Episode 53: From DC to Sacramento: Building Resilient Critical Infrastructure and OT Workforces

PART I

Bryson Bort: Welcome back to Hack the Plant. Thanks for sticking with us over the break. It’s been a busy summer for critical infrastructure systems and cybersecurity, as I’m sure you’ve noticed. But now we’re back for season six. 

We’re kicking the season off with something new. Today we’re bringing you a three-part episode. For part one, Institute for Security and Technology Executive in Residence for Public Safety and Resilience Josh Corman and I sit down to catch you up on the biggest event of the summer, Critical Effect DC. Josh and I share our favorite talks, reflections from attendees, and bring you the latest updates on the next iteration of Critical Effect. Spoiler alert: It’s in Sacramento. 

In part two, I’m joined by James Regan, CEO of Clutch. Clutch is a social impact consulting firm based out of Sacramento, California, and was one of our platinum sponsors at Critical Effect DC. James shares a little bit about his panel at Critical Effect and what we can expect from the Californian version. 

Finally, in part three, we welcome Palo Alto’s Adam Robbie, a longtime friend of the podcast. Adam co-authored the 2026 Intelligence-Driven Active Defense Report, a joint research project by Palo Alto Networks, Siemens, and the Idaho National Laboratory, bringing global telemetry from 61,000 operational technology firewalls in 20 years of incident data. Adam’s here to tell us more about the results and what we can expect from the future. 

Bryson: This is why we started Critical Effect nine years ago. First called Hack the Capital, now Critical Effect DC just happened here in June in Washington D.C., for the ninth invocation, and it was a fantastic conference that brought together folks from across the world. We had our first visa application, so that was a new one where we didn’t want to just continue to talk about the problems we already know and understand, but we’re in Washington D.C., and if you believe that your government can do something, it is a whole society of effort that starts with all of us trying to figure out how to do that. Josh, how did you feel about how we did?

Josh Corman: Well, our first year collaborating on this was last year, and I thought last year was a fantastic event. I think this one took it up several levels on pretty much every front. We had a new venue. We really challenged our speakers to bring a bias towards action and implementable ideas with the looming Taiwan Strait situation, Iran, the post-Mythos moment, etc. I think we had incredibly strong content across three tracks for two days, pretty great attendance, and pretty marquee speakers. So I’m really pleased with what we built and the feedback thus far. You know, it seems to support what we designed and set out to do.

Bryson: So this is a different kind of episode than what you’re used to hearing in Hack the Plant. Josh and I are going to talk through what we took away from the Critical Effect Conference, and then you’re going to hear from two other folks who were key sponsors and supporters of the conference: Adam Robbie and James Regan. We kicked the conference off with a keynote from the Acting Director of the Cybersecurity and Infrastructure Security Agency, CISA. Pronounce it how you will. And I was really impressed that Nick helped continue the tone that you’re going to hear from so many folks who did attend, which is one of openness and candor and conversation. Nick did an open Q and A with the entire conference. That’s rare to see from a senior government executive.

Josh: Yeah, I like Nick. We all like Nick. We know his team respects him, and I’m glad he’s in that role right now. I expected some candor, but he was even more direct, and people were really impressed. I think we should pull a quote or two from his remarks, but one of them was, “You were on the front lines of a war that will never be declared, and there will be disruption on critical infrastructure and civilian critical infrastructure. It’s not. It’s not a maybe. There will be. So I think he shares our concern that this won’t just be economic impact or even loss of life impact. It’ll also have psychological impact on the country. And he came swinging and showed the openness to take audience questions and even a press gaggle in the hallway. So I love the transparency at such an urgent moment where we need everybody at their best.

Bryson: And critical infrastructure particularly represents the when question, not the if question. God forbid, if something truly awful happens, most likely driven by a nation-state for geopolitical reasons, and that’s one of the reasons I really liked the Caleb Queen talk, When The Internet Breaks: How to Keep Critical Infrastructure Alive at 5% Bandwidth, because whatever that situation is going to be, we are going to need. Be able to operate in a degraded environment, and our critical infrastructure and asset owners are going to need to do that when things don’t work as designed. One of my favorite things, actually, I’m going to give credit to Josh on this, was when we look at critical infrastructure. It seems like everything’s equal when that’s not true. And Josh, you’ve done some great work on highlighting the fact that there are dependencies in critical infrastructure, which is even more important to understand in that awful scenario that may happen.

