economic coercion, and psychological pressure. Thornton\u2011Trump demonstrates how weaknesses in identity systems, supply chains, governance, and security visibility are exploited to bridge IT and OT, turning digital access into real\u2011world consequences\u2014including safety risks, service disruption, and national\u2011level instability.\n\nUltimately, this presentation challenges leaders and security professionals to view cyber defense as a matter of operational safety and geopolitical reality\u2014recognizing and countering grayzone activity before IT compromise becomes irreversible OT impact.", "description": "Here are my key takeaways: \n\nCyber Conflict Now Lives Below the Threshold of War\nModern adversaries deliberately operate in the grayzone\u2014conducting cyber operations that avoid attribution, legal response, or escalation.\n\nIT Compromise Is the Gateway to OT Impact\nAttacks rarely begin in industrial environments. Instead, identity systems, remote access, supply chains, and poorly governed enterprise IT are used as ingress points, allowing adversaries to pivot toward operational technology. \n\nCyber Effects Are Increasingly Physical and Strategic\nGrayzone cyber operations can produce real\u2011world outcomes including service disruption, equipment damage, environmental harm, and public loss of trust. These effects deliver strategic leverage while maintaining plausible deniability, making them powerful although limited tools of state and proxy actors alike.\n\nDefenders Must Think Like Strategists, Not Just Technicians\nEffective defense requires understanding attacker intent, dwell time, and campaign objectives\u2014not just indicators of compromise.", "recording_license": "", "do_not_record": false, "persons": [{"code": "JPPBC8", "name": "Ian Thornton-Trump CD", "avatar": "https://pretalx.com/media/avatars/JPPBC8_Hv3oEH7.webp", "biography": "Ian Thornton-Trump CD is an ITIL certified IT professional with 30 years of experience in IT security and information technology. From 1989 to 1992, Ian served with the Canadian Forces (CF), Military Intelligence Branch; in 2002, he joined the CF Military Police Reserves and retired as a Public Affairs Officer in 2013. After a year with the RCMP as a Criminal Intelligence Analyst, Ian worked as a cyber security analyst/consultant for multi-national insurance, banking, and regional health care verticals. With a deep background in cyber threat intelligence Ian was previously the CISO for Cyjax Ltd., a UK based threat intelligence provider to enterprise customers. As a CISO at Inversion6 Ian\u2019s role is to spearhead the efforts to duplicate the success of Inversion6 USA by offering fractional CISO and advanced cyber security solutions in the UK and EU markets. Ian has deep experience with the threats facing small, medium and enterprise businesses. His research and experience have made him a sought-after cyber security consultant specialising in building security operations providing services as a vCISO, and sharing his passion for building effective threat intelligence programs for small, medium, and enterprise organisations.", "public_name": "Ian Thornton-Trump CD", "guid": "57c5d939-4ce4-566b-9bb9-d513935a751a", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/JPPBC8/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/CWZKFV/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/CWZKFV/", "attachments": []}, {"guid": "98a663ba-ba9f-51df-961d-447f65f17b54", "code": "FS7LKR", "id": 87751, "logo": null, "date": "2026-04-10T11:25:00+01:00", "start": "11:25", "end": "2026-04-10T11:45:00+01:00", "duration": "00:20", "room": "Track 2", "slug": "bsides-ot-uk-2025-87751-what-your-it-response-playbook-gets-wrong-about-ot", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/FS7LKR/", "title": "What Your IT Response Playbook Gets Wrong About OT.", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "Your incident response playbook has been battle-tested through countless IT security incidents. You know the drill, isolate compromised systems, preserve evidence, rebuild from known-good baselines. But in operational technology environments, these same best practices can be catastrophic.\n\nThis talk examines the dangerous assumptions that IT security teams make when responding to OT incidents in critical national infrastructure. Through real-world scenarios, we'll explore why standard IR practices, from immediate network isolation to credential resets, need fundamental rethinking when dealing with industrial control systems. Learn what happens when you try to \"pull the plug\" on a system controlling safety mechanisms, why forensic imaging a 15-year-old PLC isn't an option, and how to navigate the tension between investigation needs and operational reality.\n\nThis session will challenge your assumptions and provide practical frameworks for adapting your IR methodology before an incident puts them to the test.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "BSV87X", "name": "James John", "avatar": "https://pretalx.com/media/avatars/BSV87X_X3IFHv5.webp", "biography": "James is a Chartered Incident Response Professional with extensive expertise in Digital Forensics and Incident Response (DFIR). Certified by SANS, he brings over nine years of specialised experience to the field, having conducted both criminal and civil forensic investigations across public and private sectors.\n\nJames spearheads the strategic development of Bridewell's proactive and reactive incident response services, driving team growth and service innovation across critical national infrastructure, finance, hospitality, defence and government clients. His leadership encompasses strategic planning, team development, and service line expansion for UK and US markets.", "public_name": "James John", "guid": "e68a8375-209b-5982-8b43-381f7f6a3ba7", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/BSV87X/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/FS7LKR/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/FS7LKR/", "attachments": []}, {"guid": "db029180-6449-58f9-97e2-19c709531378", "code": "YBPBFN", "id": 89920, "logo": null, "date": "2026-04-10T12:00:00+01:00", "start": "12:00", "end": "2026-04-10T12:40:00+01:00", "duration": "00:40", "room": "Track 2", "slug": "bsides-ot-uk-2025-89920-scada-protocol-security-what-is-the-answer-and-why", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/YBPBFN/", "title": "SCADA Protocol Security - What Is The Answer And Why?", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "Presentation will discuss practical aspects of SCADA protocol security, and includes work from my MSc In Ethical Hacking & Cybersecurity dissertation \"Enumeration and Attack Tools for the DNP3 SCADA Protocol Used in the Energy Industry\"\n\nTopics covered:\nWhat SCADA protocols are and where are they used\nWhy some of them are inherently insecure\nHow threat actors have used SCADA protocols to compromise real OT systems\nTechnical coverage of DNP3 including:\n* Overview of DNP3 protocol\n* Demonstration of custom tools (replicating threat actor capabilities):\n\t* How DNP3 can be enumerated\n\t* MITM data manipulation attacks compromising data integrity\n\t* Direct protocol injection commands\n\t* Details on DNP3 specific security settings\nGeneral practical measures to improve the security of SCADA systems", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "P78XF3", "name": "Dave Gunn", "avatar": null, "biography": "OT Security Specialist currently working within UK utilities industry. Previous experience working directly with SCADA / ICS in both utilities and oil & gas sectors.", "public_name": "Dave Gunn", "guid": "73661932-0214-5dc6-a6d8-ce7739c4ac29", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/P78XF3/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/YBPBFN/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/YBPBFN/", "attachments": []}, {"guid": "d4c3ee77-15b3-5809-b25f-96f5b60a610d", "code": "LSFGHC", "id": 88481, "logo": null, "date": "2026-04-10T13:40:00+01:00", "start": "13:40", "end": "2026-04-10T14:20:00+01:00", "duration": "00:40", "room": "Track 2", "slug": "bsides-ot-uk-2025-88481-getting-into-ot-security-on-a-budget-from-software-simulations-to-practical-ranges", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/LSFGHC/", "title": "Getting Into OT Security on a Budget: From Software Simulations to Practical Ranges", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "Industrial Control Systems and Operational Technology security is a growing field, but the barrier to entry remains prohibitively high. Commercial PLCs cost hundreds of pounds, training courses run into thousands, and purpose-built lab equipment can rival the price of a small car. This leaves aspiring OT security researchers stuck reading theory without hands-on practice.