0.4 bsides-ot-uk-2025 2026-04-10 2026-04-10 1 00:05 https://pretalx.com https://pretalx.com/media/bsides-ot-uk-2025/img/logo_bRe0HqT.webp Europe/London Track 1 General 2026-04-10T08:30:00+01:00 08:30 00:30 Welcome to BSides OT UK 2026 in Bristol! Collect your badge, lanyard, and all the swag and head on in for a quick cup of tea/coffee and a pastry before the day begins! Now's your moment to do some quick hellos to old friends, meet some new people, and review the brilliant schedule to decide your fate for the rest of today! bsides-ot-uk-2025-93763-registration-and-coffee en false https://pretalx.com/bsides-ot-uk-2025/talk/BCERFV/ https://pretalx.com/bsides-ot-uk-2025/talk/BCERFV/feedback/ Track 1 General 2026-04-10T09:00:00+01:00 09:00 00:15 Welcome to BSides OT UK 2026 in Bristol! The team behind today's event will take to the stage to provide information for the remainder of today's activities, and issue an ever-lengthening list of thank yous to everyone involved in making today possible (you included, you lucky thing!). Let's kick off the first-ever BSides OT UK! 🎉 bsides-ot-uk-2025-93764-welcoming-remarks en false https://pretalx.com/bsides-ot-uk-2025/talk/GQZD9R/ https://pretalx.com/bsides-ot-uk-2025/talk/GQZD9R/feedback/ Track 1 Main Track - Long Talk 2026-04-10T09:15:00+01:00 09:15 00:40 Our opening keynote for the inaugural BSides OT UK will be delivered by Kevin White. Kevin is the Head of Cybersecurity for the Energy businesses of SSE Group and specialises in Operational Technology. He has worked in sectors as diverse as food, nuclear and utilities and in technologies that range from industrial networks to cloud-based analytics. He currently focusses on securing the energy-generating assets of SSE in the race towards NetZero. bsides-ot-uk-2025-93766-opening-keynote /media/bsides-ot-uk-2025/submissions/J93LEL/image_ixRxDPD.png en false https://pretalx.com/bsides-ot-uk-2025/talk/J93LEL/ https://pretalx.com/bsides-ot-uk-2025/talk/J93LEL/feedback/ Track 1 Main Track - Long Talk 2026-04-10T10:00:00+01:00 10:00 00:40 Having spent several years securing downstream oil infrastructure from cyber attacks, I can confidently say that traditional IT approaches to cyber security do not translate well into OT environments. We can spend a decade trying to force that square peg into a round hole, or we can do something different. After all, have those IT approaches even worked in IT?... In this talk I'll take you through several lessons we learned out in the field, securing critical OT infrastructure. We'll talk about how went about securing OT networks, how we utilised zero day vulnerabilities to our advantage, why we don't consider patching systems to be that important, how we handle topics like security testing, and how to implement effective detection capabilities all without disrupting operations or compromising safety. This talk is us learning out loud in the field of OT security, sharing our experiences in order to contribute to collective shared wisdom. I hope to leave you with some insights and examples from our own journey that you can take away and use on, and maybe challenge, your own approaches to OT security. bsides-ot-uk-2025-89286-square-pegs-and-round-holes-what-actually-works-in-ot-security John Fitzpatrick en false https://pretalx.com/bsides-ot-uk-2025/talk/XBSGRD/ https://pretalx.com/bsides-ot-uk-2025/talk/XBSGRD/feedback/ Track 1 Main Track - Short Talk 2026-04-10T11:00:00+01:00 11:00 00:20 Modern SOCs are being asked to monitor OT environments that behave nothing like the IT systems they’re used to. This talk cuts through the hype to show what it really takes to bring OT visibility, detection, and response into a SOC without disrupting safety‑critical operations. Attendees will leave with a practical, realistic view of how to evolve their SOC for converged IT/OT threats. bsides-ot-uk-2025-89233-modernising-ot-in-the-soc Andi Hudson en Operational Technology has become the new frontline of cyber risk, yet most Security Operations Centres are still built around IT‑centric assumptions, tools, and workflows. As industrial environments modernise—introducing IIoT devices, converged networks, and cloud‑connected control systems—the SOC must evolve with them. But what does “modernising OT in the SOC” actually look like in practice? This talk explores the practical, cultural, and architectural shifts required to bring OT visibility, detection, and response into a modern SOC without disrupting the safety‑critical environments it protects. We’ll break down the unique challenges of OT telemetry, asset discovery, protocol analysis, and incident response, and contrast them with traditional IT approaches that often fall short. Expect real‑world examples, lessons learned from the field, and a candid look at what works—and what absolutely doesn’t—when trying to operationalise OT security. Attendees will walk away with a clear understanding of: - How to build OT‑aware detection and response workflows that respect operational constraints - Why traditional SIEM/SOAR approaches struggle with OT data—and how to adapt them - The role of passive monitoring, network segmentation, and ICS‑specific threat intelligence - How to align engineers, operators, and SOC analysts around shared outcomes - Practical steps for maturing OT security without requiring a full rip‑and‑replace Whether you're an OT engineer, SOC analyst, or security leader, this session will give you a grounded, realistic roadmap for bringing OT into the SOC in a way that’s safe, scalable, and future‑ready. false https://pretalx.com/bsides-ot-uk-2025/talk/T3HKBL/ https://pretalx.com/bsides-ot-uk-2025/talk/T3HKBL/feedback/ Track 1 Main Track - Short Talk 2026-04-10T11:25:00+01:00 11:25 00:20 In a world of AI slop and next-gen nonsense, how do you know the thing you bought is actually secure? How do you firewall the unfirewall-able? This is a love letter to bench testing and vulnerability research in an industry where transparency never trends. You'll see intended functionality abused for firmware-level backdoors, controller logic swapped with segregation-busting implants, and why "secure" in OT just means "nobody looked too closely (yet)". In short: 2 basement gremlins, 1 crusty PLC, and unlimited Monster. bsides-ot-uk-2025-89918-do-you-even-bench-bro Adam BromileySam Thom en true https://pretalx.com/bsides-ot-uk-2025/talk/LH3TPR/ https://pretalx.com/bsides-ot-uk-2025/talk/LH3TPR/feedback/ Track 1 Main Track - Long Talk 2026-04-10T12:00:00+01:00 12:00 00:40 The talk will cover the basics of windfarms and their operations, I’ll briefly discuss prior research in this area, noting that those findings are still valid today. Then the core of this talk will focus on identified security threats and their mitigations based on real life assessments. The impact these threats can have both in terms of windfarm operation and the physical damage that can be caused. I will show how physical and remote access to the windfarm can be gained, and by investigating the vulnerabilities found, I will show that there is an over-reliance on security boxes and buzzword solutions that has left general, basic, security hygiene lacking. So much so that that in some cases, not only have systems not been patched, but they were installed insecurely in the first place. I will then discuss the recent 2019 UK outage and the part played by windfarms in that, from the initial outage to their impact on restoration as a result of how micro generation is modelled within control systems. There will be two key takeaways from this talk. Firstly, I will be busting the myth that ‘cutting off the supply’ is the most interesting attack that can be performed. It is the most likely, and one of the simplest attacks, but it is not the most interesting. Secondly, I will cover a point often glossed over in other talks. When