Josh: Yeah, Caleb’s great. I missed his talk this time, but I have seen it elsewhere, and he will be speaking at BSides Las Vegas as well with his other collaborator Slava, who shows you that if the comms go down, how do we have non-zero communications with Meshtastic and and Lora and other protocols for a town to keep functioning? Yeah, I mean, even before we had Nick on stage, we tried to set the tone in our opening remarks that these are incredibly cross-sector cascading failures. So, no water might not seem like a big deal, but no water is no fire hydrants. No water is no hospital. No kidding. Two to four hours. No water is no HVAC or food chain or cold chain or cooling for data centers. So water really was the foundational weak link in the chain, at least in my remarks. And I liked how everybody kind of tried to tie back to that throughout the two days. 

Well, I didn’t see Caleb’s talk this time, and I will watch the recording. There was a fantastic panel on how three different states are holding the line. As you’ve seen, there’s been a transfer of shared responsibility from the federal government to the states under this administration, and there are very different ways states are handling this. So our own, my colleague Mike Klein moderated how New York’s handling it, how Texas is handling it, and how Maryland’s handling it with one of our friends, James Regan, as well, to look across the various states. So I found that one pretty thought-provoking and even upsetting at times. But that’s exactly what we want to do: challenge our audience.

Bryson: When Tom Van Norman and I were first building up the ICS Village. One of the core exhibits that we had was we called it the Wall, and it was a model of a water plant. And what we were trying to take advantage of is in industrial control systems, you have the advantage of you’re changing the physical world. That’s the difference between information processing, which is traditional IT, and the point is that being able to show water changing color because you’ve affected the programmable logic controller, which would be the equivalent of too much chlorine, too much fluoride in the processing, should make it very easy to physically understand what’s happening. Continuing that trend, at Critical Effect, Dean Ford brought his own water system to demonstrate for the audience what a water hammer was, which has been a significant part of the Undisruptable27 project, talking about that risk to water systems, Josh.

Josh: Yeah, Dean’s a great character. I think he had his old Bay Hawaiian shirt on. We first met him as a professional water engineer who showed up at BSides Las Vegas I Am the Cavalry track and watched one year, spoke the next year, taught us so much. And at the last minute before our conference, he went and spent a couple grand of his own money to make this little onstage water hammer disruption, which was hilarious for Dr. Natalie Sullivan, an ER doc, and Mark Montgomery, a firebrand. But yeah, that panel, we called it, A Tale of Three Cities. We really tried to say, like, when everything’s on fire or broken, what are we going to solve for? Is it going to be continuity of operations for the military because we might be in a war with a Volt Typhoon disruption? Is it going to the economy, where it’s the data centers, dummy, or it’s the economy, stupid. Which is I think, what Tom Fanning and others prefer, or is it going to be public safety, human life, like the trauma centers over the data centers? And the answer is we’re not going to fix them all at the same time, and you want to do them all. But boy, was that an interesting, fun, and dynamic panel. So that’s one you shouldn’t miss.

Bryson: Well, let’s bring our listeners into this because the question we asked the audience was: You have a choice, and it’s a Solomon’s choice. You only get to pick one, and I think that is so helpful because it really highlights the fact that we have to prioritize. You don’t get to do everything, all of them, right? And so the question was: In the event of a disaster and a reduction in critical infrastructure services to people, what should be the primary thing that we focus on? Should it be finance, so that we can continue the economics of modern society, jobs, and how everybody gets money to do anything? Because if you don’t have access to your own cash and banking, you can’t really do much in a disaster. Should it be the fact that we need to have a military response, so the continuity of government operations to be able to respond, whether that’s marshaling domestically or responding outside of the United States to the aggressor, and then finally, just a focus on life, keeping people alive, making sure that regular citizens are served. And so, I ask you all at home to take a moment there. What would be your vote?