\n\nThis talk charts a practical journey from zero to a functional OT security lab without breaking the bank.\nWe begin with purely software-based approaches using OpenPLC and PyModbus to simulate industrial environments on hardware you already own. From there, we graduate to Arduino and microcontroller-based solutions, which run real PLC logic on inexpensive development boards. We then enhance these setups with LEDs, switches, and physical I/O to visualize ladder logic execution in real-time, making abstract concepts tangible.\n\nTo bring industrial processes to life, we explore 3D-printed models of substations, pumpjacks, and conveyor systems that respond to PLC outputs, creating compelling demonstrations without the need for large industrial budgets. \n\nWe also navigate the second-hand market for genuine PLCs and HMIs, discussing the licensing pitfalls, firmware challenges, and security considerations that await bargain hunters.\n\nFinally, we announce the open-source release of the ModPwn Challenge Board a Raspberry Pi Pico-based Modbus challenge board - a complete attack and visualisation platform buildable for under \u00a315, enabling anyone to practice Modbus protocol attacks and visualise the inputs and output. \n\nAttendees will leave with practical blueprints, parts lists, and open-source tools to build their own OT security labs immediately.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "7YMRXB", "name": "KevTheHermit", "avatar": "https://pretalx.com/media/avatars/7YMRXB_hDZe5D3.webp", "biography": "Kev Breen currently serves as Senior Director of Cyber Threat Research at Immersive, where he helps organizations assess, build, and prove their Cyber Workforce Resilience. He is a renowned expert on new and emerging threats.\n \n\nPrior to his time at Immersive, Breen spent 15 years in the military with the Royal Signals, starting as a radio technician repairing radio electronics and communications, before moving on to digital networks specialising as a malware analyst protecting UK MOD networks against cyber attacks. With over two decades of experience in IT and cybersecurity, Breen has learned the tradecraft for defensive, offensive, and deceptive cyber operations.\n\u200d\n\nBreen has conducted extensive open-source research, including creating and releasing toolkits for network defenders, mainly for malware analysis and decryption, as well as writing the YARA rules, which are still recommended by VirusTotal. Breen\u2019s open-source research gets a lot of attention, not only from the cybersecurity community, but also from the threat actors themselves.", "public_name": "KevTheHermit", "guid": "ff8bff39-b116-5963-b72d-e185bb36cfa7", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/7YMRXB/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/LSFGHC/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/LSFGHC/", "attachments": []}, {"guid": "3281c7f1-aadc-5585-a81e-7f8c462f94ca", "code": "FBQWJP", "id": 90075, "logo": null, "date": "2026-04-10T14:20:00+01:00", "start": "14:20", "end": "2026-04-10T14:40:00+01:00", "duration": "00:20", "room": "Track 2", "slug": "bsides-ot-uk-2025-90075-explaining-ot-cyber-to-the-board-was-hard-enough-then-the-regulator-asked-for-evidence", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/FBQWJP/", "title": "Explaining OT Cyber to the Board Was Hard Enough: Then the Regulator Asked for Evidence", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "Operational Technology (OT) cyber risk is one of the few topics where you can brief three audiences\u2014engineers, the Board, and a regulator\u2014and still feel like you\u2019ve spoken three different languages.\n\nThis talk is about that translation problem. I\u2019ll share a practical way to explain OT cyber risk at leadership level (without turning it into either a Hollywood script or \u201cit\u2019s just IT\u201d), and how the complexity increases when you also need to provide confidence to an external overseer\u2014without over-promising, name-dropping frameworks, or producing a one-off \u201cassurance pack\u201d that nobody maintains.\n\nWe\u2019ll cover:\n\nWhy OT is different in ways that matter to governance: safety, availability, lifecycle, and constraints that are genuinely non-negotiable\n\nThe Board narrative vs the regulator narrative: what changes, what must stay consistent\n\nWhat credible evidence looks like (and what looks like security theatre)\n\nThe small set of artefacts that do most of the work: ownership, asset visibility, remote access, segmentation, monitoring, incident readiness\n\nHandling the awkward questions (\u201cSo are we safe?\u201d, \u201cIs it compliant?\u201d, \u201cWhat\u2019s our worst day?\u201d) with honesty and momentum\n\nNo war stories and no named organisations\u2014just patterns, pitfalls, and a set of reusable structures you can take back to your own environment.", "description": "The translation problem (why OT cyber becomes garbled between technical reality and governance language)\n\nThree audiences, three needs\n\nEngineering: reduce risk without breaking operations\n\nBoard: decisions, trade-offs, investment, accountability\n\nRegulator/overseer: confidence, evidence, progress, proportionality\n\nA simple story you can reuse (risk framing that works in leadership settings)\n\nEvidence that matters (what to show, how to show it, how to avoid theatre)\n\nPractical \u201cnext 90 days\u201d (what moves the needle most reliably)", "recording_license": "", "do_not_record": false, "persons": [{"code": "TBJ9DD", "name": "David Jones", "avatar": "https://pretalx.com/media/avatars/TBJ9DD_nkSHdY3.webp", "biography": "David is an experienced Non-Executive, currently on the Board of Ofwat and Chair at DVLA.\nPreviously, he's been on the Board of Ofcom, amongst many other Non-Executive roles.\n\nI help boards and regulators navigate cyber risk and fast-moving technology where regulation, governance and geopolitical realities intersect.\n\n(NOTE: David is speaking in a Personal capacity, not in his role at Ofwat)", "public_name": "David Jones", "guid": "bff1ba86-161d-5b51-ac29-ea0517751aaf", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/TBJ9DD/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/FBQWJP/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/FBQWJP/", "attachments": []}, {"guid": "4df926b1-cdbc-53ea-95c2-5e4e369c5bf7", "code": "TBYEYY", "id": 89530, "logo": null, "date": "2026-04-10T14:40:00+01:00", "start": "14:40", "end": "2026-04-10T15:00:00+01:00", "duration": "00:20", "room": "Track 2", "slug": "bsides-ot-uk-2025-89530-crazy-about-product-security-navigating-the-cyber-resilience-act", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/TBYEYY/", "title": "CRAzy about Product Security  - Navigating the Cyber Resilience Act", "subtitle": "", "track": null, "type": "Main Track - Short Talk", "language": "en", "abstract": "The European Cyber Resilience Act (CRA) represents one of the most significant regulatory shifts in product cybersecurity to date\u2014particularly for operators and manufacturers of operational technology. This talk provides a practical, experience\u2011driven exploration of what the CRA means for OT environments and the emerging landscape of product security regulation.\n\nAttendees will gain a clear understanding of the CRA\u2019s objectives, lifecycle\u2011oriented security requirements, vulnerability reporting obligations and conformity assessment pathways. The session will map CRA requirements to existing frameworks highlighting both areas of alignment and critical gaps that OT manufacturers and integrators must address.\n\nThe talk will also examine the CRA\u2019s timeline, expected industry impact, and how organisations can turn regulatory pressure into opportunities by strengthening SDLC processes, maturing vulnerability handling (including SBOM and coordinated disclosure), and building scalable security testing capabilities. \n\nFinally, the session offers insights into preparing for the next 24 months of uncertainty and rapid change, including the role of harmonised standards, CE marking challenges, and strategic considerations for both internal teams and clients navigating compliance.\n\nThis presentation provides OT security professionals with a roadmap for readiness\u2014grounded in regulatory expertise, industrial experience, and a focus on enabling secure\u2011by\u2011design products in a fast\u2011evolving European regulatory landscape.