an attacker ‘takes control’ it is often simply left at that, as if taking control was the ‘win condition’. This talk will cover some of the more interesting cyber physical attacks that can be performed on a wind farm and look at some of the ways that actual physical damage could be caused. bsides-ot-uk-2025-85812-acme-windpharm Colin Cassidy en false https://pretalx.com/bsides-ot-uk-2025/talk/8XA8QV/ https://pretalx.com/bsides-ot-uk-2025/talk/8XA8QV/feedback/ Track 1 Main Track - Long Talk 2026-04-10T13:40:00+01:00 13:40 00:40 The threats facing Operational Technology our outpacing the delivery of secure solutions in our critical infrastructure. Organisations deploying OT must now accept that connectivity is no longer an edge-case, and the “walled garden” model no longer reflects the way our industrial environments operate. To accelerate transformation and meet the threat we must challenge some of these beliefs to build critical infrastructure suitable for a modern threat environment. In this talk, David G2 a NCSC Cyber Physical Security Architect will introduce explain the context behind three new pieces of NCSC guidance - **Creating and Maintaining a Definitive View of Your OT Architecture**, **Secure Connectivity Principles for OT**, and **PAWs for OT**. Articulating how these documents fit together to support a realistic, defensible security posture for modern industrial environments. Do not fear this won’t be a guidance recital. This talk aims to challenge some long‑held beliefs, exploring why the traditional prioritisation of Availability, Integrity and Confidentiality (AIC) is often poorly suited to modern OT environments; why safety considerations are more nuanced than simply being “the most important factor”; how patching can be possible in practice; and how isolation is frequently misunderstood. We will examine why these beliefs emerged, what threats they can blind organisations to, and how they limit our ability to modernise, operate efficiently, and defend at scale The aim is for attendees to leave with: - A practical model for understanding their OT estate, as a system not just as assets. - Pragmatic approaches for securely enabling necessary connectivity rather than creating bespoke routes for all new connectivity. - Why Privileged Access Workstations (PAWs) matter more than ever and how they translate to the OT environment. - Clear, achievable steps for uplifting brownfield environments without waiting for the next lifecycle refresh. - A forward-looking vision that looks for operators to demand more of their vendors and integrators, drives vendors to raise their security baseline, and creates space for startups to innovate rather than replicate the past. The threats are already here, the the old rules won't save us. bsides-ot-uk-2025-89836-beyond-isolation-modern-ot-needs-modern-defences David G2 en true https://pretalx.com/bsides-ot-uk-2025/talk/D3EXLF/ https://pretalx.com/bsides-ot-uk-2025/talk/D3EXLF/feedback/ Track 1 Main Track - Short Talk 2026-04-10T14:20:00+01:00 14:20 00:20 Implementing ICS/OT cybersecurity in greenfield projects should be easier than existing brownfield projects. However, greenfield projects present their own challenges to implementing ICS/OT cyber security, especially if not properly planned. Chris will present challenges and lessons learned implementing ICS/OT cybersecurity on multiple large and complex offshore greenfield projects. bsides-ot-uk-2025-88183-lessons-learned-from-the-yard-greenfield-projects-are-hard-too Christopher Robinson en Attendees will gain a better understanding of the unique challenges faced implementing ICS/OT cybersecurity on capital projects. false https://pretalx.com/bsides-ot-uk-2025/talk/ZJL8CG/ https://pretalx.com/bsides-ot-uk-2025/talk/ZJL8CG/feedback/ Track 1 Main Track - Short Talk 2026-04-10T14:40:00+01:00 14:40 00:20 Insider threats in water treatment plants are often misunderstood as overt acts of sabotage. In reality, the most credible risk comes from low and slow actions that stay below detection thresholds. This short talk examines real-world case studies of insider activity in critical national infrastructure, introduces a simplified water treatment process model, and explores attacker goals such as water quality degradation, service disruption, and loss of public trust. We’ll walk through plausible attack scenarios that do not trigger alarms, signature-based detection, or traditional IT security controls. The session concludes with practical countermeasures focusing on process aware monitoring, assurance techniques that work in live OT environments and signposts a supporting white paper for deeper technical detail. bsides-ot-uk-2025-89872-insider-attack-below-the-detection-threshold-in-water-treatment-ot /media/bsides-ot-uk-2025/submissions/QYFGZB/image_hmQG8KC.webp Andy RichingsSaradGeorge Edmond en false https://pretalx.com/bsides-ot-uk-2025/talk/QYFGZB/ https://pretalx.com/bsides-ot-uk-2025/talk/QYFGZB/feedback/ Track 1 Main Track - Long Talk 2026-04-10T15:20:00+01:00 15:20 00:40 What if the superconducting magnet of an MRI machine breached containment? What if the checks and controls of an MRI machine are connected to the network? In this short talk I explore the cyber-physical risks of cryogenic systems, with the particular example of MRI superconducting magnets. MRI magnets rely on cryogenic cooling - liquid helium near absolute zero - to maintain superconducting magnetic fields. Superconducting relies on the coil being so cold that it has no electrical resistance, so massive currents (hundreds of amps) can flow through it and sustain magnetic fields almost hundreds of thousands of times that of the Earth. If that coolant warms up at any point the superconducting property is lost, the conductor becomes resistive and heats up, and a truly vicious cycle of heating and increasing resistance develops so the nitrogen or helium boils - called a 'quench'. The boiled gas is hundreds of times bigger than the liquid so creates intense pressure: so much that your ears will probably pop but worse, you probably can't open the door: and it forces the oxygen out of the room so you suffocate, while also getting instant frostbite. The collapse of the magnetic field can stress the magnet's structure and permanently damage the coils: which cost tens of thousands of pounds to replace while you lose weeks worth of imaging throughput. Even a controlled quench costs thousands and risks damage. These things are prevented by failsafe systems: constant monitoring, automatic venting, secure supply chains, early warnings, regular maintenance and checks. But what if they're not? What if someone or something interferes with the complex and supposedly resilient supply chain and safety monitoring systems? Then small anomalies can cascade and we have cryogenic bombs waiting to go off. Cryogenics is now a cyber‑physical risk surface: pervasive networking and the Internet of Things now means system failures - through accident or attack - can cause failures in ordering systems, delivery delays, failing fail-safes so that Operational Technology is increasingly exposed to cyber risks in cryogenic monitoring and control. The mitigations are obvious - and routine - but we all know that awareness and caution are not at all routine in cyber security, and restating the obvious is part of the toolbox of any cyber security professional so I will discuss mitigations including diversified helium and spares strategy, raised refill thresholds, network segmentation, encrypted telemetry with certificate lifecycle management, MFA for vendors, runtime physics‑based validation of sensor data, “alarm‑the‑silence” watchdogs, manual overrides, and blended quench‑plus‑cyber table-top drills, as useful tools that can help prevent incidents and avoid us breaking out into a sweat about