We’re Asking the Wrong Question About OT Security Investment

This piece argues that many industrial organizations underinvest in OT monitoring and visibility, which undermines both prevention and operational capability; it presents a three-tier "pyramid" (legal/regulatory compliance, business/operational capability, and cyber risk reduction) and recommends designing OT security programs that address all three tiers simultaneously so monitoring supports compliance, operational resilience, and targeted cyber defenses.