@BEERISAC: OT/ICS Security Podcast Playlist

Podcast: Trust Me, It's Air-Gapped
Episode: Grocery Fridge Hacks and the Shadow IT Gap
Pub date: 2026-11-09

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

A cyberattack that took down grocery store refrigerators across Europe reveals that risks behind shadow IT, third-party vendor management and remote access.
GrayMatter's Scott Christensen and Jeff Dunham look at why connected devices bought outside IT’s view are a growing risk. They cover what a vendor security review should ask before procurement and discuss GrayMatter’s SOC 2 journey.
Topics covered:
Lessons from the European grocery store refrigerator cyberattack
Shadow IT and shadow AI in IT and OT environments
Third-party vendor risk and security questionnaires
SOC 2 compliance and proving that security controls work
Network segmentation for IoT and OT devices
Containment, visibility and recovery as core security practices
Why IT/OT security works best as a team sport

Visit graymattersystems.com.

The podcast and artwork embedded on this page are from GrayMatter, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: PrOTect It All (LS 28 · TOP 10% what is this?)
Episode: Walk the Floor: Why Your Asset Count Is Wrong
Pub date: 2026-11-09

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep131/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Kevin Kumpf started out strapping steel under gantry cranes, found the crane control systems had never been updated, and has worked in OT security ever since, including leading OT security at a large US utility. He and Aaron spend this episode on the things that do not show up in a tool: safety culture, knowing what good looks like, and walking the floor.

Why an IT data center would never post a "days since last incident" sign, and why OT treats safety as the job. Two engineers at one plant who count 50 and 200 control cabinets. Ten engines on one ship, one running different. Why plants protect the most expensive asset instead of the most critical one, and the five-cent part nobody budgets for.

Then data and AI: a boiler tube failure spreadsheet that decided outage plans without ever being on a critical asset list, why AI without context is just numbers, and why a human who can check the work still matters. Aaron's zip tie that left a core switch failed for months, the only backup server sitting next to a space heater, and how to sell OT security to the business: uptime, reliability and competitive advantage, done securely.

Key takeaways

Count it yourself. If two people at the same plant give you 50 and 200, you do not have an inventory, and a tool will not settle it.

Know what good looks like. A baseline of temperatures, flows, RPMs and who talks to whom is what makes the odd one out visible.

Criticality is not price. Ask what stops production, including the small part and the small site on the same network.

Walk the floor and ask what the red light means. If nobody knows, find out or remove the light.

AI needs context and a human who can check its answer.

Lead with uptime and reliability. Security comes along with it.

Chapters

0:00 Intro

0:22 Welcome and introduction

1:58 From strapping steel to crane controls

3:16 Hard hats and safety culture in OT

6:08 Days since last incident: IT vs OT

6:58 A sticker for every year without an incident

8:29 No shortcuts to safety

9:54 Teaching IT people the safety mindset

13:11 No-judgment zone: who knows their baseline?

15:39 50 cabinets or 200: asset counts that disagree

17:17 Who controls the plant, and knowing your baseline

21:17 You have to know what good looks like

22:41 Ten engines, one running different

23:49 The most expensive asset is not the most critical

25:03 The boiler tube failure spreadsheet

28:04 Excel, history and data in context

30:57 If the AI says 42

33:42 Data versus information

36:17 The cloud and trust but verify

40:47 Firewalls, passive monitoring, people and process

42:41 Enterprise IT tools in a plant, done the OT way

44:58 One zip tie and a failed core switch

48:03 The backup server next to the space heater

50:48 Protecting the device from the human

51:15 What Kevin is building

53:51 Changing the oil: lessons learned the hard way

56:50 Where to find Kevin

57:38 Selling uptime, not security

About the guest

Kevin Kumpf has more than 20 years of IT and OT security and governance and compliance experience in energy, communications, the defense industrial base, transportation, manufacturing, healthcare, financial services and other sectors. As Director of OT Security (Iberdrola N.A.) he oversaw the security and regulatory compliance programs for operating companies including NYSEG, RG&E and CMP. Today he is Chief OT Strategist at Kasm Technologies.