liquid helium. bsides-ot-uk-2025-88534-when-absolute-zero-gets-too-hot-to-handle-cyber-risks-for-cryogenic-failure-in-mri /media/bsides-ot-uk-2025/submissions/RSN7HX/magnet_quench_1_6_RLarcXC.webp Chris Bore en What if the superconducting magnet of an MRI machine breached containment? What if the checks, controls and fail-safes of an MRI machine are connected to the network? In this short talk I explore the cyber-physical risks of cryogenic systems, with the particular example of MRI superconducting magnets. MRI magnets rely on cryogenic cooling - liquid helium near absolute zero - to maintain superconducting magnetic fields. If the cooling system fails the liquid helium boils: if safety systems work, it should vent safely but if they don't, the cold gas can fill the room with such pressure that the doors probably won't open, the oxygen is forced out so anyone trapped inside suffocates while getting frostbite. These risks are rare because we have containment systems, monitoring and fail-safes: but what if someone or something interferes with those systems? Then small anomalies can cascade and we have cryogenic bombs waiting to go off. Cryogenics is now a cyber‑physical risk surface: pervasive networking and the Internet of Things now means system failures - through accident or attack - can cause failures in ordering systems, delivery delays, failing fail-safes so that Operational Technology is increasingly exposed to cyber risks in cryogenic monitoring and control. In this talk I explore those risks, their mitigations, and summarise safe practices that can avoid us breaking out into a sweat about liquid helium. false https://pretalx.com/bsides-ot-uk-2025/talk/RSN7HX/ https://pretalx.com/bsides-ot-uk-2025/talk/RSN7HX/feedback/ Track 1 Main Track - Long Talk 2026-04-10T16:00:00+01:00 16:00 00:40 In OT environments, it is easy for cybersecurity programs to look robust on paper, but what happens when those same environments are put under the lens provided by a penetration test? In this talk we examine the results of pairing an OT Cybersecurity Maturity Assessment with an OT Penetration Test at the same facility, revealing a consistent pattern: the documented controls and expected risk posture don’t match what is actually happening on the wire. We will walk through anonymized case studies across several sites at multiple organizations in multiple geographical locations, highlighting that the results we expected based on governance were not always upheld by the reality we found with technical assessments. The goal of this talk is to demonstrate how gaps can form between OT security program standards and actual operational reality. Attendees will walk away with practical recommendations on how to test and validate expectations and risk. bsides-ot-uk-2025-88809-mind-the-gap-security-on-paper-reality-on-the-wire Mandie Grosskopf en false https://pretalx.com/bsides-ot-uk-2025/talk/JDANZB/ https://pretalx.com/bsides-ot-uk-2025/talk/JDANZB/feedback/ Track 1 Panel 2026-04-10T17:00:00+01:00 17:00 00:40 **No photos or recording for this session. Chatham House Rule.** A panel with representatives across government, regulators, and industry. bsides-ot-uk-2025-93760-ot-security-a-national-security-perspective en true https://pretalx.com/bsides-ot-uk-2025/talk/R7KGEJ/ https://pretalx.com/bsides-ot-uk-2025/talk/R7KGEJ/feedback/ Track 1 General 2026-04-10T17:40:00+01:00 17:40 00:20 Phew! What a day! The BSides OT UK organising team will take to the stage to close out an awesome day, and to draw the raffle prizes - tickets at the ready! As a reminder, all the proceeds from the raffle and the sticker stall go to our chosen charity - [The Bristol Children's Hospital Grand Appeal]([url](https://www.grandappeal.org.uk/)) - so please donate what you can, pick up some great new stickers for your laptop, and be in with the chance of winning some brilliant raffle prizes! bsides-ot-uk-2025-93765-closing-remarks-raffle-drawing en false https://pretalx.com/bsides-ot-uk-2025/talk/MW8DCP/ https://pretalx.com/bsides-ot-uk-2025/talk/MW8DCP/feedback/ Track 1 General 2026-04-10T18:30:00+01:00 18:30 00:30 The after-party will begin at 6:30 at a nearby venue, only a few minutes' walk from the main conference venue. The location of the after-party will be announced during the closing remarks. There is a sizeable bar tab thanks to our after-party sponsors, Pen Test Partners. All attendees are welcome to attend! Make sure you keep and wear your badge; the bar staff will use it to identify attendees. Food will not be provided, but a good range of food is available to order (note that this will not be covered on the bar tab). bsides-ot-uk-2025-93767-after-party en false https://pretalx.com/bsides-ot-uk-2025/talk/XWMKJK/ https://pretalx.com/bsides-ot-uk-2025/talk/XWMKJK/feedback/ Track 2 Main Track - Long Talk 2026-04-10T10:00:00+01:00 10:00 00:40 Attendees will leave able to ask more informed, stronger questions of suppliers, read assurance claims with appropriate scepticism, and make more defensible decisions about OT risk in the real world. They will gain a better understanding of where control sits in OT environments, how supplier relationships and commercial structures shape security outcomes, and why many common assumptions and frameworks around ownership, responsibility, and governance collapse in practice. The talk explores common myths around ownership: that asset owners control patching and change, that contracts offer meaningful protection, that assurance means security, and that responsibility aligns with authority. It examines how dependency, inertia, lifecycle constraints, vendor power, and incentives often dictate security posture far more than policy or wishful thinking, and offers practical ways to reframe discussions and challenge supplier narratives. bsides-ot-uk-2025-88509-ot-ownership-myths James Bore en You'll leave this session better equipped to examine supplier claims, make sense of assurance artifacts, and reason more clearly about OT supply chain risk. We'll examine ownership myths in OT environments: ideas like "well we can just patch it", "the contract protects us", or "we've done our due diligence". It looks at how real-world constraints from vendor dependency to long system lifecycles often shape outcomes far more than frameworks or policy. Instead of yet another checklist of controls, we'll focus on building a more realistic model of how OT ecosystems actually function, so you can ask better questions, assess suppliers more effectively, and make stronger decisions. false https://pretalx.com/bsides-ot-uk-2025/talk/RKQGMQ/ https://pretalx.com/bsides-ot-uk-2025/talk/RKQGMQ/feedback/ Track 2 Main Track - Short Talk 2026-04-10T11:00:00+01:00 11:00 00:20 In Grayzone Warfare: From IT Systems to OT Effects, Ian Thornton‑Trump CD examines how modern cyber conflict operates in the space “between peace and war,” where adversaries pursue strategic advantage without crossing traditional thresholds of armed conflict. Using his established insights into hybrid warfare and cyber‑physical risk, Thornton‑Trump reveals how attacks that begin in enterprise IT environments increasingly cascade into operational technology (OT), critical infrastructure, and industrial control systems. This session presents cyber incidents as components of intentional grayzone campaigns that blend espionage, disruption, economic coercion, and psychological pressure. Thornton‑Trump demonstrates how weaknesses in identity systems, supply chains, governance, and security visibility are exploited to bridge IT and OT, turning digital access into real‑world consequences—including safety risks, service disruption, and national‑level instability. Ultimately, this presentation challenges leaders and security professionals to view cyber defense as a matter of operational safety and geopolitical