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "JQPUFK", "name": "Zachary Sleath", "avatar": "https://pretalx.com/media/avatars/JQPUFK_JjYpM1b.webp", "biography": "Zachary Sleath is an OT Cyber Security Consultant with over five years of experience supporting industrial and critical national infrastructure organisations. He graduated from the University of Portsmouth with a BSc in Cyber Security and Forensic Computing, and he currently works at Bureau Veritas Cybersecurity. Zachary\u2019s expertise spans governance, risk and compliance (GRC), network architecture, vulnerability management, and third\u2011party risk management (TPRM). His work focuses on helping organisations strengthen their cyber resilience, embed security\u2011by\u2011design practices, and navigate complex regulatory landscapes across the OT and product\u2011security domains.", "public_name": "Zachary Sleath", "guid": "c246d8d7-1dec-5a7c-95fb-c6039a105f59", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/JQPUFK/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/TBYEYY/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/TBYEYY/", "attachments": []}, {"guid": "048ada6c-32b8-5398-8263-029eba55dcba", "code": "WBKRE3", "id": 88479, "logo": null, "date": "2026-04-10T15:20:00+01:00", "start": "15:20", "end": "2026-04-10T16:00:00+01:00", "duration": "00:40", "room": "Track 2", "slug": "bsides-ot-uk-2025-88479-why-ot-security-fails-on-the-factory-floor-and-how-to-make-it-stick", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/WBKRE3/", "title": "Why OT Security Fails on the Factory Floor, and How to Make It Stick", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "Most OT security failures don\u2019t happen because the technology was wrong, they happen because the security programme didn\u2019t fit how manufacturing actually operates.\n\nThis session focuses on the operational and organisational reality of embedding OT security in live production environments, drawing on experience leading a \u00a397m global OT security programme across 77 manufacturing sites. Rather than centring on attack mechanics, the talk explores what it truly takes to introduce security into environments where uptime, safety, and throughput are non-negotiable.\n\nAttendees will learn how OT security initiatives succeed or fail based on governance alignment, decision-making authority, and cultural adoption on the shop floor. The presentation examines common friction points: engineering resistance, unclear ownership between IT and operations, security controls that disrupt maintenance, and change processes that collapse under incident pressure.\n\nThrough real-world examples, the session shows how organisations can shift OT security from a bolt-on technical function into an embedded operational capability. It explores how to design security programmes that engineers trust, operators understand, and leadership supports, without slowing production or increasing risk.\n\nThe talk also addresses how resilience is built over time through repeatable processes, training, and scenario-based planning, rather than one-off tool deployments. It concludes with a forward-looking view of how emerging threats, regulatory pressure, and supply chain complexity make operational resilience a board-level responsibility.\n\nAttendees will leave with:\n\nA clear understanding of why OT security programmes succeed or fail operationally\n\nPractical approaches to aligning security with engineering and production priorities\n\nChange-management strategies that work in industrial environments\n\nInsight into building resilience through people, process, and governance \u2014 not just tools\n\nActionable ideas for embedding security into day-to-day operations without disrupting uptime\n\nThe session will include interactive discussion and open Q&A, allowing participants to share challenges, compare approaches, and leave with practical, real-world insights they can apply immediately.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "FWY3JN", "name": "John Allen", "avatar": "https://pretalx.com/media/avatars/FWY3JN_MTPmt49.webp", "biography": "John Allen is a senior OT and industrial cybersecurity leader with over two decades of experience securing complex manufacturing and critical infrastructure environments.\n\nHe previously served as Global Vice President of OT Security at GSK, where he led a \u00a397m global OT security programme spanning 77 manufacturing and research sites worldwide. In this role, John was responsible for embedding OT security across live production environments, balancing cyber risk reduction with safety, uptime, regulatory compliance, and operational efficiency.\n\nJohn\u2019s career has been shaped by working directly with engineers, operators, and plant leadership to turn security strategy into operational reality. His experience spans global governance design, large-scale OT security transformation, incident response in production environments, and the cultural change required to make security sustainable on the factory floor.\n\nToday, John advises manufacturers and critical infrastructure organisations through Harpoon Consulting, where he sits as Co-Founder of the organisation, helping them design and embed practical, operations-first OT security programmes that actually work in the real world. He is known for his ability to translate security risk into operational and business impact, and for challenging approaches that look good on paper but fail in production.\n\nJohn is a regular speaker at specialist security events, where his sessions consistently receive strong feedback for being honest, practical, and grounded in real-world end-user experience rather than theory or vendor-driven narratives.", "public_name": "John Allen", "guid": "e16643b3-0d2e-5cd2-8397-01406450785d", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/FWY3JN/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/WBKRE3/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/WBKRE3/", "attachments": []}, {"guid": "159a5655-b5f9-54f6-a9bc-2ee45d4c870f", "code": "EYYJ8Z", "id": 88956, "logo": null, "date": "2026-04-10T16:00:00+01:00", "start": "16:00", "end": "2026-04-10T16:40:00+01:00", "duration": "00:40", "room": "Track 2", "slug": "bsides-ot-uk-2025-88956-breaking-the-air-gap-covert-command-and-control-attacks-on-industrial-systems", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/EYYJ8Z/", "title": "Breaking the Air Gap: Covert Command and Control Attacks on Industrial Systems", "subtitle": "", "track": null, "type": "Main Track - Long Talk", "language": "en", "abstract": "Command and Control Servers have long existed for IT facing networks. They are the central infrastructure which allow adversaries to maintain persistent remote control over compromised systems and orchestrate large-scale cyberattacks. What if adversaries brought these tactics to OT?\n\nThis presentation explores the creation of C2 infrastructure specifically for OT Networks, using the OPC UA protocol as the example. We can examine how the OPC UA protocol can be abused to enable covert data exfiltration from airgapped networks, and how we can connect to an OPC UA server to create persistent command channels that blend with legitimate industrial traffic. Through a practical demonstration using Factory I/O and containerized PLCs, this presentation reveals the techniques adversaries could use to maintain covert control over industrial systems while evading traditional security monitoring.", "description": "As OT environments become increasingly connected, the security assumptions that protected air-gapped systems are eroding. This presentation examines how adversaries can adapt IT-based Command and Control techniques to operational technology networks, with a specific focus on abusing the OPC UA protocol. \n\nWe'll explore the technical mechanics of creating covert C2 channels with OPC UA communications, demonstrating how legitimate industrial protocols can be weaponized for data exfiltration and persistent control. Using a simulated industrial environment with Factory I/O and containerized PLCs, attendees will see firsthand how these attacks operate within realistic OT contexts. \n\nTopics include:\nFundamental differences between IT and OT C2 infrastructure requirements\nOPC UA protocol structure and abuse opportunities\nTechniques for blending malicious traffic with legitimate industrial communications\nDetection challenges / defensive considerations.", "recording_license": "", "do_not_record": false, "persons": [{"code": "R8ZNRD", "name": "James Sabin", "avatar": null, "biography": "James Sabin is a security researcher specializing in OT adversary emulation and industrial control systems networking. Currently completing his degree in Cybersecurity and Digital Forensics at the University of the West of England, he focuses on ICS/OT protocol analysis and the development of open-source tools for operational technology security research.", "public_name": "James