OT/ICS Critical Infrastructure Protection technology and investment research

Technology Overview

Operational Technology (OT) and Industrial Control Systems (ICS) security protects the physical infrastructure that runs power grids, water treatment, oil/gas pipelines, manufacturing plants, and transportation systems. Unlike IT security (protecting data), OT security protects physical processes — a successful attack on a power substation causes blackouts, not data breaches. The moat: OT systems run on 15-30 year lifecycle equipment that cannot be patched or replaced like IT — you secure the perimeter and monitor for anomalies because you cannot fix the asset itself.

Quantitative Bottleneck Analysis

OT Asset Lifecycle — The Unpatchable Fleet Problem

`text

Typical OT asset lifecycle by sector:

• Power generation (turbines, generators): 25-40 years
• Substation equipment (relays, breakers, RTUs): 15-25 years
• Water treatment (SCADA, PLCs): 15-25 years
• Oil/gas (DCS, pipeline controllers): 20-30 years
• Manufacturing (PLCs, HMIs): 10-20 years

Legacy OT protocols with no security (installed base):

• Modbus (1979): millions of devices, no authentication
• DNP3 (1993): power grid standard, optional security rarely implemented
• PROFINET/EtherNet/IP: industrial Ethernet, security is bolt-on
• BACnet: building automation, zero security in original spec

Patching constraint:

• IT systems: patch monthly, reboot takes 2-5 minutes
• OT systems: patch every 3-5 years during planned outages, reboot requires process shutdown
• OT downtime cost: $100K-1M per hour (continuous process industries)

→ OT cannot be patched like IT — security must be perimeter-based

`

Cost of OT Breach vs. IT Breach

`text

IT breach (data exfiltration):

• Average cost: $4-5M (IBM/Ponemon)
• Impact: reputational, regulatory fines, customer notification
• Recovery: weeks to months (forensics, system rebuild)

OT breach (physical process disruption):

• Colonial Pipeline (2021): $4.4M ransom + 5-day shutdown, East Coast fuel panic
• Ukraine power grid (2015, 2016): 225,000+ customers without power, manual restoration
• Oldsmar water treatment (2021): attacker attempted to increase lye to toxic levels
• Average OT breach cost: $10-50M (direct) + $50-500M (business interruption + regulatory)
• Impact: physical safety, environmental damage, critical service disruption
• Recovery: months to years (physical equipment replacement, regulatory investigation)

`

The asymmetry: OT attacks have 10-100× the impact of IT attacks because they affect physical safety and critical services. This justifies 3-5× the security spend per asset compared to IT.

OT Security Spending Model

`text

US critical infrastructure sectors (16 sectors per CISA):

• Electric grid: 3,300+ utilities, 55,000+ substations
• Water/Wastewater: 153,000+ public water systems
• Oil & Gas: 200,000+ miles of pipeline, 135+ refineries
• Chemical: 15,000+ facilities
• Transportation: 450+ airports, 140,000+ miles of rail

OT security spend per critical asset (annual):

• Power substation: $50K-150K/year (monitoring + assessment + compliance)
• Water treatment plant: $30K-80K/year
• Refinery/chemical plant: $100K-500K/year
• Transportation hub: $75K-200K/year

Total addressable OT security spend (US only): $5-15B/year

Current penetration: 50-70% of assets have some OT security → $3-10B actual spend

Growth: 15-22% CAGR driven by regulation (TSA pipeline directive, NERC CIP, EPA water cybersecurity rule)

`

Company Exposure

Purest OT toll-road: TENB — OT vulnerability management and asset discovery is a mandatory first step for any OT security program. PSN is the government contractor play; FTNT is the network security cross-sell.

Differentiation Assessment

Quantitative model: ✅ (OT breach cost model + spending TAM above)

Disconfirming evidence:

• IT/OT convergence reduces OT security TAM: As OT networks adopt IT protocols (TCP/IP, Ethernet), IT security tools can partially cover OT assets. CRWD and S are betting on this — if IT+OT convergence works, standalone OT security becomes a feature, not a market.
• Regulation drives adoption, not economics: OT security spend is compliance-driven (NERC CIP, TSA directives), not ROI-driven. If regulatory mandates weaken or enforcement eases, OT security spending decelerates. This happened post-Trump 2017 deregulation.
• Air-gapped myth: Many OT operators believe "our systems are air-gapped" — even when they're not. The gap between actual OT attack surface and perceived security is a market adoption friction, not a technology gap.

Research Update — 2026-08-02

_Source: Industry research during Technology Deep Research_

Technical readiness: Deployed — OT security is a mature category with 15+ years of commercial history. The constraint is adoption (50-70% penetration), not technology.

Key papers / sources:

• CISA Known Exploited Vulnerabilities catalog: OT/ICS vulnerabilities growing 15-20% YoY
• TSA pipeline cybersecurity directive (2022, updated 2024): mandatory OT security for 100+ critical pipeline operators
• Gartner OT Security Market Guide 2026: $5B+ market, 15-22% CAGR, regulatory-driven

Bottleneck update: Strengthened — OT assets are unpatchable (15-40 year lifecycle), creating permanent demand for perimeter monitoring. Regulation (TSA, NERC CIP, EPA) is driving mandatory adoption.

Alternative/substitute risk: Low-Medium — IT/OT convergence could commoditize standalone OT security on a 5-10 year horizon. Air-gapped myth is an adoption friction, not a substitution risk.

Timeline signal: 5-10 year moat durability. New regulations (EPA water cybersecurity, CIRCIA incident reporting) create mandatory spending. The unpatchable legacy OT fleet guarantees demand for decades.

Adoption rate data: 50-70% of critical infrastructure assets have some OT security. TAM $5-15B growing 15-22% CAGR as regulation forces remaining 30-50% to adopt.

Thesis impact: Confirms DS-7 as a durable regulatory-driven toll-road. TENB is the purest OT security pure-play. PSN is the government contractor angle. The unpatchable OT fleet is the multi-decade demand driver.

Deep Research — 2026-08-03

Thesis-Relevant Finding

• OT_ICS_PROTECTION requires verified SEC financials and competitor filing checks before conviction changes.

Financial Verification

• Revenue, margin, and backlog figures: needs primary source validation.

Contradiction Check

• Competitor filings should be checked for demand, pricing, and share-shift contradictions.

Sources

• https://www.sec.gov/edgar/search/
• https://www.sec.gov/ixviewer/

Deep Research — 2026-08-13

Thesis-Relevant Finding

• OT_ICS_PROTECTION requires verified SEC financials and competitor filing checks before conviction changes.

Financial Verification

• Revenue, margin, and backlog figures: needs primary source validation.

Contradiction Check

• Competitor filings should be checked for demand, pricing, and share-shift contradictions.

Sources

• https://www.sec.gov/edgar/search/
• https://www.sec.gov/ixviewer/