reality—recognizing and countering grayzone activity before IT compromise becomes irreversible OT impact. bsides-ot-uk-2025-89216-grayzone-warfare-from-it-systems-to-ot-effects Ian Thornton-Trump CD en Here are my key takeaways: Cyber Conflict Now Lives Below the Threshold of War Modern adversaries deliberately operate in the grayzone—conducting cyber operations that avoid attribution, legal response, or escalation. IT Compromise Is the Gateway to OT Impact Attacks rarely begin in industrial environments. Instead, identity systems, remote access, supply chains, and poorly governed enterprise IT are used as ingress points, allowing adversaries to pivot toward operational technology. Cyber Effects Are Increasingly Physical and Strategic Grayzone cyber operations can produce real‑world outcomes including service disruption, equipment damage, environmental harm, and public loss of trust. These effects deliver strategic leverage while maintaining plausible deniability, making them powerful although limited tools of state and proxy actors alike. Defenders Must Think Like Strategists, Not Just Technicians Effective defense requires understanding attacker intent, dwell time, and campaign objectives—not just indicators of compromise. false https://pretalx.com/bsides-ot-uk-2025/talk/CWZKFV/ https://pretalx.com/bsides-ot-uk-2025/talk/CWZKFV/feedback/ Track 2 Main Track - Short Talk 2026-04-10T11:25:00+01:00 11:25 00:20 Your incident response playbook has been battle-tested through countless IT security incidents. You know the drill, isolate compromised systems, preserve evidence, rebuild from known-good baselines. But in operational technology environments, these same best practices can be catastrophic. This talk examines the dangerous assumptions that IT security teams make when responding to OT incidents in critical national infrastructure. Through real-world scenarios, we'll explore why standard IR practices, from immediate network isolation to credential resets, need fundamental rethinking when dealing with industrial control systems. Learn what happens when you try to "pull the plug" on a system controlling safety mechanisms, why forensic imaging a 15-year-old PLC isn't an option, and how to navigate the tension between investigation needs and operational reality. This session will challenge your assumptions and provide practical frameworks for adapting your IR methodology before an incident puts them to the test. bsides-ot-uk-2025-87751-what-your-it-response-playbook-gets-wrong-about-ot James John en false https://pretalx.com/bsides-ot-uk-2025/talk/FS7LKR/ https://pretalx.com/bsides-ot-uk-2025/talk/FS7LKR/feedback/ Track 2 Main Track - Long Talk 2026-04-10T12:00:00+01:00 12:00 00:40 Presentation will discuss practical aspects of SCADA protocol security, and includes work from my MSc In Ethical Hacking & Cybersecurity dissertation "Enumeration and Attack Tools for the DNP3 SCADA Protocol Used in the Energy Industry" Topics covered: What SCADA protocols are and where are they used Why some of them are inherently insecure How threat actors have used SCADA protocols to compromise real OT systems Technical coverage of DNP3 including: * Overview of DNP3 protocol * Demonstration of custom tools (replicating threat actor capabilities): * How DNP3 can be enumerated * MITM data manipulation attacks compromising data integrity * Direct protocol injection commands * Details on DNP3 specific security settings General practical measures to improve the security of SCADA systems bsides-ot-uk-2025-89920-scada-protocol-security-what-is-the-answer-and-why Dave Gunn en false https://pretalx.com/bsides-ot-uk-2025/talk/YBPBFN/ https://pretalx.com/bsides-ot-uk-2025/talk/YBPBFN/feedback/ Track 2 Main Track - Long Talk 2026-04-10T13:40:00+01:00 13:40 00:40 Industrial Control Systems and Operational Technology security is a growing field, but the barrier to entry remains prohibitively high. Commercial PLCs cost hundreds of pounds, training courses run into thousands, and purpose-built lab equipment can rival the price of a small car. This leaves aspiring OT security researchers stuck reading theory without hands-on practice. This talk charts a practical journey from zero to a functional OT security lab without breaking the bank. We begin with purely software-based approaches using OpenPLC and PyModbus to simulate industrial environments on hardware you already own. From there, we graduate to Arduino and microcontroller-based solutions, which run real PLC logic on inexpensive development boards. We then enhance these setups with LEDs, switches, and physical I/O to visualize ladder logic execution in real-time, making abstract concepts tangible. To bring industrial processes to life, we explore 3D-printed models of substations, pumpjacks, and conveyor systems that respond to PLC outputs, creating compelling demonstrations without the need for large industrial budgets. We also navigate the second-hand market for genuine PLCs and HMIs, discussing the licensing pitfalls, firmware challenges, and security considerations that await bargain hunters. Finally, we announce the open-source release of the ModPwn Challenge Board a Raspberry Pi Pico-based Modbus challenge board - a complete attack and visualisation platform buildable for under £15, enabling anyone to practice Modbus protocol attacks and visualise the inputs and output. Attendees will leave with practical blueprints, parts lists, and open-source tools to build their own OT security labs immediately. bsides-ot-uk-2025-88481-getting-into-ot-security-on-a-budget-from-software-simulations-to-practical-ranges KevTheHermit en false https://pretalx.com/bsides-ot-uk-2025/talk/LSFGHC/ https://pretalx.com/bsides-ot-uk-2025/talk/LSFGHC/feedback/ Track 2 Main Track - Short Talk 2026-04-10T14:20:00+01:00 14:20 00:20 Operational Technology (OT) cyber risk is one of the few topics where you can brief three audiences—engineers, the Board, and a regulator—and still feel like you’ve spoken three different languages. This talk is about that translation problem. I’ll share a practical way to explain OT cyber risk at leadership level (without turning it into either a Hollywood script or “it’s just IT”), and how the complexity increases when you also need to provide confidence to an external overseer—without over-promising, name-dropping frameworks, or producing a one-off “assurance pack” that nobody maintains. We’ll cover: Why OT is different in ways that matter to governance: safety, availability, lifecycle, and constraints that are genuinely non-negotiable The Board narrative vs the regulator narrative: what changes, what must stay consistent What credible evidence looks like (and what looks like security theatre) The small set of artefacts that do most of the work: ownership, asset visibility, remote access, segmentation, monitoring, incident readiness Handling the awkward questions (“So are we safe?”, “Is it compliant?”, “What’s our worst day?”) with honesty and momentum No war stories and no named organisations—just patterns, pitfalls, and a set of reusable structures you can take back to your own environment. bsides-ot-uk-2025-90075-explaining-ot-cyber-to-the-board-was-hard-enough-then-the-regulator-asked-for-evidence David Jones en The translation problem (why OT cyber becomes garbled between technical reality and governance language) Three audiences, three needs Engineering: reduce risk without breaking operations Board: decisions, trade-offs, investment, accountability Regulator/overseer: confidence, evidence, progress, proportionality A simple story you can reuse (risk framing that works in leadership settings) Evidence that matters (what to show, how to show it, how to avoid theatre) Practical “next 90 days” (what moves the needle most reliably) false https://pretalx.com/bsides-ot-uk-2025/talk/FBQWJP/ https://pretalx.com/bsides-ot-uk-2025/talk/FBQWJP/feedback/ Track 2 Main Track - Short Talk 2026-04-10T14:40:00+01:00 14:40 00:20 The European Cyber Resilience Act (CRA) represents one of the most significant regulatory shifts in product cybersecurity to date—particularly for operators and manufacturers of operational technology. This talk provides a practical, experience‑driven exploration of what the CRA means for OT environments and the emerging landscape of product security regulation. Attendees will gain a clear understanding of the CRA’s objectives, lifecycle‑oriented security requirements, vulnerability reporting obligations and conformity assessment pathways. The session will map CRA requirements to existing frameworks highlighting both areas of alignment and critical gaps that OT manufacturers and integrators must address. The talk will also examine the CRA’s timeline, expected industry impact, and how organisations can turn regulatory pressure into opportunities by strengthening SDLC processes, maturing vulnerability handling (including SBOM and coordinated disclosure), and building scalable security testing capabilities. Finally, the session offers insights into preparing for the next 24 months of uncertainty and rapid change, including the role of harmonised standards, CE marking challenges, and strategic considerations for both internal teams and clients navigating compliance. This presentation provides OT security professionals with a roadmap for readiness—grounded in regulatory expertise, industrial experience, and a focus on enabling secure‑by‑design products in a fast‑evolving European regulatory landscape. bsides-ot-uk-2025-89530-crazy-about-product-security-navigating-the-cyber-resilience-act Zachary Sleath en false https://pretalx.com/bsides-ot-uk-2025/talk/TBYEYY/ https://pretalx.com/bsides-ot-uk-2025/talk/TBYEYY/feedback/ Track 2 Main Track - Long Talk 2026-04-10T15:20:00+01:00 15:20 00:40 Most OT security failures don’t happen because the technology was wrong, they happen because the security programme didn’t fit how manufacturing actually operates. This session focuses on the operational and organisational reality of embedding OT security in live production environments, drawing on experience leading a £97m global OT security programme across 77 manufacturing sites. Rather than centring on attack mechanics, the talk explores what it truly takes to introduce security into environments where uptime, safety, and throughput are non-negotiable. Attendees will learn how OT security initiatives succeed or fail based on governance alignment, decision-making authority, and cultural adoption on the shop floor. The presentation examines common friction points: engineering resistance, unclear ownership between IT and operations, security controls that disrupt maintenance, and change processes that collapse under incident pressure. Through real-world examples, the session shows how organisations can shift OT security from a bolt-on technical function into an embedded operational capability. It explores how to design security programmes that engineers trust, operators understand, and leadership supports, without slowing production or increasing risk. The talk also addresses how resilience is built over time through repeatable processes, training, and scenario-based planning, rather than one-off tool deployments. It concludes with a forward-looking view of how emerging threats, regulatory pressure, and supply chain complexity make operational resilience a board-level responsibility. Attendees will leave with: A clear understanding of why OT security programmes succeed or fail operationally Practical approaches to aligning security with engineering and production priorities Change-management strategies that work in industrial environments Insight into building resilience through people, process, and governance — not just tools Actionable ideas for embedding security into day-to-day operations without disrupting uptime The session will include interactive discussion and open Q&A, allowing participants to share challenges, compare approaches, and leave with practical, real-world insights they can apply immediately. bsides-ot-uk-2025-88479-why-ot-security-fails-on-the-factory-floor-and-how-to-make-it-stick John Allen en false https://pretalx.com/bsides-ot-uk-2025/talk/WBKRE3/ https://pretalx.com/bsides-ot-uk-2025/talk/WBKRE3/feedback/ Track 2 Main Track - Long Talk 2026-04-10T16:00:00+01:00 16:00 00:40 Command and Control Servers have long existed for IT facing networks. They are the central infrastructure which allow adversaries to maintain persistent remote control over compromised systems and orchestrate large-scale cyberattacks. What if adversaries brought these tactics to OT? This presentation explores the creation of C2 infrastructure specifically for OT Networks, using the OPC UA protocol as the example. We can examine how the OPC UA protocol can be abused to enable covert data exfiltration from airgapped networks, and how we can connect to an OPC UA server to create persistent command channels that blend with legitimate industrial traffic. Through a practical demonstration using Factory I/O and containerized PLCs, this presentation reveals the techniques adversaries could use to maintain covert control over industrial systems while evading traditional security monitoring. bsides-ot-uk-2025-88956-breaking-the-air-gap-covert-command-and-control-attacks-on-industrial-systems James Sabin en As OT environments become increasingly connected, the security assumptions that protected air-gapped systems are eroding. This presentation examines how adversaries can adapt IT-based Command and Control techniques to operational technology networks, with a specific focus on abusing the OPC UA protocol. We'll explore the technical mechanics of creating covert C2 channels with OPC UA communications, demonstrating how legitimate industrial protocols can be weaponized for data exfiltration and persistent control. Using a simulated industrial environment with Factory I/O and containerized PLCs, attendees will see firsthand how these attacks operate within realistic OT contexts. Topics include: Fundamental differences between IT and OT C2 infrastructure requirements OPC UA protocol structure and abuse opportunities Techniques for blending malicious traffic with legitimate industrial communications Detection challenges / defensive considerations. false https://pretalx.com/bsides-ot-uk-2025/talk/EYYJ8Z/ https://pretalx.com/bsides-ot-uk-2025/talk/EYYJ8Z/feedback/ Rookie, Student and Careers Track Rookie Track 2026-04-10T10:00:00+01:00 10:00 00:20 Remote access keeps OT environments running, but it also concentrates risk. Many incidents do not start with a sophisticated Programmable Logic Controller (PLC) exploit. They start at the “front door”: vendor VPNs, jump hosts, shared support accounts, and rushed identity checks during outages. According to the SANS State of ICS/OT Security 2025 findings, about half of ICS/OT incidents begin with unauthorised external access, often through third-party remote maintenance. This 20-minute talk shows how to secure OT remote support without breaking production. Using a simple “front door path” diagram (Vendor → Remote Access → Jump Host → Engineering/HMI), we cover two repeatable failure areas: 1) remote access pathways that become broader or more permanent than intended, and 2) identity/support workflows that expand access under operational pressure. For each, we pair the risk with practical controls that work in legacy OT environments: time-boxed vendor access, least-privilege support identities, and a safety-aware “normal vs emergency” access lane that preserves availability while improving accountability. We close with three high-fidelity monitoring signals you can implement even in legacy OT environments: authentication anomalies, interactive remote logons, and privilege/role changes. I’ll map these signals to common jump-host and remote-access setups, and include one worked example from Windows event logs (e.g., 4624/4625, RDP logon type 10, 4728/4732). We finish with an actionable OT access plan that attendees can apply immediately. bsides-ot-uk-2025-89215-fixing-the-front-door-securing-ot-remote-access-without-killing-production /media/bsides-ot-uk-2025/submissions/W3GSMN/Slide_1_-_The_Exp_aKop46Y.webp Richard Dosumu en Key Takeaway for Attendees: - A clear “front door” remote access path model for OT (diagram-led) - Controls that work under OT constraints: time-boxed access, least privilege, and a safety-aware normal vs emergency access lane - Three high-fidelity jump host monitoring signals using basic Windows logs (4624/4625 patterns, RDP logon type 10 anomalies, privileged group changes) - A short, actionable OT access plan to implement without disrupting operations Audience: OT/ICS engineers, plant IT, SOC/IR supporting OT, vendors/integrators, and anyone interested in actionable knowledge transfer. false A diagram-led, 4-slide visual summary of the talk showing the OT remote-access “front door” risk path, the two-lane access model, emergency-lane guardrails, and a practical 5-week implementation plan https://pretalx.com/bsides-ot-uk-2025/talk/W3GSMN/ https://pretalx.com/bsides-ot-uk-2025/talk/W3GSMN/feedback/ Rookie, Student and Careers Track Rookie Track 2026-04-10T10:20:00+01:00 10:20 00:20 Operational Technology (OT) environments are people-first systems, where operators, engineers, vendors and security teams are making real-time decisions that directly impact safety, production and business continuity/uptime. For example, when incidents occur, technical controls alone are rarely the deciding factor, whereas communication is. This talk aims to explore why "soft skills" such as risk translation, negotiation and de-escalation are actually safety-critical OT security controls. Drawing on experiences common to women in cyber and OT roles, the session will aim to highlight how skills often labelled as "non-technical" directly impacts safety, resilience and uptime (Why women often develop these skills early.). Rather than focusing solely on incidents, the talk aims to examine the everyday decisions and interactions that determine whether OT security controls are adopted, ignored or bypassed. The talk will also look at practical moments that define OT security success (i.e. managing vendor relationships where tone matters more than technical accuracy). The aim is to have attendees leave with a reframed understanding of OT security maturity, where human communication, coordination and trust are recognised as essential components of effective risk management. bsides-ot-uk-2025-89882-soft-skills-in-a-hard-hat-world-why-communication-is-one-of-the-most-critical-ot-security-controls /media/bsides-ot-uk-2025/submissions/9XADNA/Soft_Skills_MwyjE_G4SVloo.webp Fiona Kastrati en The skills we call "soft" are often the ones holding OT security together This talks looks at OT environments as people-first systems and explores how communication, negotiation and trust directly affect risk assessments, supply chain security and day-to-day OT security decisions. It examines why authority in OT is built through credibility and relationships rather than job titles, and how security outcomes are shaped in meetings as much as technical controls. Grounded in real OT security work and experiences common to women in OT and cyber roles, the session reframes so-called "soft-skills" as operational risk controls that materially impact safety and resilience. false https://pretalx.com/bsides-ot-uk-2025/talk/9XADNA/ https://pretalx.com/bsides-ot-uk-2025/talk/9XADNA/feedback/ Rookie, Student and Careers Track Workshop 2026-04-10T11:00:00+01:00 11:00 00:50 Attackers are using GenAI to get better at what they do. Why aren't more of us as defenders? The truth is that the majority of OT/ICS enviornments have limited (to no) budgets for OT/ICS cybersecurity. And yet, we're expected to continue to do more with less. GenAI platforms can act as the great equalizer and help us successfully defend our environments - and it doesn't have to be difficult! This session will walkthrough creating both offensive and defensive tools for OT/ICS environments, providing detailed prompts to help YOU secure OT/ICS! bsides-ot-uk-2025-89915-creating-offensive-and-defensive-tools-for-ot-ics-with-genai /media/bsides-ot-uk-2025/submissions/839MA7/Copy_of_Keeping_4_T6cmEOc.webp Mike Holcomb en false https://pretalx.com/bsides-ot-uk-2025/talk/839MA7/ https://pretalx.com/bsides-ot-uk-2025/talk/839MA7/feedback/ Rookie, Student and Careers Track Rookie Track 2026-04-10T12:00:00+01:00 12:00 00:20 Cross domain solutions are the gold standard for bridging air-gapped networks, a classic example being between IT and OT networks. Specialist and often with an eye-watering price tag they are mostly out of reach of security researchers and tinkerers alike, but what if you could build something using the same fundamental principles for the price of a round of drinks? bsides-ot-uk-2025-89935-from-currys-to-classified-20-cross-domain-solutions /media/bsides-ot-uk-2025/submissions/XKVN8M/cds_PVsKm0C_UjpLylA.webp Laurence Halfpenny en In this talk we'll take a £10 unmanaged network switch and, using a CH341A programmer, modify its EEPROM to change its behaviour. By configuring port isolation masks we can prevent ports from talking back to one another, creating a firmware defined data diode. The diode is just the one-way valve; a cross domain solution needs to handle more complicated data flows. This is where we'll spend our remaining £10 on a microcontroller with an ethernet port and just enough firmware to manage a protocol break and some data verification. Whether you are securing a power plant, or just here to bully cheap silicon into doing your bidding, this talk will demonstrate implementing cross domain fundamentals can be done on a shoestring budget. false https://pretalx.com/bsides-ot-uk-2025/talk/XKVN8M/ https://pretalx.com/bsides-ot-uk-2025/talk/XKVN8M/feedback/ Rookie, Student and Careers Track Student Track 2026-04-10T12:20:00+01:00 12:20 00:20 Security analysts or operators know that an intrusion occurred but they often cannot answer these critical questions: Which physical processes are threatened? How will the attack evolve? What is the attacker likely to do next? Your security tools detect the attack, but critical context is missing. This gap, between technical detection and operational understanding, represents a fundamental blind spot in industrial security approaches. bsides-ot-uk-2025-90151-beyond-alerts-diagnosing-and-improving-situational-awareness-in-industrial-systems M. Endhy Aziz en This talk will introduce a structured methodology called AESICS, which reconceptualizes adversary emulation exercise as a diagnostic instrument for iterative ICS defense improvement. We will discuss how the framework can help analysts to systematically identify multi-dimensional situational awareness gaps and design targeted defensive enhancements to close those gaps. We also introduce SIMPLE ICS (Simulated Industrial Multi-tier Platform for Laboratory Emulation of Industrial Control Systems) testbed, a sector-agnostic, Purdue-aligned industrial testbed architecture that models modern industrial environments. We will present the result from the AESICS using this testbed and empirically test the methodology for quantifying and assessing defensive improvement based on the AESICS methodology. Throughout the session, we will walk through: - A reusable industrial testbed architecture guide using SIMPLE ICS. - A structured diagnostic approach you can implement immediately, turning vague ‘improve security’ into specific quantifiable security improvement. - A quantified metrics framework for measuring situational awareness gaps. false https://pretalx.com/bsides-ot-uk-2025/talk/Z7XUUH/ https://pretalx.com/bsides-ot-uk-2025/talk/Z7XUUH/feedback/ Rookie, Student and Careers Track Student Track 2026-04-10T13:40:00+01:00 13:40 00:20 This talk addresses the challenges Critical National Infrastructures (CNIs) face during on-going adversarial campaigns as they could cause physical damaged and even threaten life. Defenders struggle to keep CNIs operational (albeit at reduced capacity) whilst they try to wipe attackers out of their systems. By monitoring network telemetry, we will explore how we can identify in near-real-time different ways a campaign could escalate to an unsafe state and place the minimum mitigations required to keep CNIs operational. bsides-ot-uk-2025-89840-dynamic-risk-assessment-for-critical-national-infrastructures Kostas Anastasakis en Since Critical National Infrastructures (CNIs) have become one of the main targets for nation state threat actors, keeping them both safe and operational during an adversarial campaign is particularly challenging. Especially the increase of their interconnectivity with Internet devices is exposing them to even more potential attack paths, making risk identification and consequently incident handling impossible. Traditional risk assessment methods fall short to address the rapidly evolving nature of vulnerability landscape. Hence, there is a need for a near-real-time dynamic risk assessment approach which aims to keep a CNI operational during an on-going attack, albeit at reduced capacity, by applying the minimum necessary mitigations. We suggest a model which identifies how/if an adversarial campaign could potentially escalate to an unsafe state of the CNI, such as physical damage or threatening life, and isolates the part of the network that could lead to such escalation. This approach combines Fault Tree Analysis, Dempster-Shafer Theory and the MITRE ATT&CK framework for deriving a near-real-time model which can adapt while an attack unfolds. false https://pretalx.com/bsides-ot-uk-2025/talk/QVYJ8A/ https://pretalx.com/bsides-ot-uk-2025/talk/QVYJ8A/feedback/ Rookie, Student and Careers Track Student Track 2026-04-10T14:00:00+01:00 14:00 00:20 A short exploration of industrial honeypot research in its current state, including what popular solutions look like; what function they perform; how cyber deception benefits industrial control systems; what challenges their deployment; and what future research could look like in this area. Despite being a defensive technology, this talk will address honeypot research from both an offensive and defensive perspective. bsides-ot-uk-2025-89196-industrial-honeypots-challenges-and-research-opportunities Jacob Williams en false https://pretalx.com/bsides-ot-uk-2025/talk/X7HVZQ/ https://pretalx.com/bsides-ot-uk-2025/talk/X7HVZQ/feedback/ Rookie, Student and Careers Track Careers Track 2026-04-10T14:20:00+01:00 14:20 00:20 Amy is a Chartered Engineer with over 15 years' experience applying hardware cybersecurity principles across telecommunications, IoT, medical devices, transportation, and operational technology. This breadth of client work informs her current portfolio of consultancy, advisory, and NED roles. She is currently working with Kry10 on their verified seL4-based operating system for OT environments. In this talk, Amy will draw on her experience securing safety-critical systems and explain why an engineering background creates valuable common ground when working in someone else's OT environment. She will offer practical advice on bridging the safety-security divide and discuss how Chartered Engineer status has helped her build trust and reduce barriers. bsides-ot-uk-2025-89267-speaking-their-language-an-engineer-s-guide-to-the-safety-security-divide Amy Brooks en true https://pretalx.com/bsides-ot-uk-2025/talk/8HY9MZ/ https://pretalx.com/bsides-ot-uk-2025/talk/8HY9MZ/feedback/ Rookie, Student and Careers Track Careers Track 2026-04-10T14:40:00+01:00 14:40 00:20 OT security careers rarely follow neat, linear paths. This talk begins with the personal transition from Associate Professor of Cyber Security to Senior OT Security Consultant as a case study in how non-traditional career moves can become a strategic advantage rather than a risk. Drawing on experience across academia, consulting, and live operational environments, this session explores what actually builds credibility in OT security roles. It examines how demonstrating tangible operational impact earns trust with decision makers, why human factors are just as important as technical controls in OT, and how security decisions get made when safety and availability outweigh confidentiality. The talk also explores why cyber exercises are crucial to building organisational resilience. This is not a “which cert should I get next?” talk. Instead, it's about developing the mindset and skills that make OT security professionals effective in environments where production can't stop, downtime is measured in millions, and your credibility determines whether security recommendations become implementation plans or left at the side of the road. It is also about recognising how experience in teaching, research, or consulting strengthens your position. For students, career switchers, and practitioners feeling stuck, this talk offers a practical reframing: OT security rewards curiosity, breadth, and time spent in uncomfortable environments. If your career choices help you enable operations instead of obstruct them, you’re building the kind of experience the field actually needs. bsides-ot-uk-2025-89587-enable-don-t-obstruct-building-an-ot-security-career-that-actually-works RichardS en false https://pretalx.com/bsides-ot-uk-2025/talk/QSNB8R/ https://pretalx.com/bsides-ot-uk-2025/talk/QSNB8R/feedback/ Rookie, Student and Careers Track Careers Track 2026-04-10T15:20:00+01:00 15:20 00:20 This talk reflects on the lessons learnt through 10 years of cyber security consulting, sharing practical lessons from industry and highlighting what is often learned only through experience. It explores how technical skills, professional judgement, and soft skills such as communication and adaptability develop over time, and offers insight into common early career challenges and what matters most when progressing in the field. bsides-ot-uk-2025-89823-the-road-to-cyber-security-consulting George Chapman en false https://pretalx.com/bsides-ot-uk-2025/talk/FXAFPH/ https://pretalx.com/bsides-ot-uk-2025/talk/FXAFPH/feedback/ Rookie, Student and Careers Track Panel 2026-04-10T15:40:00+01:00 15:40 01:00 A Q&A with a panel of experts to provide guidance and advice on OT security careers bsides-ot-uk-2025-93759-careers-panel en false https://pretalx.com/bsides-ot-uk-2025/talk/ZPYS87/ https://pretalx.com/bsides-ot-uk-2025/talk/ZPYS87/feedback/ Workshops Workshop 2026-04-10T10:00:00+01:00 10:00 02:00 Monitoring is often seen as the silver bullet for ICS security, but how effective is it really? In this interactive lab, you will launch realistic attacks with CALDERA against a live industrial setup and evaluate detections across EDR, logs, and network monitoring tools. Discover OT blind spots and walk away with a clear methodology to assess and improve monitoring. bsides-ot-uk-2025-88094-assess-the-efficiency-of-your-ot-cyber-monitoring-with-caldera Arnaud SoullieJuliette Barbier en Security monitoring is often promoted as the cornerstone of Industrial Control System (ICS) defense, but how effective is it against real adversaries? Participants will gain access to a cloud-hosted, browser-based VM preloaded with CALDERA, the open-source adversary emulation framework. The physical cyber range includes a Windows SCADA