Josh: Of course, it’ll be a bit of a mix. But what Mark pointed out is, are you on the list that’s been ruthlessly prioritized for response? And if you’re not on the list, you should be told that so that you know you’re on your own, and no one’s coming to save you. And the time to make that list, and remake that list, and remake that list is not in the middle of a firefight. It’s now.

Bryson: What I saw from the audience, other than some onesie, twosie, hands on finance, as we were about evenly split between protecting citizen life and ensuring the continuity of operations for military and government.

Josh: I think a wake-up call in the hallway, for what it’s worth, is that there is quite a bit of money being put into resilience measures for defense critical infrastructure or critical infrastructure that supports defense and bases, whereas a lot of the civilian stuff is kind of on its own right now, and hence the importance of projects like Uninstructable and ICS Village. I was really thrilled to have the Hackers on the Hill, I am the Cavalry Cyber Policy Shark Tank make a return visit to be our closing plenary. For those who have watched the television show Shark Tank, this is a public good version of it, where the sharks are not investors; they’re congressional staffers on committees of jurisdiction that matter. And we have a contest run by Bo Woods with lots of flair and stickers and inflatable sharks and prizes that are shark-themed, where we solicit shovel-ready policy recommendations and pitches that could be entertained and acted upon by our legislative branch. So this year, I think we had 18 really solid submissions for cyber-physical systems resilience, and the three finalists get a chance to pitch for a few minutes, get questions and interrogation from the sharks for a few minutes, and they deliberate against a scoring rubric. And I was really excited to see so many strong cyber-physical systems pitches this year. One of them ultimately won. You’ll have to watch to see which.

Bryson: I also understand that the winner was so good that you got follow-up from Congress.

Josh: Well, I have yet to have this meeting, but one of the Senate staffers who had heard of the pitch asked me what my thoughts were because he thinks it may be a workable idea. So that’s kind of why we do this. This isn’t just an entertaining game show; it’s a little bit of a purview into how Congress works and how committees of jurisdiction do and don’t get things done. So it’s educational for the audience, but it’s also, we’re not kidding. We want your idea to be heard in the corridors of power and maybe make the world a safer place.

Bryson: Something we did differently this year is, traditionally, we stick with the problems that are, not the problems that might be. And so we had a talk that looked at how the quantum computing phenomenon in the future Q Day potentially affects critical infrastructure.

Josh: Yeah, our speaker was pretty grateful when we had our day two open floor where we were taking feedback and comments. She was very surprised that we would showcase such a topic, and I’m like, “Hey, we have to be looking not just at the lions and tigers and bears at our doors, but the ones that are coming. So I was happy she came, and she was happy she had the opportunity. You know, we started day two with some opening remarks and reflections on day one. I really liked the vibrant discussion we were able to get going in the room before our day two plenary. Lots of good feedback, validating that we were on the right track, celebrating that we’re not just admiring the problem. People talking about making a dent, a little dent. Any dent is valuable. 

So I thought that was an intelligent instinct that we should repeat, is get some midterm feedback. And then it was really nice to have Craig Newmark of Craigslist give us a philanthropic view on our domain and show how he can reconcile a Pause, Take 9 campaign with Count von Count from Sesame Street on fraud and abuse, but also funding projects like Undisruptable 27 to keep, you know, water and hospitals and citizens alive. So it was nice to hear how he viewed his responsibility in the role of nonprofits in public safety, and at the end, we got to give him a little trophy. One of the communities he’s opening in our pilot programs wanted to show him a thank you and gave me an old pressure gage that to show their gratitude that at least their town is safer because of his contributions. So one of the things we take pride in is this three-track conference. Is so jam-packed with awesome sauce that we want it to be a very very hard decision of what to go watch. So I had hard decisions, and I have not yet seen them all. The good news is we recorded them, and now I can go watch them later. So some of the ones that I heard the most positive feedback on, and that I’m dying to see, is Joe Slowick’s talk from track three. It was called Residential Proxies and Critical Infrastructure, critical national infrastructure, and another one that got a ton of great feedback was our good friend Emma Stewart and Phoebe, who did the Electrostack at Risk: China, AI, and America’s Energy Supply Chain. So I think they’re trying to take some novel infrastructure approaches to risk reduction. So I heard very good feedback about that one as well. Is there anything that you have on your watch list?

