2.0 -//Pentabarf//Schedule//EN PUBLISH BCERFV@@pretalx.com -BCERFV Registration and Coffee en en 20260410T083000 20260410T090000 003000 Registration and Coffee PUBLIC CONFIRMED General https://pretalx.com/bsides-ot-uk-2025/talk/BCERFV/ Track 1 PUBLISH GQZD9R@@pretalx.com -GQZD9R Welcoming Remarks en en 20260410T090000 20260410T091500 001500 Welcoming Remarks PUBLIC CONFIRMED General https://pretalx.com/bsides-ot-uk-2025/talk/GQZD9R/ Track 1 PUBLISH J93LEL@@pretalx.com -J93LEL Opening Keynote en en 20260410T091500 20260410T095500 004000 Opening Keynote PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/J93LEL/ Track 1 PUBLISH XBSGRD@@pretalx.com -XBSGRD Square Pegs and Round Holes: What Actually Works in OT Security en en 20260410T100000 20260410T104000 004000 Square Pegs and Round Holes: What Actually Works in OT Security PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/XBSGRD/ Track 1 John Fitzpatrick PUBLISH T3HKBL@@pretalx.com -T3HKBL Modernising OT in the SOC en en 20260410T110000 20260410T112000 002000 Modernising OT in the SOC Operational Technology has become the new frontline of cyber risk, yet most Security Operations Centres are still built around IT‑centric assumptions, tools, and workflows. As industrial environments modernise—introducing IIoT devices, converged networks, and cloud‑connected control systems—the SOC must evolve with them. But what does “modernising OT in the SOC” actually look like in practice? This talk explores the practical, cultural, and architectural shifts required to bring OT visibility, detection, and response into a modern SOC without disrupting the safety‑critical environments it protects. We’ll break down the unique challenges of OT telemetry, asset discovery, protocol analysis, and incident response, and contrast them with traditional IT approaches that often fall short. Expect real‑world examples, lessons learned from the field, and a candid look at what works—and what absolutely doesn’t—when trying to operationalise OT security. Attendees will walk away with a clear understanding of: - How to build OT‑aware detection and response workflows that respect operational constraints - Why traditional SIEM/SOAR approaches struggle with OT data—and how to adapt them - The role of passive monitoring, network segmentation, and ICS‑specific threat intelligence - How to align engineers, operators, and SOC analysts around shared outcomes - Practical steps for maturing OT security without requiring a full rip‑and‑replace Whether you're an OT engineer, SOC analyst, or security leader, this session will give you a grounded, realistic roadmap for bringing OT into the SOC in a way that’s safe, scalable, and future‑ready. PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/T3HKBL/ Track 1 Andi Hudson PUBLISH LH3TPR@@pretalx.com -LH3TPR Do you even bench, bro? en en 20260410T112500 20260410T114500 002000 Do you even bench, bro? PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/LH3TPR/ Track 1 Adam Bromiley Sam Thom PUBLISH 8XA8QV@@pretalx.com -8XA8QV Acme Windpharm en en 20260410T120000 20260410T124000 004000 Acme Windpharm PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/8XA8QV/ Track 1 Colin Cassidy PUBLISH D3EXLF@@pretalx.com -D3EXLF Beyond Isolation: Modern OT Needs Modern Defences en en 20260410T134000 20260410T142000 004000 Beyond Isolation: Modern OT Needs Modern Defences PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/D3EXLF/ Track 1 David G2 PUBLISH ZJL8CG@@pretalx.com -ZJL8CG Lessons Learned from the Yard (Greenfield projects are hard too) en en 20260410T142000 20260410T144000 002000 Lessons Learned from the Yard (Greenfield projects are hard too) Attendees will gain a better understanding of the unique challenges faced implementing ICS/OT cybersecurity on capital projects. PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/ZJL8CG/ Track 1 Christopher Robinson PUBLISH QYFGZB@@pretalx.com -QYFGZB Insider Attack below the Detection Threshold in Water Treatment OT en en 20260410T144000 20260410T150000 002000 Insider Attack below the Detection Threshold in Water Treatment OT PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/QYFGZB/ Track 1 Andy Richings Sarad George Edmond PUBLISH RSN7HX@@pretalx.com -RSN7HX When absolute zero gets too hot to handle - Cyber Risks for Cryogenic Failure in MRI en en 20260410T152000 20260410T160000 004000 When absolute zero