Cybersecurity Under Pressure. Real Attacks, Real Lessons

Episod

• 
  The 6-Step Supply Chain Bleed: When Your Safety Blueprints Leak and the Lifeboats Catch Fire 29.07.2026 32min

  In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we follow the evidence into one of the most consequential architectural debates in industrial cybersecurity today: Should Safety Instrumented Systems (SIS) be strictly segregated from Basic Process Control Systems (BPCS)?The conversation is no longer theoretical. CISA Advisory AA-2026-2697 details Iranian-linked actors actively targeting internet-exposed PLCs, and the threat landscape has shifted from opportunistic ransomware to deliberate, physics-aware attacks. Adversaries are no longer just locking screens—they are hunting for PLC project files, logic diagrams, and network maps to understand your process before they break it.We map the six-stage Supply Chain Bleed in forensic detail:Classification – sensitive engineering assets locked in a fortified central repository.Distribution – access granted to a vetted prime contractor.Delegation – specialized tasks farmed out to tier-3 and tier-4 subcontractors.Export beyond the trust boundary – files converted to PDF, CAD, or raw logic and pulled onto unmanaged endpoints.Peripheral exposure – those files sit on personal laptops, consumer cloud drives, and vulnerable small-business networks.Delayed detection – the plant operator remains completely blind while attackers quietly exfiltrate the blueprints they need to craft a targeted strike.Then we confront the architectural nightmare: common mode failure. When BPCS and SIS share engineering workstations, network switches, or Active Directory credentials, a single compromise collapses both control and safety simultaneously. The ship loses its bridge and its lifeboats.We debate the standards and the reality:IEC 61511 demands safety-oriented independence.IEC 62443 mandates zones and conduits.NIST SP 800-82 Rev. 2 warns that true air-gaps are operational myths in modern facilities.We explore the tension between strict physical segregation (data diodes, isolated workstations) and the operational need for visibility, predictive maintenance, and remote diagnostics. And we draw a critical parallel to the automotive sector—where ISO/SAE 21434 and UN R155 are forcing hardware-level isolation between infotainment and braking ECUs—to show why industrial OT must evolve beyond flat networks.The episode closes with a live Pressure Test: A self-propagating ransomware strain has fully encrypted your BPCS. Your operators are locked out. Reactor pressure is building. The SIS must autonomously initiate a safe shutdown without any human intervention, any shared credential, or any network bridge to the compromised control layer. You have incomplete evidence, no live-fire test history, and terrifying uncertainty about hidden network bridges installed during past maintenance windows. What is your reversible move?What you’ll take away:Why the six-step supply chain bleed is the most overlooked attack surface in OT.How shared infrastructure between BPCS and SIS creates fatal common mode failures.The difference between visibility through integration and safety through isolation—and why data diodes may be the only defensible compromise.A concrete crisis escalation trigger: when to pull the plug, trigger an ungraceful shutdown, and prioritize life safety over production.Why your SIS must be capable of autonomous safe shutdown without relying on the BPCS, shared AD services, or remote command.Thank you so much for spending part of your Wednesday with us, diving deep into these critical and complex issues. We know how valuable your time is, and we truly appreciate you choosing to explore these hard questions alongside us. The stakes for our industry have never been higher, and conversations like this are exactly what move us forward. We will be back tomorrow with a shorter, highly focused follow-up episode diving even deeper into this topic—so please stay with us, and we will see you in the next episode.
• 
  The Device Meant to Secure Your Car Is the Exact Thing Exposing It: The UC San Diego Disclosure 27.07.2026 31min