Bryson: Yeah, mine would be the one that brought Sergio out of retirement, along with the return of Jonathan Horowitz from the International Red Cross, civilian exposure reduction in a shared digitally world.

Josh: Jonathan was excellent on our panel last year, so I’m really excited to see his talk with Sergio. And Sergio brought probably one of the best questions to our Q and A across those two days. I think he was challenging director, acting director Anderson about that we keep talking in the future tense when some of these threats and harms were in the present tense, and and how do we get more clarity in critical mass? So I don’t want to butcher his wording, but stick around for the Q and A of Nick Anderson’s keynote.

Bryson: Thank you to Evan Wolf, partner at the Akin Law Firm, for hosting Critical Effect DC. Look forward to next year.

Josh: Indeed, and if any of these talks are attractive to you, there will be another chance to see some of them at BSides Las Vegas, I am the Cavalry Track, in the first week of August at Hacker Summer Camp, and a different type of state-level version of Critical Effect in September in Sacramento. Stay tuned.

PART II

James Regan: Hi, I’m James Regan, and I’m the CEO of Clutch. We’re a social impact consulting firm in Sacramento, California. Super excited to be here. Thanks for having me.

Bryson: All right. So you were a platinum sponsor. Clutch was a platinum sponsor, and I think even more importantly is you also are going to be the lead founding sponsor with us for Critical Effect California, and I think that’s a nice tie-in because you also did a track two talk with Jeff Weglan from Skillrex about workforce development and operational technology. So why don’t you give a quick idea to listeners about what you covered and what people can expect from more at Critical California?

James: Totally, yeah. Jeff and I had a great time presenting on SLED workforce in particular, just kind of addressing some of the gaps in skill set, because I think the narrative is shifting from a complete workforce shortage to really a skill set shortage for modern cyber infrastructure, and we did have a focus on industrial control systems, OT, and one of the things that that shift really what it does is it makes it so that we are refocusing on instead of the lack of bodies to fill seats, the lack of qualified individuals, instead the lack of very specific skills for the sake of monitoring, monitoring, threat assessment, and investigation for not only the the sort of defense that I think most people think of when they think of cyber, but also the offense. It’s all the planning, the vulnerabilities assessment, and then all the things that we need to do to prevent sort of the really imminent attacks that we’re expecting on our operational infrastructure and critical infrastructure, and I think that is going to go so well into critical effect California because we’re going to have an entire workforce track associated with cyber OTICS conversation, which I’m really excited about, because we’re bringing together like in equal parts academic experts, government experts, and industry leaders in really trying to bridge that gap between what is typically passed in policy on the government side when it comes to cyber, and bridge that with real operators who often are stuck implementing a policy that doesn’t always translate to something that’s functional. So, how do we get those three sectors in the room and come up with real strategies? What can we do over the next two years to make it so that we have the skill set in cyber to really protect and evolve our critical infrastructure against new threats? 

Bryson: So you are on a main stage panel, Holding the Line: How states are confronting Volt Typhoon and The race to Harden Lifeline Infrastructure Before 2027. It was moderated by IST Zone Mike Klein with General Craig Hunter, John Keith, and Michaela Lee, along with yourself. So, what’s the deal with Volt Typhoon?

James: Volt Typhoon is really one of those things that represents a huge threat, and I don’t know that there’s a level of awareness that we want around this in the general population and amongst policy and decision makers. Volt Typhoon, to me, is a real threat against critical infrastructure, and having the ability to infiltrate a water utility or even potentially power utility, and then sit and wait until the right moment to cause chaos by affecting critical infrastructure in the U.S. for the sake of strategic or military advantage for China. And so it is very interesting to me that, in particular, we talked at Critical Effect DC a lot about the vulnerabilities in water utilities, the under-resourcing associated with cybersecurity and OT teams among water utilities. And I think Volt Typhoon is something we are going to talk about a lot at Critical Effect California, not only on the workforce side, but of course on the what can we do about this jointly. 

