Most board cyber briefings are built around data. How much we hold, where it lives, who could take it, what a breach would cost in notification, regulatory exposure, and reputation. That framing is correct for the risk it describes, and it has been refined over a decade of breach headlines.
It also transfers badly to operational technology. When OT fails, the loss is not primarily informational. It is production stopped, product ruined, a safety system in an unexpected state, a delivery commitment missed, a regulator asking why. Directors who have been trained to ask “what data was at risk” often have no equivalent question ready for “what could stop, and for how long.”
Five misconceptions come up repeatedly.
“Our OT is air-gapped”
This is usually said in good faith and is usually no longer true. Air gaps erode for ordinary business reasons: remote diagnostics that reduce truck rolls, production data that feeds business reporting, a vendor who needs firmware access, a historian that must reach the enterprise, a contractor with a cellular modem installed for convenience during a commissioning window that nobody removed.
The right question is not whether the gap exists on the architecture diagram. It is who has verified it recently, by testing rather than by asking, and what the verification found.
“The IT team has it covered”
OT security decisions frequently exceed IT’s authority. Patching a control system may require a production outage that only operations can authorize. Replacing an unsupported operating system may require a capital project. Adding monitoring may void a vendor warranty or a validated configuration. Segmenting a plant network may change how maintenance is performed.
When those decisions belong to operations and the accountability sits with IT, nothing moves. The board-level issue is not competence. It is decision rights, and whether anyone has the authority to trade a maintenance window against a risk.
“We would detect it”
Enterprise detection is mature in most organizations and largely blind in OT. Industrial protocols are not what endpoint agents parse, many controllers cannot host an agent at all, and the traffic patterns that indicate compromise in an office network look nothing like those on a plant floor. Where OT monitoring exists, it often watches for process anomalies rather than security events, and reports to operations rather than to the SOC.
The question that exposes this: if a controller were reconfigured tonight, which team would see it, in what system, and how would that reach an executive?
“It is a technology problem, so it has a technology fix”
Boards are accustomed to approving tools. OT exposure is rarely closed by a purchase. It is closed by architecture, by segmentation projects that touch production, by vendor contract terms, by access governance, by exercises that establish who decides during an incident, and by lifecycle plans for equipment that will run for twenty more years. These are program decisions with schedules and trade-offs, not line items.
“Our compliance posture covers it”
Compliance frameworks establish floors and are worth meeting. They also tend to lag the way plants are actually run, and passing an assessment says little about whether an attacker could move from a phished credential to a process controller. A defensible compliance position and a defensible architecture are different claims, and directors are often shown only the first.
Better questions for the board packet
Directors do not need to understand industrial protocols. They need reporting that answers questions leadership can act on.
Which operations could an attacker stop, and what is the credible duration? Not a maximum theoretical loss, but a modeled interruption with a recovery estimate someone has actually tested.
Which single accounts or vendor paths could affect both enterprise systems and physical operations, and who reviews them?
Who has the authority to take production offline to remediate a security finding, and how quickly can that decision be made?
What have we rehearsed? Specifically, has leadership ever run a scenario in which a digital compromise produced a physical consequence, and what did it reveal about escalation and communications?
Which equipment reaches end of support in the next three years, and what is the plan when patching is no longer an option?
The underlying shift
Enterprises are asked to govern security across two domains that fail differently. The data domain fails as disclosure and cost. The operational domain fails as interruption and safety. Governance that reports only on the first will always look more complete than it is.
The correction is a single risk picture that names what can stop, who owns it, and what the organization has practiced. That is a board’s work, not the technology team’s, and it is the part that no tool purchase produces.