Cyber security in industry is increasingly a matter of management, not just technology. The NIS2 directive and the Cyber Resilience Act are shifting responsibility onto boards of directors, while the unique nature of operational technology makes quick patching and updates nearly impossible. Artificial intelligence is also setting new rules for both attackers and defenders.
Experts gathered at the CYBERSEC EXPO & FORUM in Katowice on 16 June discussed the challenges facing industrial cyber security. They pointed out that OT environments — which control machinery, production lines, and critical infrastructure — operate on lifecycles of up to 15 years, far longer than the 2–3 years assumed by regulations like the CRA. This makes compliance difficult without risking production downtime.
From technical standards to corporate governance
The panelists agreed that NIS2 is transforming cyber security from a set of technical norms into an element of corporate governance. Article 21 of the directive requires effective risk management within companies. Boards must allocate budgets, implement procedures, and take responsibility.
– We already treat occupational health and safety as part of how a company functions. Cyber security should be seen the same way — as a factor essential for proper business operation, not just an obstacle for management and staff – said Dawid Bazan, cyber security lead architect at Stellantis.
– Cyber security will cease to be a technical standard and start being part of corporate governance, on par with other regulations. The board must introduce procedures and allocate a budget for proper action. For me, NIS2 is Article 21 of the directive — effective risk management in the company – added Mikołaj Śniatała, partner at Andersen.
AI speeds up detection but creates new challenges
The role of artificial intelligence in cyber security was debated extensively. AI can accelerate the detection of vulnerabilities and anomalies, which is particularly useful in the stable environment of OT systems. However, it also shortens the time from discovery to exploitation from days to seconds.
– The speed of finding vulnerabilities has significantly increased. The time from detection to exploitation has changed from days to seconds. On the defence side, systems must work equally fast – noted Waldemar Chlebik, head of cyber security at Siemens.
Zuzanna Wieczorek, CEO of Tekniska Polska, warned against trying to patch everything. In industry, it has never been possible to fix all vulnerabilities in time.
– The focus of defence cannot be based on patching vulnerabilities on time — that is unrealistic at scale. You must set priorities, focus on what is critical for the company, and embed that in cyber security frameworks. If you try to handle everything, you will be paralysed – she said.
The long lifecycle of OT systems demands new approaches
One of the biggest hurdles is the age of OT systems. Many machines run on software that predates modern security requirements. For example, water supply infrastructure — a type of critical infrastructure — has a typical lifecycle of 15 years.
– OT systems often rely on older software. The lifecycle of many machines on the OT side is not 2–3 or even 5 years, as the CRA assumes by default – explained Mikołaj Śniatała.
Panelists stressed the need for isolation between IT and OT, while allowing them to cooperate. Downtime for a production line is unacceptable, so cyber security must be designed from the start. Dawid Wachowiak, director of digital transformation and IT at investment fund TDJ, described how his company approaches acquisitions: they assume the infrastructure is not secure, perform an audit of both IT and OT, and only then integrate the company into their system. The spinoff must be self-sufficient and ready for a new owner.
– The entire architecture — infrastructure, systems, and cyber security — must be designed from the beginning with the acquisition process in mind: take over the company, adapt it to our standard, and then exit it from the portfolio – he said.
Outsourcing some functions, such as a Security Operations Center, can be cost-effective for small and medium enterprises, but management responsibility must stay internal.
Źródło: WNP.PL, Fot. PTWP
