Correcting Prevention Bias in Your OT Cyber Incident Response

Dragos analyzed multiple OT/ICS and IT cybersecurity standards and found a systemic "prevention bias"—controls and requirements heavily favor Identify and Protect functions while Detect, Respond, and Recover are underrepresented—leading to inadequate detection and incident response capabilities in industrial environments. The report supports this with standards metrics (e.g., NIST CSF, NIST 800-53, ISA/IEC 62443), IR case examples like misconfigured segmentation, and recommends adopting continuous improvement, increasing OT visibility, and conducting regular tabletop exercises to build active defense and resilience.