Critical Assets Podcast

Critical Assets Podcast

by Patrick Miller
Tech NewsTechnology
Season 4
Turning Cyber Risk Into a Decision You Can Defend
Patrick Miller sits down with Scott Kannry, co-founder and CEO of Axio, to work through cyber risk quantification as a security decision tool for OT and critical infrastructure. Scott came up in the insurance industry at Aon in the early days of cyber coverage. He founded Axio with Dave White to close the gap between a technical security program and a number a CFO and a board can act on. The conversation stays practical. Why you start on the impact side instead of arguing about probability. How NERC CIP already thinks in consequence. Why the events that matter most are rare, huge, and short on data. How to compare controls, insurance, and compliance spend on the same dollar scale. What AI and quantum do to the "it will never happen" excuse. And a new D&O option for CISOs built on top of consistent quantification. Full show notes, links, and the episode transcript are on the Ampyx Cyber episode page at ampyxcyber.com/podcast. Topics covered: The founding of Axio and the insurance-meets-frameworks origin A short history of cyber insurance, from data breach to business interruption to cyber-physical The four loss categories Axio uses, first and third party, financial and tangible Coverage gaps for industrial facilities and the danger of assumed coverage Impact-first quantification versus probability-first modeling NERC CIP and consequence-only risk rating Fiduciary duty, duty of care, and defensible decisions Security decision support versus vanity security metrics The art and science of pricing control ROI AI and quantum, and why low-probability high-impact events deserve attention now A D&O insurance option for CISOs tied to consistent quantification
S4 · E4
Aug 15, 2026
49:07
The Attack Surface You Eat: Cyber Risk in Food and Agriculture
The Attack Surface You Eat: Cyber Risk in Food and Agriculture Kristin King joins Patrick Miller to make the case that food cybersecurity is not food security, and that food and agriculture is one of the most under-defended corners of critical infrastructure. From precision agriculture and processing plants to aquaculture, zoos, and aquariums, they trace where the OT and ICS risk actually lives, why the regulatory floor is so thin, and how the threat range runs from opportunistic ransomware to nation-state targeting and agroterrorism. Guest: Kristin King, founder and CEO of AnzenSage, CEO and co-founder of AnzenOT, host of the Bites & Bytes Podcast, and author of Securing What Feeds Us: Cybersecurity in Food and Agriculture (Wiley). Full show notes and every source referenced in this episode: https://ampyxcyber.com/podcast/the-attack-surface-you-eat-cyber-risk-in-food-and-agriculture Guest links AnzenSage: https://www.anzensage.com/ Bites & Bytes Podcast: https://www.bitesandbytespodcast.com/about Kristin King on LinkedIn: https://www.linkedin.com/in/kingmkristin Securing What Feeds Us (Wiley): https://securingwhatfeedsus.com/
S4 · E3
Jul 8, 2026
1:10:21
Policy Pulse: Regulatory Roundtable - Cyber Strategy, Large Loads, AI & CISA in Flux
Explicit
Patrick Miller reconvenes with Joy Ditto (Joy Ditto Consulting) and Earl Shockley (INPOWERD) for a tour of the past two months in critical infrastructure policy. The episode opens on the administration's new National Cybersecurity Strategy and its six pillars, with focus on the openly offensive "shape adversary behavior" posture and the asymmetric risk it creates for asset owners likely to absorb retaliation. The panel then digs into the pressures reshaping the bulk electric system: data center designation, cloud-hosted control centers running NERC standards while the underlying compute is unregulated, and the physics of computational loads that behave nothing like traditional load. Earl walks through the recent NERC Level 3 alert on large load connections, an unusually serious signal that industry processes are behind. The discussion also covers April infrastructure executive orders that release funding but ignore cybersecurity, hyperscalers displacing utilities as the top buyers of bulk electrical equipment, the multi-agency zero trust in OT guidance, and CISA's leadership uncertainty after Sean Plankey withdrew his nomination. On the AI front, the group unpacks what Anthropic's Mythos and the Glasswing response mean for vulnerability discovery at scale, and why no OT vendors are on the Glasswing