Kasm Technologies: https://kasm.com/

Kevin on LinkedIn: https://www.linkedin.com/in/kevin-kumpf-b5021412

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep131/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Support the show: https://protectitallpod.com/go/support/podcast

YouTube: https://www.youtube.com/@PrOTectITAll

Email: info@protectitallpod.com

X: https://twitter.com/protectitall

Facebook: https://facebook.com/protectitallpodcast

To be a guest or suggest a guest or episode, email info@protectitallpod.com.

Please leave us a review on Apple or Spotify:

Apple: https://podcasts.apple.com/us/podcast/protect-it-all/id1727211124

Spotify: https://open.spotify.com/show/1Vvi0euj3rE8xObK0yvYi4

The podcast and artwork embedded on this page are from Aaron Crow | Operational Technology & Cybersecurity Host, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Casos de Ciberseguridad Industrial
Episode: 2/4 Análisis del riesgo de la IA en la digitalización industrial
Pub date: 2026-11-09

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

En este episodio se profundiza en si el modelo tradicional de evaluación de ciberseguridad (amenazas, vulnerabilidades e impacto) resulta suficiente para evaluar sistemas de inteligencia artificial o si requiere incorporar otras dimensiones.

The podcast and artwork embedded on this page are from Centro de Ciberseguridad Industrial, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Three Buddy Problem (LS 40 · TOP 2% what is this?)
Episode: GPT-6 Cyber Sets Price of a Linux Exploit; Europe Silent on Fridge Hacks
Pub date: 2026-11-08

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 119: We discuss the supermarket fridge hacks rolling across Europe, why no government wants to say the word Russia out loud, active measures and cyber-warfare, and the European silence on attribution.

Plus, OpenAI's GPT-6 Cyber and the cost of 948 Linux exploits, the Daybreak Blue training flap, a tough-love pep talk for researchers mourning the loss of the old game and the Binance postmortem the FBI pinned on North Korea's TraderTraitor.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:

0:00 Introductory banter

3:00 TLP Black and AI agents watching your edge devices

10:21 Supermarket fridge hacks spread across Europe

16:27 How the refrigeration attacks work

18:49 Is this Russia?

21:12 Boundary testing and the Article 5 problem

34:20 Sabotage short of war

40:06 The IOCs nobody is sharing

44:41 Costin's hunting playbook

51:24 Not just a European story

57:25 What do intelligence agencies know?

1:06:22 GPT-6 Cyber and Daybreak Red

1:26:40 948 Linux root exploits for $1.2 million

1:36:48 Daybreak Blue training and the mathematicians

2:09:01 Binance postmortem and TraderTraitor
Links:
Transcript

TBP Ep54: Train brake hack, GRU sanctions

Tom Hegel: Defrost and Disrupt - Europe’s Refrigeration Attacks

French blood service hit by Europe-wide fridge hacks

Govs Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems

Germany, Romania and UK report supermarket cyberattacks

OpenAI Ships GPT‑6 Cyber

A thousand fewer paths to root | OpenAI

OpenAI plans to train models on Daybreak Blue cybersecurity session data

Free Chinese AI Models Are Getting Scary Good at Hacking

Tal Be'ery: Dense in Depth: Rethinking Security When Vulns Are Everywhere

FBI blames N. Korea’s TraderTraitor for Binance theft

Binance $6.5B Crypto Theft Post-Mortem

FBI: North Korea Responsible for $6 Billion+ Binance Attack

SkiSides 2027

CYBERWARCON Agenda

RE//verse Conference

TLPBLACK

The podcast and artwork embedded on this page are from Security Conversations, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: Podomation
Episode: 015 - ISA Automation Summit & Expo: CRA and Regulation, AI, SCADA, and more!
Pub date: 2026-11-04

Get Podcast Transcript →
powered by Listen411 - fast audio-to-text and summarization

In this episode, we're continuing our journey inside the ISA Automation Summit and Expo in Orlando. Our conversations kept returning to three questions. How do we protect critical infrastructure, especially water? How do we keep up with new regulations like Europe's Cyber Resilience Act? And how do we bring AI into the plant safely? ISA talked to experts on each of these topics... and their answers are more hopeful, and more practical, than the headlines suggest.

The podcast and artwork embedded on this page are from ISA - International Society of Automation, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.