OT After Hours

In this episode, we explore how an embedded-systems engineer became the leader of Verve's Special Projects & Protocols team—and what his journey says about recruiting, culture, and continuous learning in OT security. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guest Lance Lamont, Manager for Special Projects & Protocols, as they discuss career pivots, protocol reverse-engineering, and building low-ego teams that thrive on curiosity. Key Takeaways Transferable skills matter: deep protocol expertise from product engineering can power OT-security research Flexibility attracts talent: "We want you for your skills, not your hours" sealed Lance's mid-pandemic move to Verve Low ego, high curiosity: teams grow faster when members admit mistakes and chase answers together Diverse entry points strengthen outcomes: mixing maker-space tinkerers, robotics alumni, and anime-inspired problem-solvers yields broader perspective Timestamps 00:00 – Introduction and sound check 00:05 – From touch-screen drivers to a LinkedIn message that changed everything 02:45 – Turning down (then accepting) the offer: balancing parenting and remote work 05:20 – "Skill collector" mindset and early protocol wins 07:10 – Maker-space leadership and the value of empowering others 09:38 – Imposter feelings, confidence, and the culture of asking questions 11:30 – Hiring for curiosity and low ego: what Lance looks for in new team members 13:00 – Closing thoughts on continuous learning and career growth Guest Information Lance Lamont: Manager, Special Projects & Protocols at Verve Industrial. Former embedded developer (power tools, automotive, touchscreens) who now leads a multidisciplinary research team reverse-engineering OT communication protocols. Subscribe Follow and Subscribe for more episodes on Apple Podcasts, Spotify, YouTube, or wherever you get your podcasts. Get in Touch 🔗 LinkedIn | YouTube | Twitter/X | Contact Verve | Listener Q&A

In this episode, we take a look at how Verve Reporting, and in particular its ability to search and filter logs, can be useful for high-level forensic investigation. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Dustin Gogue (Technical Account Manager), Andrew Wintermyer (Team Lead, Device & Integration Research) and Zach Woltjer (ICS Security Specialist) as they dive into how Verve Reporting helped identify user account management and authentication issues. Key Takeaways Proper user account hygiene (especially timely user off-boarding) is a key component of a robust security strategy. Maintaining named user accounts for key personnel is important for non-repudiation during investigations. OT software is sometimes installed in a way that binds its services or application authentication to a particular user account, which can present a challenge when and if that user needs to be off-boarded. The ability to collect, filter, and search event logs quickly and easily is a key component of forensic and incident investigation. Timestamps 00:00 – Introduction and sound check 00:27 – Welcome to Season Two of OT After Hours 00:37 – Guest introductions: Dustin, Andrew & Zach 01:30 – Quick overview of what logs are 02:19 – Why logs are important to digital forensics 04:43 – Dustin steps through the process of investigating an influx of logs and discovering key issues 12:50 – Identifying an improperly off-boarded user account within the authentication logging data 13:30 – The complexities of user off-boarding in OT environments 16:32 – Zach on incorporating user account privileges and user employment status into risk calculations 24:15 – Value of the Verve Reporting platform and roundtable discussion 32:33 - Outtro and thank yous Guest Information Dustin Gogue: Technical Account Manager at Verve Industrial Andrew Wintermyer: Device & Integration Research Team Lead at Verve Industrial Zach Woltjer: ICS Security Specialist at Verve Industrial Subscribe Follow and Subscribe Get in Touch LinkedIn | YouTube | Twitter/X | Contact Verve I Listener Q&A

In this episode, we explore how often OT teams really need to refresh asset-inventory data and what MITRE's near-miss funding lapse for the CVE program means for vulnerability management. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Natalie Kalinowski (OT Security Specialist), Lance Lamont (Team Lead, Special Projects & Protocols), Andrew Wintermeyer (Senior ICS Architect), and Tyler Bergman (Principal Security Consultant) as they discuss scan cadences, change-detection value, and building redundancy into threat-intel pipelines. Key Takeaways Context drives cadence. Fan speed may need minute-level polling, firmware often does not. Redundancy is resilience. Blend NVD, CISA, MITRE, and vendor advisories to survive feed outages. CVE is a language, not the cure. Losing it wouldn't add vulnerabilities, but it would cripple prioritization. Change detection turns inventory data into real-time alerts for unauthorized config tweaks. Timestamps 00:00 – Introduction and sound check 03:30 – Why "asset-data freshness" landed on today's agenda 04:10 – MITRE CVE funding scare: what happened and why it matters 10:50 – OT vs. IT views on vulnerability backlog and enrichment 18:00 – Mapping scan frequency to business need 24:40 – Change management and configuration-drift detection 33:00 – Diversifying data sources beyond NVD 38:50 – The proposed "CVE Foundation" for long-term stability 42:40 – Building redundancy into threat-intel pipelines 44:50 – Listener poll results: hard-rock "Legacy Code" wins 46:15 – Sign-off and credits Listener Q&A We're happy to announce that the hard rock version of Legacy Code on the Conveyor Belt was far-and-away the fan favorite! