In a timely and candid webinar hosted by Axio, leading experts discussed what’s working (and what’s not) in industrial cybersecurity as we look toward 2025. Featuring insights from cybersecurity veteran Matt Morris, OT product expert Grayson Estes, and Axio President David White, the session revealed a common theme: many organizations are still missing the mark on the fundamentals, even as threats grow more advanced.
We encourage you to watch the recording of the webinar to hear the full discussion. In the meantime, below is a summary of the key takeaways.
One of the most urgent concerns discussed was the growing sophistication of nation-state actors, particularly China. Campaigns like Volt Typhoon highlight that adversaries aren’t just trying to break in; they already have the keys. “They’re in the systems, mapping them quietly, waiting,” Morris warned. The implications are clear: critical infrastructure is vulnerable to pre-positioned cyberattacks that may strike without warning.
Despite heightened awareness, many industrial organizations still struggle with cybersecurity basics:
Without these foundational elements, even the best detection tools won’t offer meaningful protection.
Too many teams are overwhelmed by vulnerability reports and compliance checklists, stuck in reactive mode. “You can’t fix everything,” said Morris, “but you can do enough to become a harder target than the next guy.” This means focusing on what matters most.
That’s where Cyber Risk Quantification (CRQ) comes in. CRQ provides a structured, data-informed way to model and prioritize risk based on business impact – not fear, not hype. By simulating “what-if” scenarios, organizations can:
As White emphasized, “CRQ conversations look a lot like tabletop exercises, but with numbers attached.” It’s a powerful way to align teams, surface blind spots, and guide funding to the most impactful areas.
Asked whether digital transformation is making OT more secure or more complex, the panel agreed: both. More connected devices and AI-enabled platforms can improve performance, but also expand the attack surface. AI itself is a double-edged sword, with attackers likely already using it to evade detection.
We wrapped the webinar with a call to action:
As geopolitical tensions rise and cyber capabilities become more weaponized, the message was clear: industrial organizations must adopt a civil defense mindset focused on resilience, not just defense.
CRQ is the key to making that mindset actionable.
For a deeper dive into these insights, watch the full webinar recording here.
Have questions about your transition? Connect with our experts to support your cybersecurity program.