gets too hot to handle - Cyber Risks for Cryogenic Failure in MRI What if the superconducting magnet of an MRI machine breached containment? What if the checks, controls and fail-safes of an MRI machine are connected to the network? In this short talk I explore the cyber-physical risks of cryogenic systems, with the particular example of MRI superconducting magnets. MRI magnets rely on cryogenic cooling - liquid helium near absolute zero - to maintain superconducting magnetic fields. If the cooling system fails the liquid helium boils: if safety systems work, it should vent safely but if they don't, the cold gas can fill the room with such pressure that the doors probably won't open, the oxygen is forced out so anyone trapped inside suffocates while getting frostbite. These risks are rare because we have containment systems, monitoring and fail-safes: but what if someone or something interferes with those systems? Then small anomalies can cascade and we have cryogenic bombs waiting to go off. Cryogenics is now a cyber‑physical risk surface: pervasive networking and the Internet of Things now means system failures - through accident or attack - can cause failures in ordering systems, delivery delays, failing fail-safes so that Operational Technology is increasingly exposed to cyber risks in cryogenic monitoring and control. In this talk I explore those risks, their mitigations, and summarise safe practices that can avoid us breaking out into a sweat about liquid helium. PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/RSN7HX/ Track 1 Chris Bore PUBLISH JDANZB@@pretalx.com -JDANZB Mind the Gap: Security on Paper, Reality on the Wire en en 20260410T160000 20260410T164000 004000 Mind the Gap: Security on Paper, Reality on the Wire PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/JDANZB/ Track 1 Mandie Grosskopf PUBLISH R7KGEJ@@pretalx.com -R7KGEJ OT Security: A National Security Perspective en en 20260410T170000 20260410T174000 004000 OT Security: A National Security Perspective PUBLIC CONFIRMED Panel https://pretalx.com/bsides-ot-uk-2025/talk/R7KGEJ/ Track 1 PUBLISH MW8DCP@@pretalx.com -MW8DCP Closing Remarks & Raffle Drawing en en 20260410T174000 20260410T180000 002000 Closing Remarks & Raffle Drawing PUBLIC CONFIRMED General https://pretalx.com/bsides-ot-uk-2025/talk/MW8DCP/ Track 1 PUBLISH XWMKJK@@pretalx.com -XWMKJK After Party en en 20260410T183000 20260410T190000 003000 After Party PUBLIC CONFIRMED General https://pretalx.com/bsides-ot-uk-2025/talk/XWMKJK/ Track 1 PUBLISH RKQGMQ@@pretalx.com -RKQGMQ OT Ownership Myths en en 20260410T100000 20260410T104000 004000 OT Ownership Myths You'll leave this session better equipped to examine supplier claims, make sense of assurance artifacts, and reason more clearly about OT supply chain risk. We'll examine ownership myths in OT environments: ideas like "well we can just patch it", "the contract protects us", or "we've done our due diligence". It looks at how real-world constraints from vendor dependency to long system lifecycles often shape outcomes far more than frameworks or policy. Instead of yet another checklist of controls, we'll focus on building a more realistic model of how OT ecosystems actually function, so you can ask better questions, assess suppliers more effectively, and make stronger decisions. PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/RKQGMQ/ Track 2 James Bore PUBLISH CWZKFV@@pretalx.com -CWZKFV Grayzone Warfare: From IT Systems to OT Effects en en 20260410T110000 20260410T112000 002000 Grayzone Warfare: From IT Systems to OT Effects Here are my key takeaways: Cyber Conflict Now Lives Below the Threshold of War Modern adversaries deliberately operate in the grayzone—conducting cyber operations that avoid attribution, legal response, or escalation. IT Compromise Is the Gateway to OT Impact Attacks rarely begin in industrial environments. Instead, identity systems, remote access, supply chains, and poorly governed enterprise IT are used as ingress points, allowing adversaries to pivot toward operational technology. Cyber Effects Are Increasingly Physical and Strategic Grayzone cyber operations can produce real‑world outcomes including service disruption, equipment damage, environmental harm, and public loss of trust. These effects deliver strategic leverage while maintaining plausible deniability, making them powerful although limited