  In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we dissect the staggering UC San Diego research disclosure revealing how dealer-installed aftermarket anti-theft modules bypassed entire OEM security architectures. What starts as a localized dealer convenience ends as a systemic collapse of the trust boundary.We go under the hood—literally—to trace the five-stage failure chain: from the initial blind trust of physical splicing, through CAN bus propagation with zero source authentication, to the nightmare of containment when 2.2 million cars cannot be fixed with an over-the-air update.But this is not just a post-mortem. We dive into the central engineering dilemma of the decade:Regulatory mandates (UN R155, ISO/SAE 21434) demand rigorous, state-aware cyber risk management.Right-to-repair legislation demands open, interoperable access to the exact same systems.Can both coexist? We debate hardline transaction-level state checking versus risk-based interoperability APIs, and we propose a defensible tiered architecture: an unbreakable vault for propulsion, braking and steering; a monitored turnstile for diagnostics and infotainment.The episode closes with a live Pressure Test: a nationwide repair chain’s certified diagnostic tool has been compromised through its cloud backend and is actively probing your zonal gateways. You have incomplete evidence, a 72-hour regulatory clock, and millions of dollars in operational exposure. What is your reversible move?What you’ll take away:Why physical proximity must never equal digital trust in zonal architectures.The difference between session-level and transaction-level authentication—and why your gateway needs both.How to build a tiered access model that keeps mechanics working without handing them the keys to the drivetrain.A concrete decision framework for SOC teams facing compromised third-party certificates under fire.Thank you so much for spending your time with us today. Your attention and your curiosity are what keep this conversation moving forward. If you found value in this debate, please share it with a colleague wrestling with the same trust-boundary questions. We’ll be back soon with another real attack, another real lesson, and another hard decision under pressure, so stay tuned, and we’ll see you in the next episode.
• 
  The Euro 7 Data Trap: When Emissions Compliance Becomes an Attack Surface 24.07.2026 37min

  What if the system designed to prove that a vehicle is compliant becomes the easiest way to manipulate what regulators see?In this episode of Cybersecurity Under Pressure, we examine how emissions compliance is evolving from a controlled laboratory exercise into a continuous, software-dependent data operation.Modern vehicles rely on sensors, engine control units, calibration software, diagnostic functions, onboard memory, connectivity and backend platforms to demonstrate how they behave in real driving conditions. That creates a much broader attack surface. An attacker may not need to disable the emissions system itself. Manipulating a sensor input, an ECU calibration, a diagnostic function or the telemetry sent to the backend could be enough to corrupt the evidence used to demonstrate compliance.We also explore the operational reality behind this model. Vehicles must collect, protect, transmit and validate large volumes of information without creating unacceptable latency, storage costs, connectivity dependencies or availability problems. Cryptographic protection strengthens trust, but it also introduces key-management, processing and scalability challenges across millions of vehicles.The central lesson is that emissions compliance can no longer be separated from cybersecurity architecture. Protecting the engine is not enough. Manufacturers must protect the complete evidence chain, from the physical sensor to the regulatory record.Follow Cybersecurity Under Pressure: Real Attacks, Real Lessons for practical analysis of the technical decisions, operational constraints and hidden dependencies shaping connected mobility.
• 
  When Compiling Becomes the Payload: The OpenPLC Supply Chain Trap 22.07.2026 34min

  What if the attacker does not deliver malware to your industrial controller? What if your own engineering pipeline builds and deploys it for them?In this episode of Cybersecurity Under Pressure, we examine public research affecting OpenPLC and a more significant problem behind it: the moment when trusted source code, engineering repositories and automated compilation processes become part of the attack path.The research demonstrates a proof-of-concept scenario, not evidence of a confirmed campaign against production environments. However, the implications extend far beyond a laboratory. Industrial integrators increasingly use shared repositories, reusable libraries, automated builds and remote deployment workflows to move control logic from engineering workstations into operational systems.An attacker who compromises source code, an intermediate repository, a dependency or the build environment may not need direct access to the final PLC. The legitimate compiler and deployment process can transform the attacker’s changes into trusted operational code.We explore why scanning the finished binary is not enough, where traditional IT security controls fail to account for industrial engineering workflows, and how signed commits, protected repositories, isolated build environments, reproducible builds, software provenance, deployment approval and runtime monitoring can reduce the risk.The central lesson is uncomfortable: in modern industrial environments, the payload may not arrive from outside. It may be compiled, approved and deployed by the victim’s own trusted process.Follow Cybersecurity Under Pressure: Real Attacks, Real Lessons for practical analysis of the vulnerabilities, engineering decisions and operational dependencies shaping industrial cybersecurity.
• 
  The Kudankulam Supply Chain Breach: When Trusted Partners Expose Critical Infrastructure 20.07.2026 47min