and engineering station with EDR, PLCs from two different vendors, and centralized log and network monitoring, creating a realistic environment to explore both IT and OT attacks. Guided exercises begin with simulating a malicious remote user using malware and disabling security solutions, then progress to PLC reconnaissance and manipulation using ICS protocols such as Modbus, S7 and OPC-UA. An advanced scenario will also highlight how custom detection logic can be implemented in PLC & SCADA. Throughout the lab, adversaries and detection capabilities are mapped against MITRE ATT&CK for ICS, giving participants a structured way to evaluate monitoring effectiveness. The session concludes with a defensive checklist and guidance on extending these exercises into tabletop assessments. No prior ICS experience is required—just a laptop with a browser. Attendees leave with a repeatable methodology to assess and strengthen their own monitoring deployments. false https://pretalx.com/bsides-ot-uk-2025/talk/MHTBYY/ https://pretalx.com/bsides-ot-uk-2025/talk/MHTBYY/feedback/ Workshops Workshop 2026-04-10T13:20:00+01:00 13:20 02:00 This interactive workshop offers a practical, hands-on experience within an Operational Technology (OT) laboratory setting. Participants will work with real-world industrial control processes to gain a clear understanding of how OT systems function and where vulnerabilities can occur. Through guided activities, the session will uncover common cyber risks affecting critical infrastructure and demonstrate proven approaches to identifying, assessing, and managing these threats. By the end, attendees will appreciate the unique challenges of securing OT environments and take away practical strategies to strengthen resilience against evolving cyber threats. bsides-ot-uk-2025-88013-crossing-the-wire-defensive-ot-workshop-with-live-red-team-attack /media/bsides-ot-uk-2025/submissions/R3YCJA/OT_Lab_Image_1y63_2JV16Yh.webp Jonny Keiller en This purpose-built OT laboratory offers a practical environment for exploring industrial control systems and understanding cyber risks in a safe, controlled setting. At its centre is a hypervisor running a SCADA platform, which connects to four PLCs through ESP32 modules using the Modbus protocol. These PLCs manage a variety of physical processes, including motors, pump valves, lighting systems, and radio frequency controls linked to remote-controlled ship and helicopter models. The lab mirrors real-world operational technology scenarios, giving participants the chance to see how interconnected systems operate and where vulnerabilities can arise. Working with live processes rather than theory provides valuable insight into OT architecture, automation logic, and the potential impact of cyber threats on physical operations. This hands-on experience bridges the gap between IT and OT, making complex concepts clear and equipping learners with practical skills to manage risk effectively. false https://pretalx.com/bsides-ot-uk-2025/talk/R3YCJA/ https://pretalx.com/bsides-ot-uk-2025/talk/R3YCJA/feedback/ Cyber Escape Room Workshop 2026-04-10T10:00:00+01:00 10:00 01:30 OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be. What happens when a cyber incident doesn’t start with malware… but with a door? In this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast. As IT and OT systems become increasingly interconnected, the line between “IT security issue” and “OT safety problem” is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other. Set inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick. bsides-ot-uk-2025-89318-the-break-in-interactive-ot-cyber-escape-room Amy Stokes-Waters en This workshop delivers a fully interactive OT cyber incident simulation using The Cyber Escape Room Co.’s portable OT escape room experience, purpose-built for industrial and critical infrastructure environments. Participants are dropped straight into the action. A facility has been compromised. Physical access has been interfered with. Systems are behaving strangely. Information is incomplete. The clock is ticking. Working in small teams, attendees will: • Investigate physical and digital clues to uncover how the incident occurred • Experience first-hand how IT security failures can cascade into OT impact • Restore access to OT systems • Communicate findings to a simulated SOC and incident response function • Make judgement calls that balance security, safety, and operational continuity The scenario deliberately blends IT and OT considerations, reflecting how modern environments actually operate. Participants will see why traditional IT-only approaches often fall short in OT, and why OT teams can’t afford to ignore IT security practices as systems become more connected. This is not about “winning” an escape room. It’s about learning through experience. The session finishes with a guided debrief that translates the scenario into practical, actionable takeaways covering: • The growing convergence of IT and OT security • Human and process failures that attackers exploit • Physical security as a cyber control • How to improve collaboration between IT, OT, and security teams No prior escape room experience is needed. The workshop is designed to be accessible, engaging, and genuinely fun, while still delivering serious insight for OT engineers, security professionals, and anyone responsible for protecting operational systems. false https://pretalx.com/bsides-ot-uk-2025/talk/7Q99SU/ https://pretalx.com/bsides-ot-uk-2025/talk/7Q99SU/feedback/ Cyber Escape Room Workshop 2026-04-10T13:40:00+01:00 13:40 01:30 OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be. What happens when a cyber incident doesn’t start with malware… but with a door? In this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast. As IT and OT systems become increasingly interconnected, the line between “IT security issue” and “OT safety problem” is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other. Set inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick. bsides-ot-uk-2025-93761-the-break-in-interactive-ot-cyber-escape-room-session-2 Amy Stokes-Waters en false https://pretalx.com/bsides-ot-uk-2025/talk/SYFXHW/ https://pretalx.com/bsides-ot-uk-2025/talk/SYFXHW/feedback/ Cyber Escape Room Workshop 2026-04-10T15:20:00+01:00 15:20 01:30 OT incidents don't start with sirens and flashing dashboards. They start with something small. A door left unlocked. A badge clones. A laptop plugged in where it shouldn't be. What happens when a cyber incident doesn’t start with malware… but with a door? In this fast-paced, hands-on workshop, The Cyber Escape Room Co. invites attendees to step inside a live OT cyber escape room and experience an industrial incident from the inside out. No slides. No lectures. Just teamwork, time pressure, and a compromised operational environment that needs fixing fast. As IT and OT systems become increasingly interconnected, the line between “IT security issue” and “OT safety problem” is disappearing. This workshop is designed to reflect that reality. Participants will investigate how physical security gaps, IT failures, and OT constraints combine to create real-world risk, and how incident response decisions in one domain directly affect the other. Set inside a fictional but highly realistic industrial scenario, attendees will act as the on-site response team, working together to regain access to systems, identify the breach, and prevent further operational impact. The experience concludes with a practical debrief linking the chaos back to real OT and IT security lessons that actually stick. bsides-ot-uk-2025-93762-the-break-in-interactive-ot-cyber-escape-room-session-3 Amy Stokes-Waters en false https://pretalx.com/bsides-ot-uk-2025/talk/US3MJK/ https://pretalx.com/bsides-ot-uk-2025/talk/US3MJK/feedback/