list. Closing thoughts include Joy's note on satellite cybersecurity and a rare bipartisan Senate trip to China, Earl's emphasis that computational load is now an enterprise governance issue rather than a technical one, and Patrick's plea to stop making the adversary's job easy. Topics covered The new National Cybersecurity Strategy and its six pillars Offensive cyber posture and the asymmetric risk to asset owners Data center designation as critical infrastructure Cloud control centers and the NERC 100-series standards Computational load, grid stability, and loss of system inertia NERC Level 3 alert on large load connections April infrastructure executive orders and the missing cyber language Supply chain shifts and hyperscalers as the top equipment buyers Zero trust principles for OT environments CISA Fortify guidance and CISA's current leadership status Anthropic's Mythos, the Glasswing response, and the OT vendor gap Satellite cybersecurity and bipartisan engagement on China policy Basic hygiene: get exposed devices off the internet
S4 · E2
May 11, 2026
1:00:18
Policy Pulse: Regulatory Roundtable - NERC CIP, Cybersecurity Strategy, AI & Electric Sector
Welcome to the Policy Pulse Panel, a new monthly series within the Critical Assets Podcast. Hosted by Patrick Miller (Ampyx Cyber), Earl Shockley (CEO, Inpowerd), and Joy Ditto (CEO, Joy Ditto Consulting), this recurring panel dives into the most significant policy shifts and regulatory developments impacting critical infrastructure, operational technology (OT), and industrial cybersecurity. Each month, we unpack emerging legislation, agency actions, and standards updates - connecting the dots between policy and the practical realities faced by asset owners, utilities, vendors, and government partners. If you're trying to stay ahead of your auditors and your legislators, this is your monthly must-listen. https://ampyxcyber.com/podcast/policy-pulse-regulatory-roundtable-nerc-cip-cybersecurity-strategy-ai-electric-sector
S4 · E1
Feb 1, 2026
1:02:05
Season 3
Vulnerability Overload: Making Prioritization Work in the Real World
In this episode, Patrick Miller speaks with Kylie McClanahan, CTO at Bastazo, about the practical (and often messy) realities of patch and vulnerability management in operational technology (OT) environments. Kylie shares grounded insights into patching challenges, the gaps between IT and OT remediation cycles, and the real-world implications of relying too heavily on scoring systems like CVSS. The conversation covers CISA’s Known Exploited Vulnerabilities (KEV) catalog, exploring how it’s being used (and possibly misused) in prioritization workflows, and where the disconnects lie between policy directives and operational feasibility. Kylie also critiques the current state of vendor responsiveness, machine-readable vulnerability disclosure (CSAF), and the importance of asset and exposure awareness. This episode is essential listening for practitioners wrestling with patching fatigue, program prioritization, and the tradeoffs between theoretical vulnerability data and applied security outcomes in critical infrastructure environments. Links: CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities CISA vulnrichment: https://github.com/cisagov/vulnrichment Vulnrichment, Year One: https://www.youtube.com/watch?v=g5pSVMnWD7k CISA SSVC: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc Carnegie Mellon SSVC: https://certcc.github.io/SSVC/ CSAF: https://www.csaf.io/ VulnCheck KEV: https://vulncheck.com/kev Kylie McLanahan on LinkedIn: https://www.linkedin.com/in/kyliemcclanahan/ Bastazo: https://bastazo.com
S3 · E3
Jul 20, 2025
35:36
From CISO to Startup: OT Security, Leadership, and Lessons from the Field
In this episode of the Critical Assets Podcast, Patrick Miller interviews Darren Highfill, former CISO of Norfolk Southern, for a candid look behind the curtain of life as a security executive. Darren shares hard-won lessons from building and leading a cybersecurity program in a critical infrastructure environment, including how to gain executive buy-in, scale a team, and align security with business priorities. He reflects on the challenges of translating cyber risk into business risk, managing real-world incidents, and the evolving expectations of the CISO role. Whether you're in the chair now or working toward it, this conversation is packed with practical insights for anyone navigating cybersecurity leadership. Show links: Darren Highfill LinkedIn Profile - https://www.linkedin.com/in/darrenhighfill/ NIST Cyber Security Framework (CSF) - https://www.nist.gov/cyberframework Ankrd website - https://www.ankrd.com/
