Where Sound Risk Management Breaks on the Plant Floor — and How to Fix It
Jose Maria Seara, DeNexus
Every industrial organization has a risk management process on paper. But the standard cycle — identify, assess, treat, monitor, communicate — was built for IT environments, and it breaks in specific, predictable ways the moment it meets OT reality: incomplete asset inventories, maintenance windows that make patching impossible, qualitative scores that can't support a board conversation, and a fundamental tension between security and operational uptime.
This session walks through each phase of the risk management cycle, diagnoses exactly where and why it fails in OT, and offers a practical blueprint for rebuilding it around financial quantification, continuous telemetry, and the language that actually moves decisions at the executive level.