Sabin", "guid": "85bc9cf2-9d4a-5b7a-ba89-9b6c83b0c453", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/R8ZNRD/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/EYYJ8Z/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/EYYJ8Z/", "attachments": []}], "Rookie, Student and Careers Track": [{"guid": "52f84c1b-364c-5e68-ac7a-9a23917c9930", "code": "W3GSMN", "id": 89215, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/W3GSMN/Slide_1_-_The_Exp_aKop46Y.webp", "date": "2026-04-10T10:00:00+01:00", "start": "10:00", "end": "2026-04-10T10:20:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89215-fixing-the-front-door-securing-ot-remote-access-without-killing-production", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/W3GSMN/", "title": "Fixing the Front Door: Securing OT Remote Access Without Killing Production", "subtitle": "", "track": null, "type": "Rookie Track", "language": "en", "abstract": "Remote access keeps OT environments running, but it also concentrates risk. Many incidents do not start with a sophisticated Programmable Logic Controller (PLC) exploit. They start at the \u201cfront door\u201d: vendor VPNs, jump hosts, shared support accounts, and rushed identity checks during outages. According to the SANS State of ICS/OT Security 2025 findings, about half of ICS/OT incidents begin with unauthorised external access, often through third-party remote maintenance.\n\nThis 20-minute talk shows how to secure OT remote support without breaking production. Using a simple \u201cfront door path\u201d diagram (Vendor \u2192 Remote Access \u2192 Jump Host \u2192 Engineering/HMI), we cover two repeatable failure areas: 1) remote access pathways that become broader or more permanent than intended, and 2) identity/support workflows that expand access under operational pressure. For each, we pair the risk with practical controls that work in legacy OT environments: time-boxed vendor access, least-privilege support identities, and a safety-aware \u201cnormal vs emergency\u201d access lane that preserves availability while improving accountability.\n\nWe close with three high-fidelity monitoring signals you can implement even in legacy OT environments: authentication anomalies, interactive remote logons, and privilege/role changes. I\u2019ll map these signals to common jump-host and remote-access setups, and include one worked example from Windows event logs (e.g., 4624/4625, RDP logon type 10, 4728/4732). We finish with an actionable OT access plan that attendees can apply immediately.", "description": "Key Takeaway for Attendees:\n\n- A clear \u201cfront door\u201d remote access path model for OT (diagram-led)\n\n- Controls that work under OT constraints: time-boxed access, least privilege, and a safety-aware normal vs emergency access lane\n\n- Three high-fidelity jump host monitoring signals using basic Windows logs (4624/4625 patterns, RDP logon type 10 anomalies, privileged group changes)\n\n- A short, actionable OT access plan to implement without disrupting operations\n\nAudience: OT/ICS engineers, plant IT, SOC/IR supporting OT, vendors/integrators, and anyone interested in actionable knowledge transfer.", "recording_license": "", "do_not_record": false, "persons": [{"code": "38UUCG", "name": "Richard Dosumu", "avatar": "https://pretalx.com/media/avatars/38UUCG_l4KRhxr.webp", "biography": "Richard Dosumu is a cybersecurity practitioner, Founder at OctaTech, and an independent researcher focused on practical security in real-world environments. He holds an MSc in Cyber Security & Human Factors and writes educational cybersecurity content on Medium and LinkedIn, with a particular interest in making security guidance usable under operational pressure. His published research spans the intersection of AI, cybersecurity, and Industry 4.0/manufacturing, exploring how modern systems introduce new risks and control challenges. He is also involved with the OWASP Bristol organising community and is committed to sharing actionable, defensible approaches that teams can implement without disrupting critical operations.", "public_name": "Richard Dosumu", "guid": "9c3884c9-00e7-55ac-a843-69da7139cb77", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/38UUCG/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/W3GSMN/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/W3GSMN/", "attachments": [{"title": "A diagram-led, 4-slide visual summary of the talk showing the OT remote-access \u201cfront door\u201d risk path, the two-lane access model, emergency-lane guardrails, and a practical 5-week implementation plan", "url": "/media/bsides-ot-uk-2025/submissions/W3GSMN/resources/BSides__dXcSY5I.pptx", "type": "related"}]}, {"guid": "3c518841-601e-52ee-b0f2-933d7fc88e9e", "code": "9XADNA", "id": 89882, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/9XADNA/Soft_Skills_MwyjE_G4SVloo.webp", "date": "2026-04-10T10:20:00+01:00", "start": "10:20", "end": "2026-04-10T10:40:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89882-soft-skills-in-a-hard-hat-world-why-communication-is-one-of-the-most-critical-ot-security-controls", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/9XADNA/", "title": "Soft Skills in a Hard-Hat World: Why Communication is One of the Most Critical OT Security Controls", "subtitle": "", "track": null, "type": "Rookie Track", "language": "en", "abstract": "Operational Technology (OT) environments are people-first systems, where operators, engineers, vendors and security teams are making real-time decisions that directly impact safety, production and business continuity/uptime. For example, when incidents occur, technical controls alone are rarely the deciding factor, whereas communication is. \n\nThis talk aims to explore why \"soft skills\" such as risk translation, negotiation and de-escalation are actually safety-critical OT security controls. Drawing on experiences common to women in cyber and OT roles, the session will aim to highlight how skills often labelled as \"non-technical\" directly impacts safety, resilience and uptime (Why women often develop these skills early.). Rather than focusing solely on incidents, the talk aims to examine the everyday decisions and interactions that determine whether OT security controls are adopted, ignored or bypassed. The talk will also look at practical moments that define OT security success (i.e. managing vendor relationships where tone matters more than technical accuracy). \n\nThe aim is to have attendees leave with a reframed understanding of OT security maturity, where human communication, coordination and trust are recognised as essential components of effective risk management.", "description": "The skills we call \"soft\" are often the ones holding OT security together\n\nThis talks looks at OT environments as people-first systems and explores how communication, negotiation and trust directly affect risk assessments, supply chain security and day-to-day OT security decisions. It examines why authority in OT is built through credibility and relationships rather than job titles, and how security outcomes are shaped in meetings as much as technical controls.\n\nGrounded in real OT security work and experiences common to women in OT and cyber roles, the session reframes so-called \"soft-skills\" as operational risk controls that materially impact safety and resilience.", "recording_license": "", "do_not_record": false, "persons": [{"code": "AFWDXM", "name": "Fiona Kastrati", "avatar": "https://pretalx.com/media/avatars/AFWDXM_yxQlcZU.webp", "biography": "Fiona Kastrati is a cyber security consultant specialising in OT security, risk assessments, supply chain management and incident response preparedness. With extensive experience in bridging the gap network security teams, engineers and operational staff, she helps translate technical risk into actionable strategies. She is an advocate for women in OT and cyber, championing the skills and perspectives they bring into shaping resilient, safe and efficient systems.", "public_name": "Fiona Kastrati", "guid": "002e76a6-df09-5f16-9187-03aef32271fe", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/AFWDXM/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/9XADNA/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/9XADNA/", "attachments": []}, {"guid": "777e84d2-b466-556b-a1ae-1a617a230011", "code": "839MA7", "id": 89915, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/839MA7/Copy_of_Keeping_4_T6cmEOc.webp", "date": "2026-04-10T11:00:00+01:00", "start": "11:00", "end": "2026-04-10T11:50:00+01:00", "duration": "00:50", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89915-creating-offensive-and-defensive-tools-for-ot-ics-with-genai", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/839MA7/", "title": "Creating Offensive and Defensive Tools for OT/ICS with GenAI", "subtitle": "", "track": null, "type": "Workshop", "language": "en", "abstract": "Attackers are using GenAI to get better at what they do.  