tools of state and proxy actors alike. Defenders Must Think Like Strategists, Not Just Technicians Effective defense requires understanding attacker intent, dwell time, and campaign objectives—not just indicators of compromise. PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/CWZKFV/ Track 2 Ian Thornton-Trump CD PUBLISH FS7LKR@@pretalx.com -FS7LKR What Your IT Response Playbook Gets Wrong About OT. en en 20260410T112500 20260410T114500 002000 What Your IT Response Playbook Gets Wrong About OT. PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/FS7LKR/ Track 2 James John PUBLISH YBPBFN@@pretalx.com -YBPBFN SCADA Protocol Security - What Is The Answer And Why? en en 20260410T120000 20260410T124000 004000 SCADA Protocol Security - What Is The Answer And Why? PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/YBPBFN/ Track 2 Dave Gunn PUBLISH LSFGHC@@pretalx.com -LSFGHC Getting Into OT Security on a Budget: From Software Simulations to Practical Ranges en en 20260410T134000 20260410T142000 004000 Getting Into OT Security on a Budget: From Software Simulations to Practical Ranges PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/LSFGHC/ Track 2 KevTheHermit PUBLISH FBQWJP@@pretalx.com -FBQWJP Explaining OT Cyber to the Board Was Hard Enough: Then the Regulator Asked for Evidence en en 20260410T142000 20260410T144000 002000 Explaining OT Cyber to the Board Was Hard Enough: Then the Regulator Asked for Evidence The translation problem (why OT cyber becomes garbled between technical reality and governance language) Three audiences, three needs Engineering: reduce risk without breaking operations Board: decisions, trade-offs, investment, accountability Regulator/overseer: confidence, evidence, progress, proportionality A simple story you can reuse (risk framing that works in leadership settings) Evidence that matters (what to show, how to show it, how to avoid theatre) Practical “next 90 days” (what moves the needle most reliably) PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/FBQWJP/ Track 2 David Jones PUBLISH TBYEYY@@pretalx.com -TBYEYY CRAzy about Product Security - Navigating the Cyber Resilience Act en en 20260410T144000 20260410T150000 002000 CRAzy about Product Security - Navigating the Cyber Resilience Act PUBLIC CONFIRMED Main Track - Short Talk https://pretalx.com/bsides-ot-uk-2025/talk/TBYEYY/ Track 2 Zachary Sleath PUBLISH WBKRE3@@pretalx.com -WBKRE3 Why OT Security Fails on the Factory Floor, and How to Make It Stick en en 20260410T152000 20260410T160000 004000 Why OT Security Fails on the Factory Floor, and How to Make It Stick PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/WBKRE3/ Track 2 John Allen PUBLISH EYYJ8Z@@pretalx.com -EYYJ8Z Breaking the Air Gap: Covert Command and Control Attacks on Industrial Systems en en 20260410T160000 20260410T164000 004000 Breaking the Air Gap: Covert Command and Control Attacks on Industrial Systems As OT environments become increasingly connected, the security assumptions that protected air-gapped systems are eroding. This presentation examines how adversaries can adapt IT-based Command and Control techniques to operational technology networks, with a specific focus on abusing the OPC UA protocol. We'll explore the technical mechanics of creating covert C2 channels with OPC UA communications, demonstrating how legitimate industrial protocols can be weaponized for data exfiltration and persistent control. Using a simulated industrial environment with Factory I/O and containerized PLCs, attendees will see firsthand how these attacks operate within realistic OT contexts. Topics include: Fundamental differences between IT and OT C2 infrastructure requirements OPC UA protocol structure and abuse opportunities Techniques for blending malicious traffic with legitimate industrial communications Detection challenges / defensive considerations. PUBLIC CONFIRMED Main Track - Long Talk https://pretalx.com/bsides-ot-uk-2025/talk/EYYJ8Z/ Track 2 James Sabin PUBLISH W3GSMN@@pretalx.com -W3GSMN Fixing the Front Door: Securing OT Remote Access Without Killing Production en en 20260410T100000 20260410T102000 002000 Fixing the Front Door: Securing OT Remote Access Without Killing Production Key Takeaway for Attendees: - A clear “front door” remote access path model for OT (diagram-led) - Controls that work under OT constraints: time-boxed access, least privilege, and