  What happens when a critical infrastructure operator protects its own systems, but sensitive information escapes through a trusted supplier?In this episode of Cybersecurity Under Pressure, we examine the reported Kudankulam nuclear supply chain breach and the uncomfortable lesson behind it: your security perimeter is only as strong as the companies that handle your data.We explore how sensitive engineering information can move from controlled environments into local computers, shared repositories, CAD and BIM tools, subcontractor networks and unmanaged exports. We also challenge a common assumption: that contracts, data classifications and traditional information rights management are enough to maintain control.The discussion moves beyond theory to examine realistic measures, including operator-hosted engineering environments, controlled virtual workspaces, export restrictions, supplier segmentation, stronger access governance and evidence-based oversight of lower-tier suppliers.Because in critical infrastructure, the breach may not begin inside the plant. It may begin several suppliers away.Follow Cybersecurity Under Pressure: Real Attacks, Real Lessons for practical analysis of the incidents, technical decisions and operational failures shaping cybersecurity today.
• 
  The Threat Has a Body: Defending Critical Infrastructure Against Kinetic AI 17.07.2026 49min

  A firewall cannot stop a drone.A fence cannot stop the algorithm guiding it.Artificial intelligence is moving beyond screens and networks. Combined with drones, autonomous platforms, computer vision and robotic systems, it can observe physical environments, identify targets and support actions with real-world consequences.For operators of energy, transport, manufacturing, telecommunications and other critical services, this changes the threat model.In this episode of Cybersecurity Under Pressure, we examine the emergence of kinetic AI and the convergence of cyber, physical and operational risk.We explore:• How AI can accelerate reconnaissance, target identification and attack planning• Why physical security and cybersecurity can no longer operate separately• How autonomous and semi-autonomous systems could threaten exposed infrastructure• Why traditional perimeter controls may fail against distributed and adaptive threats• How OT monitoring, physical sensors and threat intelligence should work together• The importance of redundancy, manual operation and safe degraded modes• How organisations can exercise their response before a digital incident becomes a physical emergencyThe objective is not to predict science-fiction scenarios.It is to prepare for a threat environment in which software can perceive the physical world, make decisions and translate them into action.Critical infrastructure resilience must protect more than networks and individual assets.It must preserve the essential service when both the digital and physical layers are under pressure.Cybersecurity Under Pressure. Real Attacks, Real Lessons.
• 
  Your License Plate Is the Password: What the Kia API Hack Revealed 15.07.2026 35min

  A modern vehicle can have secure boot, encrypted communications and protected ECUs, yet remain exposed through a dealer website.In this episode, we examine an automotive cybersecurity case where researchers began with a public identifier, a vehicle’s license plate, and built an attack chain capable of reaching personal data, vehicle location and remote functions.The compromise did not begin inside the vehicle. It began in the cloud.A license plate was converted into a VIN. A dealer-facing portal trusted the wrong identity. Excessive backend privileges allowed vehicle ownership to be reassigned. Legitimate APIs then delivered commands that the vehicle accepted as authorized.This episode explores why:• License plates and VINs are identifiers, not authentication factors• Dealer and after-sales portals form part of the vehicle attack surface• Weak API authorization can create cyber-physical consequences• Excessive privileges turn a local web flaw into systemic fleet risk• Automotive threat analysis must include cloud, mobile and business systems• OEMs need stronger ownership controls, dealer authentication and behavioral detectionThe main lesson is uncomfortable but necessary: the security boundary of a connected vehicle does not end at the CAN bus or the telematics unit.It extends to every portal, API and support process capable of issuing a trusted command.Cybersecurity Under Pressure. Real Attacks, Real Lessons.
• 
  The 24-Hour Trap: Defensible Decisions Under the Cyber Resilience Act 13.07.2026 34min

  At 2:00 AM, your PSIRT receives a critical alert: an open-source component used across several products may be under active exploitation.The 24-hour clock may already be running. But your team still does not know which products are affected, whether the vulnerable code path is reachable, what suppliers can confirm, or who has the authority to trigger a regulatory notification.From 11 September 2026, the Cyber Resilience Act requires manufacturers to submit an early warning within 24 hours and a full notification within 72 hours for actively exploited vulnerabilities and severe security incidents.This episode examines the operational reality behind those deadlines. We explore why an SBOM can identify the presence of a component but cannot, by itself, determine exploitability. We also look at the role of VEX, product and version traceability, supplier response commitments, technical attack-path validation, decision logs and predefined escalation criteria.The central challenge is not completing a reporting form. It is coordinating PSIRT, product engineering, suppliers, legal and compliance teams, and customer operations quickly enough to make a decision that remains technically and legally defensible.The key lesson is clear: CRA readiness means being able to make and evidence a high-consequence decision while the available information is still incomplete.Cybersecurity Under Pressure. Real Attacks, Real Lessons.
• 
  Stopping Stealthy Radio Jamming in Industrial 5G: When the Air Interface Becomes the Attack Surface 10.07.2026 32min