And on the panel, it was amazing to hear from all of the brilliance that you just mentioned across that panel, where I got to sit and listen to perspectives from New York and Maryland and Texas, and each one of the panelists just had such great perspective. I think one of the main things that we’re missing—we talked a lot about this on the panel—is incident coordination across multiple SLED departments from a state perspective, and also local utilities. It’s very, very difficult for a joint threat like this to identify the entity that’s responsible as the coordinating entity. Typically, in SLED, there would be a state-level entity. I think people would be surprised at the level of: well, wait. Are you going to take care of this? Are we going to take care of this? Is it your department? Is it my department? And so, being able to plan forward very effectively, plan forward and run through exercises. Think about how: is there joint funding available so that you’re not asking for duplicative funding across multiple state departments or local utilities, and having truly coordinated effort to combat the threat that’s coming through local platforms? 

Bryson: And what’s also interesting is that there has been a shift in this administration from a federal capability to a state capability. You used to work in state government. Critical Effect California is going to be happening in Sacramento because we want to focus on the state level. So, what should states be thinking about with Volt Typhoon?

James: It’s a great question. I did spend a lot of time in state government in California. I’m super excited to bring Critical Effect to the West Coast for the first time because I think a lot of the conversation we had was exactly that. I want everyone in the room, like I said, there’s going to be academic experts, government experts, utilities, and also industry leaders in cyber, generative AI, and quantum as well. In the context of cyber, to figure out what state and local governments and utilities can be doing. So, in my mind, I can give you an answer, but really, I want to get all that brilliance in the room and figure it out altogether. We need everybody. 

As much as I may have some SLED government experience in California, I’ve never run a water utility, so some of the OT/ICS struggles in a water utility I would have no idea. So we’re going to have them there and really bring everyone together. And this is not going to be your typical conference, in a similar way to how you’ve built this amazing community of brilliant people for Critical Effect DC. We’re also going to try and replicate that in California, while also adding a little bit of flavor around the tracks, and really create this sort of hub, this little beautiful community of brilliants in the room, to make it so that it’s not a sales conference, right? This is not your typical conference. It is people in the room in focused conversations, and we walk away with real things to say. What are we going to do about Volt Typhoon and other threats that we see hitting our infrastructure every day? We’ll come up with three to five real actions, and then after the conference, continue to follow up with the experts on those actions. It’s a one-day conference, but it’s not a one-day effort. And so, I know I didn’t necessarily answer your question directly, but that’s because I don’t know that we have the answers yet. I want to get them after Critical Effect California and see how we can push forward over the next couple of years.

Bryson: Anything we didn’t cover you want to touch on?

James: I’m just excited to be part of the effort. I mean, for Clutch to be a part of this and to be raising the level of the cyber conversation in partnership with ICS Village and Sycthe and so many others that are bringing Critical Effect to California. It’s going to be such a good time, and I’m just excited to see what we can all do together.

PART III 

Bryson: Adam, thank you. You have been a perennial supporter of the ICS Village and all of our efforts with your time at Palo Alto. For those of you who want to get more out of him after this, we did a podcast with him, so check out the Hack the Plant episode, which we’ll post in the show notes. And you’re here to talk to us about a really cool white paper that you wrote with several partners called Intelligence Driven Act Defense Report for 2026. What did you all talk about? What can you share?

Adam Robbie: Thanks, Bryson, for having me over. And this white paper was one of my favorite ones because of the partnership we did. You will see we have Palo Alto Networks, Idaho National Lab, and Siemens – the three of us came together to work on this white paper, and we wanted to set an example for the industry that securing critical infrastructure is not a one-person job. It’s about bringing multiple people, multiple teams with different expertise, together to know what the best way is to secure critical infrastructure, and we have lived and walked the experience of the difficulties of how to bring people from different departments or backgrounds, who speak different languages, and try to have a common agreement scope. 

