When Governance Fails on the Plant Floor: Deconstructing Real ICS Incidents and Rebuilding Security that Actually Works

Industrial Control Systems rarely fail because of “advanced hackers.” They fail because governance, engineering, and security do not meet where real work happens. In this session, we will deconstruct real-world ICS and OT security incidents drawn from audits, incident reviews, and post-incident remediation efforts across industrial environments. Each case shows how small, everyday decisions - vendor access, asset visibility gaps, emergency bypasses, weak change management - cascade into exploitable conditions. Rather than focusing on tools or fear-based threat narratives, this talk maps each incident directly to practical defensive actions aligned with the SANS ICS 5 Critical Controls, showing what actually prevented recurrence and what failed despite good intentions. Attendees will leave with concrete, immediately applicable steps to strengthen ICS environments without disrupting operations, including governance patterns that work on the plant floor, not just on paper.