Why aren't more of us as defenders?  \n\nThe truth is that the majority of OT/ICS enviornments have limited (to no) budgets for OT/ICS cybersecurity.  And yet, we're expected to continue to do more with less.  GenAI platforms can act as the great equalizer and help us successfully defend our environments - and it doesn't have to be difficult!  This session will walkthrough creating both offensive and defensive tools for OT/ICS environments, providing detailed prompts to help YOU secure OT/ICS!", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "VUQGPM", "name": "Mike Holcomb", "avatar": "https://pretalx.com/media/avatars/VUQGPM_9mBsQS7.webp", "biography": "Mike Holcomb is an independent consultant and an educational content creator focused on OT/ICS cybersecurity . Prior to supporting clients full-time through UtilSec, he was the Fellow of Cybersecurity and the OT/ICS Cybersecurity Global Lead for one of the world\u2019s largest engineering and construction companies, providing him with the opportunity to work in securing some of the world\u2019s largest OT/ICS environments, from power plants and commuter rail to manufacturing facilities and refineries. \n\nAs part of his community efforts, Michael founded the BSidesICS/OT with multiple events planned globally in 2026. He has his master\u2019s degree in OT/ICS cybersecurity from the SANS Technology Institute. Additionally, he maintains cyber security and OT/ICS certifications such as the CISSP, GRID, GICSP, GCIP, GPEN, GCIH, ISA 62443, and more.\n\nHe was awarded the SANS Difference Maker Award for Practitioner of the Year: ICS/OT Defender for 2025.\n\nHe posts regularly on LinkedIn and YouTube to help others learn more about securing OT/ICS and critical infrastructure.\n\nYou can find out more information about Mike and his resources at mikeholcomb.com.", "public_name": "Mike Holcomb", "guid": "e73aa9e7-384e-5477-8375-cb875cfcf771", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/VUQGPM/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/839MA7/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/839MA7/", "attachments": []}, {"guid": "4b51af27-783b-5cfb-b745-c79ec92126ba", "code": "XKVN8M", "id": 89935, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/XKVN8M/cds_PVsKm0C_UjpLylA.webp", "date": "2026-04-10T12:00:00+01:00", "start": "12:00", "end": "2026-04-10T12:20:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89935-from-currys-to-classified-20-cross-domain-solutions", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/XKVN8M/", "title": "From Currys to Classified: \u00a320 Cross Domain Solutions", "subtitle": "", "track": null, "type": "Rookie Track", "language": "en", "abstract": "Cross domain solutions are the gold standard for bridging air-gapped networks, a classic example being between IT and OT networks. Specialist and often with an eye-watering price tag they are mostly out of reach of security researchers and tinkerers alike, but what if you could build something using the same fundamental principles for the price of a round of drinks?", "description": "In this talk we'll take a \u00a310 unmanaged network switch and, using a CH341A programmer, modify its EEPROM to change its behaviour. By configuring port isolation masks we can prevent ports from talking back to one another, creating a firmware defined data diode.\n\nThe diode is just the one-way valve; a cross domain solution needs to handle more complicated data flows. This is where we'll spend our remaining \u00a310 on a microcontroller with an ethernet port and just enough firmware to manage a protocol break and some data verification.\n\nWhether you are securing a power plant, or just here to bully cheap silicon into doing your bidding, this talk will demonstrate implementing cross domain fundamentals can be done on a shoestring budget.", "recording_license": "", "do_not_record": false, "persons": [{"code": "9TYDBC", "name": "Laurence Halfpenny", "avatar": "https://pretalx.com/media/avatars/9TYDBC_k4oiwYZ.webp", "biography": "# Who is this guy?\n- Software Engineer of 6 years\n- Preacher of Rust \ud83e\udd80\n- Worked in **cross domain**, electronic warfare and now aerospace\n- Rare MG / Rover enthusiast", "public_name": "Laurence Halfpenny", "guid": "5f1554fb-09d3-527b-a1a1-19d068748654", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/9TYDBC/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/XKVN8M/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/XKVN8M/", "attachments": []}, {"guid": "13df0b88-2f78-5dc2-ab27-67b11d939b1c", "code": "Z7XUUH", "id": 90151, "logo": null, "date": "2026-04-10T12:20:00+01:00", "start": "12:20", "end": "2026-04-10T12:40:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-90151-beyond-alerts-diagnosing-and-improving-situational-awareness-in-industrial-systems", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/Z7XUUH/", "title": "Beyond Alerts: Diagnosing and Improving Situational Awareness in Industrial Systems", "subtitle": "", "track": null, "type": "Student Track", "language": "en", "abstract": "Security analysts or operators know that an intrusion occurred but they often cannot answer these critical questions: Which physical processes are threatened? How will the attack evolve? What is the attacker likely to do next? Your security tools detect the attack, but critical context is missing. This gap, between technical detection and operational understanding, represents a fundamental blind spot in industrial security approaches.", "description": "This talk will introduce a structured methodology called AESICS, which reconceptualizes adversary emulation exercise as a diagnostic instrument for iterative ICS defense improvement. We will discuss how the framework can help analysts to systematically identify multi-dimensional situational awareness gaps and design targeted defensive enhancements to close those gaps. \n\nWe also introduce SIMPLE ICS (Simulated Industrial Multi-tier Platform for Laboratory Emulation of Industrial Control Systems) testbed, a sector-agnostic, Purdue-aligned industrial testbed architecture that models modern industrial environments. We will present the result from the AESICS using this testbed and empirically test the methodology for quantifying and assessing defensive improvement based on the AESICS methodology.\n\nThroughout the session, we will walk through:\n- A reusable industrial testbed architecture guide using SIMPLE ICS.\n- A structured diagnostic approach you can implement immediately, turning vague \u2018improve security\u2019 into specific quantifiable security improvement.\n- A quantified metrics framework for measuring situational awareness gaps.", "recording_license": "", "do_not_record": false, "persons": [{"code": "DDTF77", "name": "M. Endhy Aziz", "avatar": null, "biography": "With more than 10 years of professional experience in security, I am now pursuing a PhD for further study.", "public_name": "M. Endhy Aziz", "guid": "e71cb0ea-6d2f-5ffc-aec0-d9848c8ea007", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/DDTF77/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/Z7XUUH/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/Z7XUUH/", "attachments": []}, {"guid": "0e8e0d8c-66b2-5334-889b-5c3395796083", "code": "QVYJ8A", "id": 89840, "logo": null, "date": "2026-04-10T13:40:00+01:00", "start": "13:40", "end": "2026-04-10T14:00:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89840-dynamic-risk-assessment-for-critical-national-infrastructures", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/QVYJ8A/", "title": "Dynamic Risk Assessment For Critical National Infrastructures", "subtitle": "", "track": null, "type": "Student Track", "language": "en", "abstract": "This talk addresses the challenges Critical National Infrastructures (CNIs) face during on-going adversarial campaigns as they could cause physical damaged and even threaten life. Defenders struggle to keep CNIs operational (albeit at reduced capacity) whilst they try to wipe attackers out of their systems. By monitoring network telemetry, we will explore how we can identify in near-real-time different ways a campaign could escalate to an unsafe state and place the minimum mitigations required to keep CNIs operational.", "description": "Since Critical National Infrastructures (CNIs) have become one of the main targets for nation state threat actors, keeping them both safe and operational during an adversarial campaign is particularly challenging. Especially the increase of their interconnectivity with Internet devices is exposing them to even more potential attack paths, making risk identification and consequently incident handling impossible. Traditional