So we have Palo Alto with the security background language, Siemens with the control industry language, and we have Idaho National Lab that brings the national and government language. And we started the white paper content with 60-something pages, and we ended up agreeing on 24 pages. So you can imagine all the back-and-forth for every page we go through. We see what we can agree on and what we cannot agree on. If there is a keyword we like, the three of us have to agree on the same keyword or the language. Is it incident? Is it trigger? Is it an alert? It’s the same thing, but we want to have, you know, a common language between the three of us. And also, you brought, like, a lot of experts to the same table, and part of the white paper you will see is the framework, and that framework was not developed like based on a scientific methodology. It’s actually based on the expertise of the three organizations’ experts. So, as you will see, like there’s 10 people who came together from different organizations around the same table, and we discussed what has been worked on before, what hasn’t been worked on before, and how we can put this in a framework that the industry can take and apply.

Bryson: So one of the things that I like about what you said there is that you had to come to a common vocabulary, and while that might sound understated to our listeners, think about what that means. We have to agree on concepts, which is so important, not only at this expertise level, but one of our primary jobs is storytelling. One of our primary jobs is communicating what the issues are and what to do about them in a very clear manner, and we have to do that to so many different stakeholders. And so, your paper naturally had to bring all of that together into that output, which is one of the things I think is so powerful that you’re able to speak to multiple levels.

Adam: I cannot agree more. It’s something we experience on a daily basis. You’d meet with different stakeholders. You use the same keyword, even the word control system or automation. That word means different things to different teams. If you talk to the control engineers, they think of automation from an industrial automation standpoint. If you talk to the security team or IT, they think of automation from a software standpoint—pipeline, database— so I always have to make sure, like I am explaining these terminologies. And sometimes, when we go into different meetings, I propose: can we all agree on a language and identify what we mean with every keyword before we dive in, so we are on the same page? And I had a couple of exercises. Sometimes I bring two people, and I set them together, and I was like, I need to be an interpreter between both of you because you both are saying the same thing, but in a different language, and it’s so interesting how after this exercise, a lot of miscommunication or misunderstanding just makes alignment go faster, which will help make decisions on securing the infrastructure go faster.

Bryson: So, content and impact. What are the takeaways? What are the takeaways for our listeners? 

Adam: The main thing we liked in this white paper, we say bring the fight to the edge, which means IT threats become an OT impact on the network edge, and this is where we work a methodology for how we identify the threat landscape around the network edge of OT. One thing is, it’s difficult to identify your OT network edge because we are not only talking about between your OT and the internet or OT and IT. It’s between your like anything that’s outside of your OT network. It could be between your OT and the cloud, OT and IT, OT and the internet. So we decided to look at all our firewalls. We have 61,000 firewalls. We identified that they see OT traffic. We have our app-ID that looks for any OT application, and if the firewall has a COT application, goes through that firewall. We identify this part of the network edge, and from there we collected a lots of telemetries to look for the threat landscape that impacts or surrounds these networks, and one of the arguments we try to agree on among us is the number of malware that we find. Like you will see, like we have like millions of samples that we were analyzing, and we looked at, like, oh, a lot of these malware are using OT port numbers, and the argument came, like, but that doesn’t mean these malwares are specifically for OT, and we agreed on that. We are not saying all these malware are intentionally designed to impact OT, however, the accidental impact is very high. Right, you have a malware on your OT network edge that’s using an OT port. What are the chances that it can impact your OT network or your OT devices? And that’s the risk and the threat where you’re trying to bring people’s attention. That not every threat has to be an OT specific. Like, we are not talking about Stuxnet, and I know this is the word now people just think about it too much. Like it’s too old now. It’s not you know a sexy buzzing word, but it’s the same concept that not every threat has to be an OT specific. Threats that can impact OT can be IT threats.

Bryson: For those of you at home, check out our show notes for your ability to download the Intelligence Driven Active Defensive Report that Adam has been covering. Final question, Adam: What was your favorite part of Critical Effect D.C. this past June.

Adam: Well, besides meeting you and meeting the team, I think one was the panels and the discussion – I think it was pushing the edge of the conversation I have seen and experienced in this conference. I always tell people that the conference is a small conference, but the quality is very, very high.

Bryson: Well, looking forward to seeing you there next year. Thank you, Adam.

This is Hack the Plant, a podcast from the ICS Village. Catch us at an event near you. Subscribe wherever you find podcasts to get episodes as soon as they’re released. Thanks for listening.