Industrial Cybersecurity 2025: Key Takeaways from our Webinar

In a timely and candid webinar hosted by Axio, leading experts discussed what’s working (and what’s not) in industrial cybersecurity as we look toward 2025. Featuring insights from cybersecurity veteran Matt Morris, OT product expert Grayson Estes, and Axio President David White, the session revealed a common theme: many organizations are still missing the mark on the fundamentals, even as threats grow more advanced.

We encourage you to watch the recording of the webinar to hear the full discussion. In the meantime, below is a summary of the key takeaways.

Nation-State Threats: A Wake-Up Call

One of the most urgent concerns discussed was the growing sophistication of nation-state actors, particularly China. Campaigns like Volt Typhoon highlight that adversaries aren’t just trying to break in; they already have the keys. “They’re in the systems, mapping them quietly, waiting,” Morris warned. The implications are clear: critical infrastructure is vulnerable to pre-positioned cyberattacks that may strike without warning.

The Basics Still Aren’t Covered

Despite heightened awareness, many industrial organizations still struggle with cybersecurity basics:

• Incomplete or outdated asset inventories
• No tested backups
• Unprepared or siloed incident response plans
• Lack of visibility between IT and OT environments

Without these foundational elements, even the best detection tools won’t offer meaningful protection.

We’re on a Cyber Hamster Wheel

Too many teams are overwhelmed by vulnerability reports and compliance checklists, stuck in reactive mode. “You can’t fix everything,” said Morris, “but you can do enough to become a harder target than the next guy.” This means focusing on what matters most.

CRQ: A Practical Path Forward

That’s where Cyber Risk Quantification (CRQ) comes in. CRQ provides a structured, data-informed way to model and prioritize risk based on business impact – not fear, not hype. By simulating “what-if” scenarios, organizations can:

• Identify which systems truly support critical operations
• Understand cascading impacts of downtime or compromise
• Prioritize investments that measurably reduce risk
• Engage leadership with clear, financial terms

As White emphasized, “CRQ conversations look a lot like tabletop exercises, but with numbers attached.” It’s a powerful way to align teams, surface blind spots, and guide funding to the most impactful areas.

More Secure…or Just More Complex?

Asked whether digital transformation is making OT more secure or more complex, the panel agreed: both. More connected devices and AI-enabled platforms can improve performance, but also expand the attack surface. AI itself is a double-edged sword, with attackers likely already using it to evade detection.

Recommendations: Start Simple, Act Now

We wrapped the webinar with a call to action:

• Exercise regularly. If you don’t practice, you’re not prepared.
• Bridge IT and OT. The divide is artificial, and the risks are shared.
• Use CRQ. Don’t guess at risk, quantify it.
• Revisit the basics. Backups, segmentation, and response plans are non-negotiable.

As geopolitical tensions rise and cyber capabilities become more weaponized, the message was clear: industrial organizations must adopt a civil defense mindset focused on resilience, not just defense.

CRQ is the key to making that mindset actionable.

Watch the Full Webinar

For a deeper dive into these insights, watch the full webinar recording here.

Have questions about your transition? Connect with our experts to support your cybersecurity program.

Contact Us