risk assessment methods fall short to address the rapidly evolving nature of vulnerability landscape. Hence, there is a need for a near-real-time dynamic risk assessment approach which aims to keep a CNI operational during an on-going attack, albeit at reduced capacity, by applying the minimum necessary mitigations. We suggest a model which identifies how/if an adversarial campaign could potentially escalate to an unsafe state of the CNI, such as physical damage or threatening life, and isolates the part of the network that could lead to such escalation. This approach combines Fault Tree Analysis, Dempster-Shafer Theory and the MITRE ATT&CK framework for deriving a near-real-time model which can adapt while an attack unfolds.", "recording_license": "", "do_not_record": false, "persons": [{"code": "79XUZM", "name": "Kostas Anastasakis", "avatar": null, "biography": "PhD student in Cybersecurity at University of Bristol", "public_name": "Kostas Anastasakis", "guid": "ab807a74-4158-5a70-a7a5-00792a857e78", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/79XUZM/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/QVYJ8A/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/QVYJ8A/", "attachments": []}, {"guid": "c7780a00-8850-5f0f-aa75-0efba89be262", "code": "X7HVZQ", "id": 89196, "logo": null, "date": "2026-04-10T14:00:00+01:00", "start": "14:00", "end": "2026-04-10T14:20:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89196-industrial-honeypots-challenges-and-research-opportunities", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/X7HVZQ/", "title": "Industrial Honeypots Challenges and Research Opportunities", "subtitle": "", "track": null, "type": "Student Track", "language": "en", "abstract": "A short exploration of industrial honeypot research in its current state, including what popular solutions look like; what function they perform; how cyber deception benefits industrial control systems; what challenges their deployment; and what future research could look like in this area. Despite being a defensive technology, this talk will address honeypot research from both an offensive and defensive perspective.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "BTGHJL", "name": "Jacob Williams", "avatar": "https://pretalx.com/media/avatars/BTGHJL_sgXDaV0.webp", "biography": "I'm a PhD student at the Bristol Cyber Security (TIPs-at-Scale) Centre for Doctoral Training. My primary area of research is the application of honeypots in industrial control systems, focusing on the optimal design and testing of individual deployments. Before this I worked in a Security Operations Centre. I pivoted into industrial control systems because I love the physical engineering aspect of it and a passion to secure the infrastructure that people use in their every day life.", "public_name": "Jacob Williams", "guid": "e335311d-2b81-5051-b546-3640bdc502fc", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/BTGHJL/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/X7HVZQ/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/X7HVZQ/", "attachments": []}, {"guid": "9c606d88-b314-5350-9eb3-c197c4c0a652", "code": "8HY9MZ", "id": 89267, "logo": null, "date": "2026-04-10T14:20:00+01:00", "start": "14:20", "end": "2026-04-10T14:40:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89267-speaking-their-language-an-engineer-s-guide-to-the-safety-security-divide", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/8HY9MZ/", "title": "Speaking Their Language: An Engineer's Guide to the Safety-Security Divide", "subtitle": "", "track": null, "type": "Careers Track", "language": "en", "abstract": "Amy is a Chartered Engineer with over 15 years' experience applying hardware cybersecurity principles across telecommunications, IoT, medical devices, transportation, and operational technology. This breadth of client work informs her current portfolio of consultancy, advisory, and NED roles. She is currently working with Kry10 on their verified seL4-based operating system for OT environments.\n\nIn this talk, Amy will draw on her experience securing safety-critical systems and explain why an engineering background creates valuable common ground when working in someone else's OT environment. She will offer practical advice on bridging the safety-security divide and discuss how Chartered Engineer status has helped her build trust and reduce barriers.", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "UVWPFA", "name": "Amy Brooks", "avatar": "https://pretalx.com/media/avatars/UVWPFA_zWFeM6n.webp", "biography": "Amy is a Chartered Engineer specialising in cyber and information security, with deep expertise in Operational Technology, IoT, and semiconductors. She provides consultancy and advisory services across critical national infrastructure sectors, helping organisations navigate complex risk landscapes.\nHer strategic thought leadership spans semiconductor microprocessor architecture, automotive technology, and safety-critical cyber-physical systems. This cross-sector experience gives her a distinctive perspective on securing the technologies that underpin modern infrastructure.\nBeyond her consultancy work, Amy is passionate about building the next generation of cyber professionals. She was a founding contributor to the CyberFirst Girls competition and remains actively involved in STEM outreach through the Cheltenham STEM community, FameLab, and Women in Technology initiatives.", "public_name": "Amy Brooks", "guid": "6d3e1952-615f-5695-be95-adfa7f387dc9", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/UVWPFA/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/8HY9MZ/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/8HY9MZ/", "attachments": []}, {"guid": "6cde43aa-1bb0-5516-979e-339b643c9bf8", "code": "QSNB8R", "id": 89587, "logo": null, "date": "2026-04-10T14:40:00+01:00", "start": "14:40", "end": "2026-04-10T15:00:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89587-enable-don-t-obstruct-building-an-ot-security-career-that-actually-works", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/QSNB8R/", "title": "Enable, Don't Obstruct: Building an OT Security Career That Actually Works", "subtitle": "", "track": null, "type": "Careers Track", "language": "en", "abstract": "OT security careers rarely follow neat, linear paths. This talk begins with the personal transition from Associate Professor of Cyber Security to Senior OT Security Consultant as a case study in how non-traditional career moves can become a strategic advantage rather than a risk.\n\nDrawing on experience across academia, consulting, and live operational environments, this session explores what actually builds credibility in OT security roles. It examines how demonstrating tangible operational impact earns trust with decision makers, why human factors are just as important as technical controls in OT, and how security decisions get made when safety and availability outweigh confidentiality. The talk also explores why cyber exercises are crucial to building organisational resilience.\n\nThis is not a \u201cwhich cert should I get next?\u201d talk. Instead, it's about developing the mindset and skills that make OT security professionals effective in environments where production can't stop, downtime is measured in millions, and your credibility determines whether security recommendations become implementation plans or left at the side of the road. It is also about recognising how experience in teaching, research, or consulting strengthens your position.\n\nFor students, career switchers, and practitioners feeling stuck, this talk offers a practical reframing: OT security rewards curiosity, breadth, and time spent in uncomfortable environments. If your career choices help you enable operations instead of obstruct them, you\u2019re building the kind of experience the field actually needs.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "3TE8EK", "name": "RichardS", "avatar": null, "biography": "Dr. Richard Smith is a Senior OT Security Consultant at Bureau Veritas, specialising in the intersection of industrial resilience and cyber-physical security. Formerly an Associate Professor of Cyber Security at De Montfort University, Richard has spent his career bridging the gap between theoretical research and the operational realities of critical infrastructure. His expertise spans the full security lifecycle from initial risk assessment to high-pressure incident response.\nRichard is a firm believer in \"learning by doing.