Industrial Cyber profiles ICS/OT practitioner Mike Holcomb, UtilSec founder and BSidesICS/OT organizer
Industrial Cyber published a Hall of Fame interview with Mike Holcomb, an ICS/OT cybersecurity practitioner who founded UtilSec after serving as fellow of cybersecurity and ICS/OT global lead at Fluor, where he worked across power generation, commuter rail, manufacturing and refineries. The piece is career and community coverage: it contains no vulnerability, no threat actor, no indicator and no incident of its own. Holcomb describes how Stuxnet in 2010 drew him from IT security into industrial environments, and why he publishes free ICS/OT training on LinkedIn, YouTube, TryHackMe and GitHub, including Shodan quick start guides, Modbus testing tools and a controller simulator modeled on the devices targeted in the FrostyGoop attack in Ukraine. He founded BSides Greenville and, in 2024, BSidesICS/OT, now also held in the UK, Australia and Paris, and received the BEER-ISAC Community Builder Award in 2026 after a 2025 SANS Difference Makers Award as Practitioner of the Year for ICS/OT Defender. The operational value for defenders is in his prescriptions rather than in any new threat data.
Detalhes técnicos
Holcomb cites the Dragos 2026 Year in Review finding that organizations with comprehensive OT visibility detect and contain OT ransomware in roughly 5 days versus an industry average of 42 days, while fewer than 10% of OT networks have that visibility. He attributes the gap to budget and staffing rather than tooling, noting that even free offerings such as the Dragos Community Defense Program require people to deploy, tune and monitor them. He references in passing the recent attacks against 100+ water systems in the United States and the compromise of refrigeration units at French grocery stores as examples of incidents shifting from single sites to hundreds at a time; the article gives no technical detail, attribution or indicators for either.
Remediação
For under-resourced operators he recommends a minimum viable path: install and properly configure a firewall between IT and OT, then begin reviewing its event logs, using AI assistance where staff are lacking. He frames his broader program as five B.A.S.I.C.s — Backup and Recovery, Asset Management, Secure Network Architecture including Secure Remote Access, Incident Response Planning, and Continuous Vulnerability Management — a variation of the SANS ICS 5 Critical Controls scaled to operators of any size, alongside hands-on offensive practice in test environments to build more effective defenders.
Linha do tempo
-
Industrial Cyber profiles ICS/OT practitioner Mike Holcomb, UtilSec founder and BSidesICS/OT organizer
ler a análise desta fonte ocultar
Industrial Cyber published a Hall of Fame interview with Mike Holcomb, an ICS/OT cybersecurity practitioner who founded UtilSec after serving as fellow of cybersecurity and ICS/OT global lead at Fluor, where he worked across power generation, commuter rail, manufacturing and refineries. The piece is career and community coverage: it contains no vulnerability, no threat actor, no indicator and no incident of its own. Holcomb describes how Stuxnet in 2010 drew him from IT security into industrial environments, and why he publishes free ICS/OT training on LinkedIn, YouTube, TryHackMe and GitHub, including Shodan quick start guides, Modbus testing tools and a controller simulator modeled on the devices targeted in the FrostyGoop attack in Ukraine. He founded BSides Greenville and, in 2024, BSidesICS/OT, now also held in the UK, Australia and Paris, and received the BEER-ISAC Community Builder Award in 2026 after a 2025 SANS Difference Makers Award as Practitioner of the Year for ICS/OT Defender. The operational value for defenders is in his prescriptions rather than in any new threat data.
Technical Details
Holcomb cites the Dragos 2026 Year in Review finding that organizations with comprehensive OT visibility detect and contain OT ransomware in roughly 5 days versus an industry average of 42 days, while fewer than 10% of OT networks have that visibility. He attributes the gap to budget and staffing rather than tooling, noting that even free offerings such as the Dragos Community Defense Program require people to deploy, tune and monitor them. He references in passing the recent attacks against 100+ water systems in the United States and the compromise of refrigeration units at French grocery stores as examples of incidents shifting from single sites to hundreds at a time; the article gives no technical detail, attribution or indicators for either.
Remediation
For under-resourced operators he recommends a minimum viable path: install and properly configure a firewall between IT and OT, then begin reviewing its event logs, using AI assistance where staff are lacking. He frames his broader program as five B.A.S.I.C.s — Backup and Recovery, Asset Management, Secure Network Architecture including Secure Remote Access, Incident Response Planning, and Continuous Vulnerability Management — a variation of the SANS ICS 5 Critical Controls scaled to operators of any size, alongside hands-on offensive practice in test environments to build more effective defenders.