  In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we explore a risk that is often underestimated in industrial 5G environments: stealthy radio jamming.Industrial 5G is usually presented as a driver for uptime, low latency, automation and flexible production. But once wireless connectivity supports mobile robots, AGVs, sensors, remote operations or safety-relevant workflows, the radio layer becomes part of the industrial risk model.The episode looks at how attackers may not need to fully disconnect a factory to create impact. Subtle interference, selective jamming, signal degradation or disruption of specific cells can create intermittent failures, delayed commands, false troubleshooting paths and operational uncertainty.The key lesson is clear: industrial 5G resilience cannot rely only on encryption, authentication or core network security. Organisations need spectrum monitoring, anomaly detection, coverage planning, fallback procedures, supplier accountability and incident response playbooks that treat radio interference as a real OT security scenario.
• 
  How EV Chargers Could Crash the Grid: The Cyber Risk Behind Mass Electrification 08.07.2026 49min

  In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we explore how electric vehicle chargers could become more than a mobility cybersecurity problem.As EV charging infrastructure grows, thousands of connected chargers start acting like distributed energy assets. Each charger depends on firmware, cloud platforms, payment systems, operator backends, remote maintenance, APIs and grid coordination mechanisms. If attackers compromise enough of this ecosystem, the impact may move beyond data theft or local service disruption.The episode looks at how weak authentication, exposed management interfaces, insecure backend platforms, poor supplier access control and lack of grid-aware monitoring could allow attackers to manipulate charging behaviour at scale. The risk is not that one charger fails. The real concern is coordinated load manipulation, demand spikes, service instability and loss of trust in critical infrastructure.The key lesson is clear: EV charging security must be treated as energy resilience. The charger, the backend, the operator, the supplier chain and the grid interface must be governed together before mass electrification turns a convenience layer into a systemic risk.
• 
  Defending Industrial Networks from Cyber Attacks: Why Resilience Beats Perimeter Security 06.07.2026 42min

  In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we look at what it really means to defend an industrial network when production, safety and uptime are part of the equation.Industrial environments are not protected by applying standard IT controls in isolation. Many plants still depend on legacy assets, flat network zones, fragile protocols, shared vendor access, engineering workstations, limited patch windows and systems that cannot simply be restarted during an incident.The episode explores why effective OT defense starts with visibility, asset ownership and network segmentation, but cannot stop there. Real resilience requires secure remote access, hardened engineering stations, controlled change management, passive monitoring, tested incident response, recovery procedures and clear coordination between OT, IT, suppliers and business leadership.The key lesson is clear: defending industrial networks is not about building a perfect perimeter. It is about reducing propagation, detecting abnormal behaviour early and keeping the physical process safe when something goes wrong.
• 
  Industrial 5G and the Uptime Trap: When Connectivity Becomes a Production Risk 03.07.2026 44min

  In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we explore the hidden risk behind industrial 5G: the belief that better connectivity automatically means stronger resilience.Private 5G, edge computing and connected industrial assets can improve flexibility, latency and operational visibility. But they also change the risk model of the plant. The production environment becomes more dependent on identity, network slicing, SIM/eSIM management, radio coverage, edge platforms, vendor access, cloud integration and telecom operational processes.The real issue is not whether industrial 5G is secure or insecure by design. The issue is whether organisations understand what they are becoming dependent on. A factory may gain uptime, but also create new failure modes if segmentation, monitoring, access control, fallback procedures and supplier responsibilities are not clearly defined.The key lesson is clear: industrial 5G should not be treated only as a connectivity project. It must be handled as an OT resilience project, where cybersecurity, safety, operations and business continuity are designed together before the plant becomes dependent on it.
• 
  Hacking EV Chargers to Stress the Grid: When Mobility Becomes Critical Infrastructure 01.07.2026 37min

  n this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we explore why EV chargers should no longer be treated as simple connected devices.As electric mobility scales, charging infrastructure becomes part of a wider cyber-physical system that connects vehicles, users, payment platforms, operators, cloud backends, energy providers and the grid. A weakness in one layer may not only expose data or interrupt charging. Under the right conditions, it can create operational stress, coordinated load manipulation, service disruption or loss of trust in critical infrastructure.The episode looks at the real attack paths behind this risk: weak charger authentication, vulnerable backend platforms, insecure maintenance access, poor segmentation, exposed APIs and insufficient monitoring between the charging network and the energy ecosystem.The key lesson is clear: EV charging cybersecurity is not only a mobility issue. It is also an energy resilience issue. Security needs to cover the charger, the backend, the operator, the supplier chain and the grid interface before attackers turn convenience into pressure.
• 
  Teenage Hackers and Software-Defined Factories: When Industrial Risk Starts with Identity 29.06.2026 38min