\" He has designed and built hybrid cyber ranges to facilitate complex security exercises and has showcased the real-world impact of OT vulnerabilities as a demonstrator at global stages like DEFCON and RSA. His mission remains constant: translating complex technical risks into actionable business intelligence to ensure the continued safety and operation of essential services.", "public_name": "RichardS", "guid": "6e158beb-7f68-55a3-8e82-d350f4755074", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/3TE8EK/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/QSNB8R/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/QSNB8R/", "attachments": []}, {"guid": "788cd750-6d84-513a-a8ec-44bbe6b2077f", "code": "FXAFPH", "id": 89823, "logo": null, "date": "2026-04-10T15:20:00+01:00", "start": "15:20", "end": "2026-04-10T15:40:00+01:00", "duration": "00:20", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-89823-the-road-to-cyber-security-consulting", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/FXAFPH/", "title": "The Road to Cyber Security Consulting", "subtitle": "", "track": null, "type": "Careers Track", "language": "en", "abstract": "This talk reflects on the lessons learnt through 10 years of cyber security consulting, sharing practical lessons from industry and highlighting what is often learned only through experience.\n\nIt explores how technical skills, professional judgement, and soft skills such as communication and adaptability develop over time, and offers insight into common early career challenges and what matters most when progressing in the field.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "QPRGXN", "name": "George Chapman", "avatar": "https://pretalx.com/media/avatars/QPRGXN_AU7WHmG.webp", "biography": "George Chapman is a senior cyber security consultant who delivers Penetration Testing engagements, Red Team Operations and Incident Response support. A CVE-credited researcher, George converts technical insight into tangible business value and stronger organisational resilience.", "public_name": "George Chapman", "guid": "9e29b2ad-6431-5e87-8355-5348abe08e33", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/QPRGXN/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/FXAFPH/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/FXAFPH/", "attachments": []}, {"guid": "e218427a-61f8-5821-9bed-892e97f37c4a", "code": "ZPYS87", "id": 93759, "logo": null, "date": "2026-04-10T15:40:00+01:00", "start": "15:40", "end": "2026-04-10T16:40:00+01:00", "duration": "01:00", "room": "Rookie, Student and Careers Track", "slug": "bsides-ot-uk-2025-93759-careers-panel", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/ZPYS87/", "title": "Careers Panel", "subtitle": "", "track": null, "type": "Panel", "language": "en", "abstract": "A Q&A with a panel of experts to provide guidance and advice on OT security careers", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/ZPYS87/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/ZPYS87/", "attachments": []}], "Workshops": [{"guid": "2daf744e-b69b-57c3-8e1d-44bb90d0b231", "code": "MHTBYY", "id": 88094, "logo": null, "date": "2026-04-10T10:00:00+01:00", "start": "10:00", "end": "2026-04-10T12:00:00+01:00", "duration": "02:00", "room": "Workshops", "slug": "bsides-ot-uk-2025-88094-assess-the-efficiency-of-your-ot-cyber-monitoring-with-caldera", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/MHTBYY/", "title": "Assess the Efficiency of Your OT Cyber Monitoring with CALDERA", "subtitle": "", "track": null, "type": "Workshop", "language": "en", "abstract": "Monitoring is often seen as the silver bullet for ICS security, but how effective is it really? In this interactive lab, you will launch realistic attacks with CALDERA against a live industrial setup and evaluate detections across EDR, logs, and network monitoring tools. Discover OT blind spots and walk away with a clear methodology to assess and improve monitoring.", "description": "Security monitoring is often promoted as the cornerstone of Industrial Control System (ICS) defense, but how effective is it against real adversaries? \n\nParticipants will gain access to a cloud-hosted, browser-based VM preloaded with CALDERA, the open-source adversary emulation framework. The physical cyber range includes a Windows SCADA and engineering station with EDR, PLCs from two different vendors, and centralized log and network monitoring, creating a realistic environment to explore both IT and OT attacks.\n\nGuided exercises begin with simulating a malicious remote user using malware and disabling security solutions, then progress to PLC reconnaissance and manipulation using ICS protocols such as Modbus, S7 and OPC-UA. An advanced scenario will also highlight how custom detection logic can be implemented in PLC & SCADA.\nThroughout the lab, adversaries and detection capabilities are mapped against MITRE ATT&CK for ICS, giving participants a structured way to evaluate monitoring effectiveness. The session concludes with a defensive checklist and guidance on extending these exercises into tabletop assessments.\n\nNo prior ICS experience is required\u2014just a laptop with a browser. Attendees leave with a repeatable methodology to assess and strengthen their own monitoring deployments.", "recording_license": "", "do_not_record": false, "persons": [{"code": "TYQGQN", "name": "Arnaud Soullie", "avatar": "https://pretalx.com/media/avatars/TYQGQN_kUb2jH7.webp", "biography": "Arnaud Soulli\u00e9 is a Senior Manager at Wavestone, a global consulting company. For 15 years, he has been performing security assessments and pentests on all types of targets. He started specializing in ICS cybersecurity 10 years ago. He has spoken at numerous security conferences on ICS topics: BlackHat Europe, BruCon, 4SICS, BSides Las Vegas, DEFCON... He is also the creator of the DYODE project, an open source data diode aimed at ICS. He has been teaching ICS cybersecurity trainings since 2015.", "public_name": "Arnaud Soullie", "guid": "32de017d-c3f4-5094-9733-94dd6cae8dd3", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/TYQGQN/"}, {"code": "NZYQHV", "name": "Juliette Barbier", "avatar": "https://pretalx.com/media/avatars/NZYQHV_mjYfgw8.webp", "biography": "Juliette Barbier is a Senior Consultant at Wavestone, a global consulting company. She specializes in industrial cybersecurity, with a strong focus on detection strategies and solutions for ICS environments. She has worked on implementing detection capabilities and getting the most of network-based detection solutions. Curious and enthusiastic, she enjoys putting detection theory to the test against real-world adversaries and operational constraints.", "public_name": "Juliette Barbier", "guid": "cf042ef6-0722-5539-9ad6-1935255b4a43", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/NZYQHV/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/MHTBYY/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/MHTBYY/", "attachments": []}, {"guid": "c23d73a0-b6ea-51a7-bb7f-59b1c9e06974", "code": "R3YCJA", "id": 88013, "logo": "https://pretalx.com/media/bsides-ot-uk-2025/submissions/R3YCJA/OT_Lab_Image_1y63_2JV16Yh.webp", "date": "2026-04-10T13:20:00+01:00", "start": "13:20", "end": "2026-04-10T15:20:00+01:00", "duration": "02:00", "room": "Workshops", "slug": "bsides-ot-uk-2025-88013-crossing-the-wire-defensive-ot-workshop-with-live-red-team-attack", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/R3YCJA/", "title": "Crossing the Wire: Defensive OT Workshop with Live Red Team Attack", "subtitle": "", "track": null, "type": "Workshop", "language": "en", "abstract": "This interactive workshop offers a practical, hands-on experience within an Operational Technology (OT) laboratory setting. Participants will work with real-world industrial control processes to gain a clear understanding of how OT systems function and where vulnerabilities can occur. Through guided activities, the session will uncover common cyber risks affecting critical infrastructure and demonstrate proven approaches to identifying, assessing, and managing these threats. By the end, attendees will appreciate the unique challenges of securing OT environments and take away practical strategies to strengthen resilience against evolving cyber threats.", "description": "This purpose-built OT laboratory offers a practical environment for exploring industrial control systems and understanding cyber risks in a safe, controlled setting. At its centre is a hypervisor running a SCADA platform, which connects to four PLCs through ESP32 modules using the Modbus protocol. These PLCs manage a variety of physical processes, including motors, pump valves, lighting systems, and radio frequency controls linked to remote-controlled ship and helicopter models.