Certified: The CompTIA SecOT+ Audio Course

This episode teaches how to prepare for incidents by drafting and maintaining IR documentation that OT teams can actually use during real events, where time pressure and safety constraints punish vague plans. You’ll learn what documentation must exist before an incident, including role assignments, contact trees, escalation criteria, safe containment principles, evidence handling procedures, commu...

This episode explains escalation and notification as disciplined processes that protect safety, preserve credibility, and reduce legal and regulatory risk, because delayed or inconsistent notifications can create consequences that outlast the technical incident. You’ll learn how internal escalation should work across operations, engineering, safety, IT, security leadership, legal, and communicatio...

This episode teaches how to plan mutual aid and retainers so OT incident response readiness is real, not theoretical, especially when specialized expertise and vendor knowledge may be required quickly. You’ll learn how mutual aid works in practice through sector communities and peer support, and why relationships and pre-defined trust are often more valuable than scrambling for contacts during a c...

This episode explains how to coordinate IT and OT during incidents without letting either side accidentally increase risk, a common scenario theme where the “wrong” answer is a technically reasonable IT action applied at the wrong time in OT. You’ll learn why authority and accountability must be explicit, including who can approve isolations, who can change firewall rules, who can touch controller...

This episode teaches the overarching considerations that make OT incident response different, because OT incidents often blend cyber events with physical realities, crisis management demands, and facilities constraints that cannot be ignored. You’ll learn how to assess whether an event is purely cyber, cyber-enabled physical impact, or a physical issue creating cyber symptoms, and why that distinc...

 This episode explains how OT incident management frameworks provide structured response discipline when safety and uptime are at stake, and why SecOT+ scenarios often reward the answer that follows a clear lifecycle with defined roles. You’ll learn PICERL as a practical flow that emphasizes preparation and iterative improvement, then connect it to what teams actually do in OT, such as validating...

 This episode teaches how to apply a collection management framework so OT security data collection is purposeful, sustainable, and aligned to operational constraints rather than being an endless hunt for “more logs.” You’ll learn how to define collection requirements by starting with decisions you need to support, such as detecting abnormal remote access, validating change control, confirming ass...

This episode explains how to map OT assets into a CMDB in a way that supports security decisions without forcing IT-centric data models that ignore plant reality. You’ll learn which attributes belong in a CMDB record for OT, including stable identifiers, location context down to cabinets or lines, ownership, vendor support boundaries, criticality, and interface exposure, so the CMDB becomes useful...

 This episode explains why software inventory in OT must be mapped to hardware reality, because risks often live in firmware versions, installed packages, configuration sets, and vendor toolchains that do not show up in a simple device list. You’ll learn what “software inventory” includes in OT contexts, such as operating systems, controller firmware, HMI applications, engineering suites, drivers,...

This episode teaches which asset attributes matter most for OT security decisions and why capturing the right details prevents wasted effort during audits, patch planning, and incident response. You’ll learn how to establish identity with stable identifiers, including hostnames, serial numbers, MAC addresses, and controller-specific identifiers, while avoiding the trap of treating any single attri...

This episode teaches how to choose asset discovery methods that respect OT safety and reliability constraints, because the wrong discovery approach can disrupt production and destroy trust in the security program. You’ll learn what passive discovery looks like in practice, including observing traffic and device behavior without injecting packets, and why passive methods are often preferred for fra...

This episode explains asset management as a continuous OT security capability, because you cannot govern access, assess risk, or respond confidently if you do not know what exists and what it does. You’ll learn the difference between discovery, which finds candidates, and inventory creation, which establishes a controlled record with identifiers, ownership, and baseline attributes that can be vali...

This episode teaches facility perimeter controls as the outermost layer of OT defense, because the easiest attack path is often the one that requires no network sophistication at all. You’ll learn how fences and barriers contribute to delay and deterrence, and why perimeter design is about controlling approach routes, limiting concealment, and guiding legitimate entry through monitored points rath...

This episode explains how surveillance and inspection support OT security by providing reality checks that tools alone cannot deliver, especially in environments where visibility gaps and legacy constraints are common. You’ll learn how walkdowns function as structured validation exercises, confirming asset presence, cabinet condition, port exposure, signage, and physical changes that may not appea...

This episode teaches how to secure critical spaces and infrastructure elements in OT, because many “cyber” compromises become easy when rooms, cabinets, and cabling are treated as mere facilities concerns. You’ll learn what MDFs and IDFs typically contain, why they represent high-leverage points for segmentation and availability, and how poor access control can enable taps, rogue devices, configur...

This episode explains physical security controls as part of OT security posture, because physical access frequently equals control access when cabinets, ports, and engineering environments are reachable. You’ll learn how badges, readers, biometrics, and turnstiles function as layers that enforce identity, authorization, and accountability at the facility boundary, and why “everyone knows everyone”...

This episode teaches how to maintain interoperability in OT while keeping designs simple enough to operate reliably, because complexity creates hidden dependencies and workarounds that expand attack surface. You’ll learn how interoperability pressures arise from multi-vendor environments, long lifecycles, and the need to share data across engineering, operations, historians, and business systems,...

This episode explains how OT security designs must preserve performance while also producing auditability and observability that can be demonstrated with evidence, because “we think it’s secure” fails the moment an incident or audit demands proof. You’ll learn what performance means in OT beyond bandwidth, including latency sensitivity, jitter tolerance, deterministic traffic expectations, and how...

This episode teaches how to engineer compartmentalization in OT so you can limit blast radius while still preserving the control behaviors operations depend on, a balancing act that shows up repeatedly in design and response questions. You’ll learn how to use criticality to decide what belongs in separate zones, what needs tightly controlled conduits, and what systems should never share credential...

This episode explains operational resilience as the ability to endure disruption and recover safely, which is a central OT outcome and a frequent thread in SecOT+ scenarios about outages, containment, and restoration. You’ll learn the difference between endurance, redundancy, and high availability, and why each one addresses different failure patterns, from component failures to upstream service o...

This episode teaches core OT architectural principles that support both security and reliable control, because SecOT+ questions often reward the answer that preserves deterministic behavior while reducing exposure. You’ll learn how least privilege applies to OT identities, services, and network paths, emphasizing that broad access is not “convenient,” it is a direct multiplier on blast radius when...

This episode explains how to turn telemetry into usable intelligence by focusing on signals that matter in OT, where too much noise can be as dangerous as too little visibility. You’ll learn how to think about logs, sessions, and network observations as evidence streams, then apply simple analytic questions like “what is normal here,” “what changed,” and “what could that change enable” to move fro...

This episode teaches how to operationalize intelligence data types without forcing IT-centric workflows into OT environments where telemetry and response options are different. You’ll define indicators of compromise as actionable signals that can be searched for in logs and network data, then learn how to treat IOCs as starting points for investigation rather than proof of infection, especially in...

 This episode focuses on the threat vectors most likely to matter in real OT environments and on the SecOT+ exam, with an emphasis on how attackers actually reach control-adjacent systems. You’ll learn how remote access becomes risky when it is unmanaged, broadly permitted, shared across vendors, or protected by weak authentication, and how to reduce that risk with jump hosts, MFA, tight scoping,...

This episode teaches how to analyze the OT threat landscape by connecting actor motives and capabilities to the kinds of consequences OT environments can experience, which helps you choose answers that match realistic risk. You’ll learn how motivations differ across criminal groups, ideological actors, insiders, and nation-state aligned teams, and how those motivations influence targeting decision...