a safety-aware normal vs emergency access lane - Three high-fidelity jump host monitoring signals using basic Windows logs (4624/4625 patterns, RDP logon type 10 anomalies, privileged group changes) - A short, actionable OT access plan to implement without disrupting operations Audience: OT/ICS engineers, plant IT, SOC/IR supporting OT, vendors/integrators, and anyone interested in actionable knowledge transfer. PUBLIC CONFIRMED Rookie Track https://pretalx.com/bsides-ot-uk-2025/talk/W3GSMN/ Rookie, Student and Careers Track Richard Dosumu PUBLISH 9XADNA@@pretalx.com -9XADNA Soft Skills in a Hard-Hat World: Why Communication is One of the Most Critical OT Security Controls en en 20260410T102000 20260410T104000 002000 Soft Skills in a Hard-Hat World: Why Communication is One of the Most Critical OT Security Controls The skills we call "soft" are often the ones holding OT security together This talks looks at OT environments as people-first systems and explores how communication, negotiation and trust directly affect risk assessments, supply chain security and day-to-day OT security decisions. It examines why authority in OT is built through credibility and relationships rather than job titles, and how security outcomes are shaped in meetings as much as technical controls. Grounded in real OT security work and experiences common to women in OT and cyber roles, the session reframes so-called "soft-skills" as operational risk controls that materially impact safety and resilience. PUBLIC CONFIRMED Rookie Track https://pretalx.com/bsides-ot-uk-2025/talk/9XADNA/ Rookie, Student and Careers Track Fiona Kastrati PUBLISH 839MA7@@pretalx.com -839MA7 Creating Offensive and Defensive Tools for OT/ICS with GenAI en en 20260410T110000 20260410T115000 005000 Creating Offensive and Defensive Tools for OT/ICS with GenAI PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-ot-uk-2025/talk/839MA7/ Rookie, Student and Careers Track Mike Holcomb PUBLISH XKVN8M@@pretalx.com -XKVN8M From Currys to Classified: £20 Cross Domain Solutions en en 20260410T120000 20260410T122000 002000 From Currys to Classified: £20 Cross Domain Solutions In this talk we'll take a £10 unmanaged network switch and, using a CH341A programmer, modify its EEPROM to change its behaviour. By configuring port isolation masks we can prevent ports from talking back to one another, creating a firmware defined data diode. The diode is just the one-way valve; a cross domain solution needs to handle more complicated data flows. This is where we'll spend our remaining £10 on a microcontroller with an ethernet port and just enough firmware to manage a protocol break and some data verification. Whether you are securing a power plant, or just here to bully cheap silicon into doing your bidding, this talk will demonstrate implementing cross domain fundamentals can be done on a shoestring budget. PUBLIC CONFIRMED Rookie Track https://pretalx.com/bsides-ot-uk-2025/talk/XKVN8M/ Rookie, Student and Careers Track Laurence Halfpenny PUBLISH Z7XUUH@@pretalx.com -Z7XUUH Beyond Alerts: Diagnosing and Improving Situational Awareness in Industrial Systems en en 20260410T122000 20260410T124000 002000 Beyond Alerts: Diagnosing and Improving Situational Awareness in Industrial Systems This talk will introduce a structured methodology called AESICS, which reconceptualizes adversary emulation exercise as a diagnostic instrument for iterative ICS defense improvement. We will discuss how the framework can help analysts to systematically identify multi-dimensional situational awareness gaps and design targeted defensive enhancements to close those gaps. We also introduce SIMPLE ICS (Simulated Industrial Multi-tier Platform for Laboratory Emulation of Industrial Control Systems) testbed, a sector-agnostic, Purdue-aligned industrial testbed architecture that models modern industrial environments. We will present the result from the AESICS using this testbed and empirically test the methodology for quantifying and assessing defensive improvement based on the AESICS methodology. Throughout the session, we will walk through: - A reusable industrial testbed architecture guide using SIMPLE ICS. - A structured diagnostic approach you can implement immediately, turning vague ‘improve security’ into specific quantifiable security improvement. - A quantified metrics framework for measuring situational