  In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we look at a uncomfortable shift in industrial cybersecurity: the attacker does not always need deep OT knowledge to create operational impact.As factories become more software-defined, the attack surface moves beyond PLCs, HMIs and plant networks. Identity, remote access, cloud services, engineering workstations, supplier connections and software deployment pipelines become part of the production risk model.The episode explores how young, highly organised attackers can use social engineering, credential theft and weak access paths to move from IT compromise toward factory disruption, data exposure or loss of trust in the software loaded into industrial systems and vehicles.The key lesson is clear: protecting the plant now means protecting the full chain of trust. Identity controls, supplier access governance, OT segmentation, engineering station hardening, change monitoring, CSMS, PSIRT and incident response must work together before the pressure arrives.
• 
  The Compliance Theater. Draining Supplier R&D and Breaking Automotive Silos. 26.06.2026 30min

  our Tier-2 supplier just spent 80,000 euros on compliance. Their product cybersecurity did not improve by a single cent.In this episode of "Cybersecurity Under Pressure: Real Attacks, Real Lessons," we look at the compliance trap the automotive industry has built for its own supply chain. A single electronic component supplier must now navigate the overlapping demands of UNR 155, TISAX, and ISO 21434, and potentially the EU Cyber Resilience Act (CRA). The consequence? One exhausted engineering team building parallel "compliance theaters" to satisfy different auditors instead of building one secure product.We discuss the fatal flaw of managing requirements in silos and move beyond the sales pitch of PLM automation tools. Instead, we analyze the real engineering challenge: process convergence. Discover how to integrate Information Security Management Systems (ISMS) with Cybersecurity Management Systems (CSMS), using TISAX corporate controls as the baseline for ISO 21434 organizational requirements.We challenge OEMs and Tier-1s to stop outsourcing their compliance anxiety. Residual risk in the automotive supply chain isn't solved by adding more audit cycles. We explore practical strategies to optimize the audit burden and ensure supplier budgets are invested in actual product resilience, not just bureaucratic overhead.Listen now and subscribe to "Cybersecurity Under Pressure" for practical lessons on supply chain risk, process convergence, and real-world automotive cybersecurity defense.
• 
  The Red Signal. Paralyzing a Railway Network with a Single Patch 24.06.2026 35min

  In railway signaling, an uncoordinated security patch rarely causes a fatal accident. But it can paralyze an entire network.In this episode of Cybersecurity Under Pressure Real Attacks Real Lessons, we explore the structural tension between RAMS engineering and cybersecurity in critical railway infrastructure.We operate under EN 50129, where fail-safe guarantees that an interlocking system degrades into a restrictive state to protect human life. But the incoming prEN 50701 demands continuous patching, active monitoring, and rapid response. One patch. Two masters. Zero margin for error.We discuss what happens when you install a security update on a SIL 4 system without Assessment Body approval. The patch might close a CVE, but it triggers an unexpected system halt. The signals turn red, and the timetable collapses.We analyze safety and security co-engineering. It is not just about passing documents across a hallway. It is about defining a rigorous Safety Security Interface where your Threat Analysis and Risk Assessment maps mathematically to your System Hazard Analysis.Listen now to understand why residual risk in this sector is measured in infrastructure unavailability, and how to articulate hardware modifications when a cyber mitigation requires full CAB recertification.
• 
  The Shadow Corridor. Legacy VPNs and the Financial Blast Radius in OT 22.06.2026 50min

