Why OT incidents often escalate after detection
Industrial environments are becoming increasingly digital. Production systems, energy installations, and logistics processes are now closely connected to IT networks and external platforms. This boosts efficiency, but also increases vulnerability, says Nick Peeters, founder of Soterics and keynote speaker at Cybersec Europe. “Detection is no longer the hard problem, response is.”
In many organizations, detection mechanisms have significantly improved in recent years: anomaly detection, SOC monitoring, and vulnerability scanning generate alerts more quickly and more frequently. “Yet in practice, incidents in operational technology (OT) environments often escalate after they have been identified,” Peeters notes.
Nick Peeters will speak about this on May 20, 2026, in the Tech Theater at Cybersec Europe, taking place on May 20–21 in Hall 5 of Brussels Expo.
Response is not a slower version of IT
While IT incident response often focuses on speed—isolating, patching, restoring—different rules apply in OT environments. Production processes, safety systems, and physical installations are closely interconnected.
A rushed intervention can disrupt continuity or even create safety risks. “OT incident response is not IT response at a slower pace,” Peeters emphasizes. “A poor response can cause more damage than the cyber incident itself.”
He therefore advocates a response-centric approach to OT cybersecurity. According to him, control—not speed—should be the primary metric. Organizations must define clear boundaries in advance: which systems are critical, which processes depend on each other, and who is authorized to make decisions under uncertainty?
Technology alone is not enough
Peeters also sees a broader challenge. Many organizations invest in additional tools when something goes wrong, while the problem is often organizational. Cybersecurity in OT requires aligned processes and clear responsibilities between corporate policy and local operational teams.
“Resilience is not a toolset, but a decision-making capability,” he says. The ability to make the right trade-offs under pressure ultimately determines whether an incident remains contained or escalates into a crisis.
With his keynote, Peeters is not only addressing OT specialists, but anyone who views cybersecurity as a strategic discipline where technology, processes, and people come together.
Nick Peeters will speak on May 21, 2026, at 14:45 in the Tech Theater at Cybersec Europe, taking place on May 20–21 in Hall 5 of Brussels Expo.
Register for free!
As cyber attacks continue to threaten today’s tech landscape, this event is the premier platform for seasoned cyber security professionals and innovative start-ups to exchange knowledge and tackle cybersecurity challenges together. Organizations across all sectors will discover strategies to boost cyber resilience and safeguard critical assets. Don’t miss this chance to strengthen your cyber defenses.