awareness gaps. PUBLIC CONFIRMED Student Track https://pretalx.com/bsides-ot-uk-2025/talk/Z7XUUH/ Rookie, Student and Careers Track M. Endhy Aziz PUBLISH QVYJ8A@@pretalx.com -QVYJ8A Dynamic Risk Assessment For Critical National Infrastructures en en 20260410T134000 20260410T140000 002000 Dynamic Risk Assessment For Critical National Infrastructures Since Critical National Infrastructures (CNIs) have become one of the main targets for nation state threat actors, keeping them both safe and operational during an adversarial campaign is particularly challenging. Especially the increase of their interconnectivity with Internet devices is exposing them to even more potential attack paths, making risk identification and consequently incident handling impossible. Traditional risk assessment methods fall short to address the rapidly evolving nature of vulnerability landscape. Hence, there is a need for a near-real-time dynamic risk assessment approach which aims to keep a CNI operational during an on-going attack, albeit at reduced capacity, by applying the minimum necessary mitigations. We suggest a model which identifies how/if an adversarial campaign could potentially escalate to an unsafe state of the CNI, such as physical damage or threatening life, and isolates the part of the network that could lead to such escalation. This approach combines Fault Tree Analysis, Dempster-Shafer Theory and the MITRE ATT&CK framework for deriving a near-real-time model which can adapt while an attack unfolds. PUBLIC CONFIRMED Student Track https://pretalx.com/bsides-ot-uk-2025/talk/QVYJ8A/ Rookie, Student and Careers Track Kostas Anastasakis PUBLISH X7HVZQ@@pretalx.com -X7HVZQ Industrial Honeypots Challenges and Research Opportunities en en 20260410T140000 20260410T142000 002000 Industrial Honeypots Challenges and Research Opportunities PUBLIC CONFIRMED Student Track https://pretalx.com/bsides-ot-uk-2025/talk/X7HVZQ/ Rookie, Student and Careers Track Jacob Williams PUBLISH 8HY9MZ@@pretalx.com -8HY9MZ Speaking Their Language: An Engineer's Guide to the Safety-Security Divide en en 20260410T142000 20260410T144000 002000 Speaking Their Language: An Engineer's Guide to the Safety-Security Divide PUBLIC CONFIRMED Careers Track https://pretalx.com/bsides-ot-uk-2025/talk/8HY9MZ/ Rookie, Student and Careers Track Amy Brooks PUBLISH QSNB8R@@pretalx.com -QSNB8R Enable, Don't Obstruct: Building an OT Security Career That Actually Works en en 20260410T144000 20260410T150000 002000 Enable, Don't Obstruct: Building an OT Security Career That Actually Works PUBLIC CONFIRMED Careers Track https://pretalx.com/bsides-ot-uk-2025/talk/QSNB8R/ Rookie, Student and Careers Track RichardS PUBLISH FXAFPH@@pretalx.com -FXAFPH The Road to Cyber Security Consulting en en 20260410T152000 20260410T154000 002000 The Road to Cyber Security Consulting PUBLIC CONFIRMED Careers Track https://pretalx.com/bsides-ot-uk-2025/talk/FXAFPH/ Rookie, Student and Careers Track George Chapman PUBLISH ZPYS87@@pretalx.com -ZPYS87 Careers Panel en en 20260410T154000 20260410T164000 010000 Careers Panel PUBLIC CONFIRMED Panel https://pretalx.com/bsides-ot-uk-2025/talk/ZPYS87/ Rookie, Student and Careers Track PUBLISH MHTBYY@@pretalx.com -MHTBYY Assess the Efficiency of Your OT Cyber Monitoring with CALDERA en en 20260410T100000 20260410T120000 020000 Assess the Efficiency of Your OT Cyber Monitoring with CALDERA Security monitoring is often promoted as the cornerstone of Industrial Control System (ICS) defense, but how effective is it against real adversaries? Participants will gain access to a cloud-hosted, browser-based VM preloaded with CALDERA, the open-source adversary emulation framework. The physical cyber range includes a Windows SCADA and engineering station with EDR, PLCs from two different vendors, and centralized log and network monitoring, creating a realistic environment to explore both IT and OT attacks. Guided exercises begin with simulating a malicious remote user using malware and disabling security solutions, then progress to PLC reconnaissance and manipulation using ICS protocols such as Modbus, S7 and OPC-UA. An advanced scenario will also highlight how custom detection logic can be implemented in PLC & SCADA. Throughout the lab, adversaries and detection capabilities are mapped against MITRE ATT&CK for ICS, giving participants a structured way to evaluate monitoring