  Last month, a maintenance technician connected to a Level 1 PLC via VPN to fix a sensor. He did not know he had just opened the only door an attacker needed.In this episode of Cybersecurity Under Pressure Real Attacks Real Lessons, we look at a quiet failure in industrial architecture. The Purdue Model is not dead, but it is being bypassed from the inside. A direct VPN tunnel to OT infrastructure grants broad network access. It wraps lateral movement in implicit trust, delaying IDS correlation until the attacker already has command execution.Suddenly, the problem is not a broken sensor. It is a compromised plant floor.We discuss why classical VPN access for third party vendors is no longer just technical debt. Under NIS2 and the principles of IEC 62443, it is board level negligence with a compliance countdown attached. We analyze the transition to ZTNA architected for OT, focusing on continuous identity verification and forensic session recording to turn a vendor intervention into a strictly audited, least privilege transaction.But deploying ZTNA in legacy railway and automotive networks can become an operational trap. Without accounting for strict machinery manufacturer support contracts and industrial protocols, security teams face severe friction. It requires engineering redesign, not just a software patch.Because unmanaged remote access is no longer just an IT concern. It is a direct threat to the OPEX forecast, driving downtime costs, regulatory fines, and insurance premium hikes.Listen now and subscribe to Cybersecurity Under Pressure for practical lessons on OT cybersecurity, industrial resilience and real world network defense.
• 
  Missing Cybersecurity Evidence Can Delay Production 19.06.2026 39min

  The next production delay may not come from a missing component. It may come from missing cybersecurity evidence.In this episode of Cybersecurity Under Pressure: real attacks, real lessons, we look at a growing risk in automotive supply chains: suppliers may deliver the ECU, the software may work, and the release plan may look under control. Then a vulnerability appears, a VSOC event raises questions, or the OEM asks whether a specific component, diagnostic function, OTA path, certificate or backend dependency is affected.Suddenly, the blocking item is not hardware.It is evidence.We discuss why generic documentation is not enough during a real incident. Automotive teams need decision-grade evidence: affected-version mapping, VEX-enriched SBOMs, vulnerability impact analysis, TARA delta, V&V evidence, mitigation status, incident timelines, escalation contacts and cybersecurity case support.A raw SBOM can become a trap. Without exploitability justification, engineering teams may waste critical time chasing theoretical CVEs that are not reachable in the actual ECU architecture. The supplier must own the first exploitability assessment, while the OEM or Tier 1 still owns the final risk decision.Because supplier governance is no longer just a purchasing annex. It is a production resilience control.Listen now and subscribe to Cybersecurity Under Pressure for practical lessons on automotive cybersecurity, supply chain risk and real-world product incident response.
• 
  An IDPS Alert Is Not an Incident Response Capability 17.06.2026 39min

  Detecting a suspicious event in a vehicle is not the same as knowing what to do next.In this episode of Cybersecurity Under Pressure: real attacks, real lessons, we look at one of the weakest points in automotive cybersecurity: the gap between detection and decision-making.A vehicle may report suspicious diagnostic behaviour. A backend may receive telemetry. A VSOC may flag an anomaly linked to connectivity, certificates, OTA, CAN traffic or unexpected service requests. The alert exists. But the real problem starts after that.Who owns the next action?Is it a cyber incident, a vulnerability, a supplier software defect, a quality issue or a false positive?Which ECU, software version, backend service, vehicle programme or aftersales process is affected?Can the evidence be trusted enough to support a product decision?We discuss why IDPS and VSOC tooling are not enough without pre-agreed triage criteria, trusted evidence sources, supplier forensic agreements, TARA impact rules, cybersecurity case update triggers and clear containment decision rights.Because in automotive cybersecurity, the real capability is not the alert. It is the ability to turn that alert into a defensible product decision before the incident becomes a governance problem.Listen now and subscribe to Cybersecurity Under Pressure for practical lessons on automotive cybersecurity, product risk and real-world incident response.
• 
  The Restart Bottleneck Is Not the Backup. It Is the Evidence. 15.06.2026 54min

  After an OT cyber incident, restoring systems is only the visible part of recovery. The harder question comes next: who can prove that production is safe to restart?In this episode of Cybersecurity Under Pressure: real attacks, real lessons, we look at why OT recovery is different from IT recovery. A backup may exist. The PLC logic may appear unchanged. The virtual machine may boot. But in automotive and high-cadence manufacturing, restarting without trusted evidence can create a second crisis.We discuss engineering workstations, SCADA-related Windows servers, virtualised OT environments, dwell-time assessed baselines, out-of-band evidence, tamper-evident logs and pre-agreed IT/OT go/no-go criteria.The real challenge is not only technical recovery. It is building enough operational confidence for plant management, cybersecurity, quality and product safety to make a defensible restart decision under pressure.Because in OT, the strongest recovery teams are not the ones with the longest backup catalogue. They are the ones that can answer one question with evidence:Why is it safe to restart now?Listen now and subscribe to Cybersecurity Under Pressure for practical lessons on OT cybersecurity, industrial resilience and real-world cyber risk.