S3 · E2
Apr 13, 2025
44:04
Critical Conversations: IR, Forensics, and Regulation in OT
In this episode, we sit down with Lesley Carhart (@hacks4pancakes), a renowned expert in OT/ICS incident response and forensics, to explore the unique challenges of defending critical infrastructure against cyber threats. Lesley shares insights into how internal OT teams can better support external IR teams, evaluates global and sector-specific preparedness, and discusses the impact of regulations on effective incident response. We delve into the complexities of defining and reporting incidents, the potential for improved approaches, and actionable advice for those looking to enhance their IR and forensics skills. Lesley also gives a glimpse into the future of their work and their continued mission to strengthen cybersecurity in critical infrastructure. Show Links: https://www.linkedin.com/in/lcarhart/ https://www.threads.net/@hacks4pancakes https://bsky.app/profile/hacks4pancakes.com https://infosec.exchange/@hacks4pancakes
S3 · E1
Jan 4, 2025
44:32
Season 2
Energizing Cybersecurity Careers: Workforce Development in OT/ICS
Join us for a discussion on Energizing Cybersecurity Careers: Workforce Development in the OT/ICS Community. Guests Cynthia Hsu and Erin Owens dive into the cybersecurity challenges facing Industrial Control Systems and Operational Technology asset owners. Through open conversations, we explore everything from skill gaps and career pathways to diversity, continuous learning, and the impact of new technologies. This session aims to provide insights into developing a skilled, diverse cybersecurity workforce – starting from the ground up – with a focus on practical strategies for professionals, educators, and anyone interested in the future of ICS/OT security. Show links: Cynthia Hsu LinkedIn profile https://www.linkedin.com/in/cynthiahsu33/ Erin Owens LinkedIn profile https://www.linkedin.com/in/erinowens/DOE CESER Cybersecurity Training for the Utility Workforce, free 3-day ICS Cybersecurity training for electric and ONG utility staff.  Next training event: Buffalo, NY, April 23-25,  Register at: Eventleaf | Event Registration Software and Mobile Event Apps   DOE CESER CyberStrikeTM professional cybersecurity training for operational technology environments: https://inl.gov/cyberstrike/ ·       LIGHTS OUT – focus on Ukraine attacks ·       NEMESIS – focus on nation-state TTPs ·       STORMCLOUD – focus on renewable energy     DOE CESER CyberForce® workforce development program for college students focused on building a pipeline of cyber professional candidates in operational technology cybersecurity:  https://cyberforce.energy.gov/   Sandia National Laboratory Tracer FIRE (Forensic Incident Response Exercise): https://github.com/sandialabs/Tracer-FIRE Center for Cyber Defenders:  https://www.sandia.gov/careers/career-possibilities/students-and-postdocs/internships-co-ops/institute-programs/titans-technical-internships-to-advance-national-security/titans-cyber/   Cyber Defense Center https://www.cyberdefensecenter.org/
S2 · E1
Mar 3, 2024
1:08:23
Season 1
CIE: Architecting Infrastructure Immunity
In this episode, we take a deep dive into the world of Cyber Informed Engineering (CIE), joined by Ginger Wright, Program Manager at Idaho National Laboratory. This episode unpacks CIE's strategic efforts to integrate cybersecurity into the very fabric of engineering critical infrastructure. We discuss the evolution of CIE and how it's transforming the approach to system design. We cover the synergy between engineers and cybersecurity experts and the implementation of engineering-based mitigations. Get insights on building resilience into critical systems from the ground up.
S1 · E6
Nov 9, 2023
53:39
One Rule to Rule Them All
Join Patrick Miller, CEO of Ampere Industrial Security and his guest Danielle Jablanski, OT Cybersecurity Strategist at Nozomi Networks as they continue their debate on the topic: "If you could have only one cybersecurity regulation, what should that be?" They cover everything from threat hunting, vulnerability management, attack surface management, incident response, breach notification, risk quantification, cybersecurity insurance, NIS2, NERC CIP, and what's best for corporate vs. public good.
S1 · E5
Sep 5, 2023
59:18
1 of 2