effectiveness. The session concludes with a defensive checklist and guidance on extending these exercises into tabletop assessments. No prior ICS experience is required—just a laptop with a browser. Attendees leave with a repeatable methodology to assess and strengthen their own monitoring deployments. PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-ot-uk-2025/talk/MHTBYY/ Workshops Arnaud Soullie Juliette Barbier PUBLISH R3YCJA@@pretalx.com -R3YCJA Crossing the Wire: Defensive OT Workshop with Live Red Team Attack en en 20260410T132000 20260410T152000 020000 Crossing the Wire: Defensive OT Workshop with Live Red Team Attack This purpose-built OT laboratory offers a practical environment for exploring industrial control systems and understanding cyber risks in a safe, controlled setting. At its centre is a hypervisor running a SCADA platform, which connects to four PLCs through ESP32 modules using the Modbus protocol. These PLCs manage a variety of physical processes, including motors, pump valves, lighting systems, and radio frequency controls linked to remote-controlled ship and helicopter models. The lab mirrors real-world operational technology scenarios, giving participants the chance to see how interconnected systems operate and where vulnerabilities can arise. Working with live processes rather than theory provides valuable insight into OT architecture, automation logic, and the potential impact of cyber threats on physical operations. This hands-on experience bridges the gap between IT and OT, making complex concepts clear and equipping learners with practical skills to manage risk effectively. PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-ot-uk-2025/talk/R3YCJA/ Workshops Jonny Keiller PUBLISH 7Q99SU@@pretalx.com -7Q99SU The Break In: Interactive OT Cyber Escape Room en en 20260410T100000 20260410T113000 013000 The Break In: Interactive OT Cyber Escape Room This workshop delivers a fully interactive OT cyber incident simulation using The Cyber Escape Room Co.’s portable OT escape room experience, purpose-built for industrial and critical infrastructure environments. Participants are dropped straight into the action. A facility has been compromised. Physical access has been interfered with. Systems are behaving strangely. Information is incomplete. The clock is ticking. Working in small teams, attendees will: • Investigate physical and digital clues to uncover how the incident occurred • Experience first-hand how IT security failures can cascade into OT impact • Restore access to OT systems • Communicate findings to a simulated SOC and incident response function • Make judgement calls that balance security, safety, and operational continuity The scenario deliberately blends IT and OT considerations, reflecting how modern environments actually operate. Participants will see why traditional IT-only approaches often fall short in OT, and why OT teams can’t afford to ignore IT security practices as systems become more connected. This is not about “winning” an escape room. It’s about learning through experience. The session finishes with a guided debrief that translates the scenario into practical, actionable takeaways covering: • The growing convergence of IT and OT security • Human and process failures that attackers exploit • Physical security as a cyber control • How to improve collaboration between IT, OT, and security teams No prior escape room experience is needed. The workshop is designed to be accessible, engaging, and genuinely fun, while still delivering serious insight for OT engineers, security professionals, and anyone responsible for protecting operational systems. PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-ot-uk-2025/talk/7Q99SU/ Cyber Escape Room Amy Stokes-Waters PUBLISH SYFXHW@@pretalx.com -SYFXHW The Break In: Interactive OT Cyber Escape Room - Session 2 en en 20260410T134000 20260410T151000 013000 The Break In: Interactive OT Cyber Escape Room - Session 2 PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-ot-uk-2025/talk/SYFXHW/ Cyber Escape Room Amy Stokes-Waters PUBLISH US3MJK@@pretalx.com -US3MJK The Break In: Interactive OT Cyber Escape Room - Session 3 en en 20260410T152000 20260410T165000 013000 The Break In: Interactive OT Cyber Escape Room - Session 3 PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-ot-uk-2025/talk/US3MJK/ Cyber Escape Room Amy Stokes-Waters