\nThe lab mirrors real-world operational technology scenarios, giving participants the chance to see how interconnected systems operate and where vulnerabilities can arise. Working with live processes rather than theory provides valuable insight into OT architecture, automation logic, and the potential impact of cyber threats on physical operations. This hands-on experience bridges the gap between IT and OT, making complex concepts clear and equipping learners with practical skills to manage risk effectively.", "recording_license": "", "do_not_record": false, "persons": [{"code": "RATADW", "name": "Jonny Keiller", "avatar": "https://pretalx.com/media/avatars/RATADW_QLr4bq0.webp", "biography": "I am an ISA/IEC 62443 Certified Expert leading an OT consultancy team focused on securing Critical National Infrastructure and manufacturing environments. My work involves delivering robust cyber security strategies, risk assessments, and compliance solutions to protect complex industrial systems from evolving threats.\nPreviously, I spent 22 years in the Royal Navy specialising in Electronic Warfare and Cyber Defence, gaining extensive experience in countering advanced threats and supporting the protection of mission-critical systems. This background provides a strong foundation for understanding the challenges of resilience in operational technology.", "public_name": "Jonny Keiller", "guid": "cc4e8e7e-a87c-5cf5-82a3-9abe4680871e", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/RATADW/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/R3YCJA/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/R3YCJA/", "attachments": []}], "Cyber Escape Room": [{"guid": "9ba25db7-41f8-58df-b36d-97fb29c246a4", "code": "7Q99SU", "id": 89318, "logo": null, "date": "2026-04-10T10:00:00+01:00", "start": "10:00", "end": "2026-04-10T11:30:00+01:00", "duration": "01:30", "room": "Cyber Escape Room", "slug": "bsides-ot-uk-2025-89318-the-break-in-interactive-ot-cyber-escape-room", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/7Q99SU/", "title": "The Break In: Interactive OT Cyber Escape Room", "subtitle": "", "track": null, "type": "Workshop", "language": "en", "abstract": "OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be. \n\nWhat happens when a cyber incident doesn\u2019t start with malware\u2026 but with a door?\n\nIn this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast.\n\nAs IT and OT systems become increasingly interconnected, the line between \u201cIT security issue\u201d and \u201cOT safety problem\u201d is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other.\n\nSet inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick.", "description": "This workshop delivers a fully interactive OT cyber incident simulation using The Cyber Escape Room Co.\u2019s portable OT escape room experience, purpose-built for industrial and critical infrastructure environments.\n\nParticipants are dropped straight into the action. A facility has been compromised. Physical access has been interfered with. Systems are behaving strangely. Information is incomplete. The clock is ticking.\n\nWorking in small teams, attendees will:\n\t\u2022\tInvestigate physical and digital clues to uncover how the incident occurred\n\t\u2022\tExperience first-hand how IT security failures can cascade into OT impact\n\t\u2022\tRestore access to OT systems \n\t\u2022\tCommunicate findings to a simulated SOC and incident response function\n\t\u2022\tMake judgement calls that balance security, safety, and operational continuity\n\nThe scenario deliberately blends IT and OT considerations, reflecting how modern environments actually operate. Participants will see why traditional IT-only approaches often fall short in OT, and why OT teams can\u2019t afford to ignore IT security practices as systems become more connected.\n\nThis is not about \u201cwinning\u201d an escape room. It\u2019s about learning through experience. The session finishes with a guided debrief that translates the scenario into practical, actionable takeaways covering:\n\t\u2022\tThe growing convergence of IT and OT security\n\t\u2022\tHuman and process failures that attackers exploit\n\t\u2022\tPhysical security as a cyber control\n\t\u2022\tHow to improve collaboration between IT, OT, and security teams\n\nNo prior escape room experience is needed. The workshop is designed to be accessible, engaging, and genuinely fun, while still delivering serious insight for OT engineers, security professionals, and anyone responsible for protecting operational systems.", "recording_license": "", "do_not_record": false, "persons": [{"code": "38SZLJ", "name": "Amy Stokes-Waters", "avatar": "https://pretalx.com/media/avatars/38SZLJ_3sgfE8U.webp", "biography": "Amy Stokes-Waters is the founder of The Cyber Escape Room Co., where she designs immersive, experience-led cybersecurity training that helps people learn by doing, not clicking through slides. Her work focuses on human behaviour, decision-making, and how people respond under pressure, turning real-world security challenges into memorable learning experiences that actually stick.", "public_name": "Amy Stokes-Waters", "guid": "43b08fc1-c08c-5d4d-9a47-0564f90c15a6", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/38SZLJ/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/7Q99SU/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/7Q99SU/", "attachments": []}, {"guid": "9bea089d-b1be-5793-bb68-e0e219001efa", "code": "SYFXHW", "id": 93761, "logo": null, "date": "2026-04-10T13:40:00+01:00", "start": "13:40", "end": "2026-04-10T15:10:00+01:00", "duration": "01:30", "room": "Cyber Escape Room", "slug": "bsides-ot-uk-2025-93761-the-break-in-interactive-ot-cyber-escape-room-session-2", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/SYFXHW/", "title": "The Break In: Interactive OT Cyber Escape Room - Session 2", "subtitle": "", "track": null, "type": "Workshop", "language": "en", "abstract": "OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be. \n\nWhat happens when a cyber incident doesn\u2019t start with malware\u2026 but with a door?\n\nIn this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast.\n\nAs IT and OT systems become increasingly interconnected, the line between \u201cIT security issue\u201d and \u201cOT safety problem\u201d is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other.\n\nSet inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "38SZLJ", "name": "Amy Stokes-Waters", "avatar": "https://pretalx.com/media/avatars/38SZLJ_3sgfE8U.webp", "biography": "Amy Stokes-Waters is the founder of The Cyber Escape Room Co., where she designs immersive, experience-led cybersecurity training that helps people learn by doing, not clicking through slides. Her work focuses on human behaviour, decision-making, and how people respond under pressure, turning real-world security challenges into memorable learning experiences that actually stick.", "public_name": "Amy Stokes-Waters", "guid": "43b08fc1-c08c-5d4d-9a47-0564f90c15a6", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/38SZLJ/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/SYFXHW/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/SYFXHW/", "attachments": []}, {"guid": "237cc5f4-fe62-520b-96e5-d1f7096b1291", "code": "US3MJK", "id": 93762, "logo": null, "date": "2026-04-10T15:20:00+01:00", "start": "15:20", "end": "2026-04-10T16:50:00+01:00", "duration": "01:30", "room": "Cyber Escape Room", "slug": "bsides-ot-uk-2025-93762-the-break-in-interactive-ot-cyber-escape-room-session-3", "url": "https://pretalx.com/bsides-ot-uk-2025/talk/US3MJK/", "title": "The Break In: Interactive OT Cyber Escape Room - Session 3", "subtitle": "", "track": null, "type": "Workshop", "language": "en", "abstract": "OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be. \n\nWhat happens when a cyber incident doesn\u2019t start with malware\u2026 but with a door?\n\nIn this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast.\n\nAs IT and OT systems become increasingly interconnected, the line between \u201cIT security issue\u201d and \u201cOT safety problem\u201d is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other.\n\nSet inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "38SZLJ", "name": "Amy Stokes-Waters", "avatar": "https://pretalx.com/media/avatars/38SZLJ_3sgfE8U.webp", "biography": "Amy Stokes-Waters is the founder of The Cyber Escape Room Co., where she designs immersive, experience-led cybersecurity training that helps people learn by doing, not clicking through slides. Her work focuses on human behaviour, decision-making, and how people respond under pressure, turning real-world security challenges into memorable learning experiences that actually stick.", "public_name": "Amy Stokes-Waters", "guid": "43b08fc1-c08c-5d4d-9a47-0564f90c15a6", "url": "https://pretalx.com/bsides-ot-uk-2025/speaker/38SZLJ/"}], "links": [], "feedback_url": "https://pretalx.com/bsides-ot-uk-2025/talk/US3MJK/feedback/", "origin_url": "https://pretalx.com/bsides-ot-uk-2025/talk/US3MJK/", "attachments": []}]}}]}}}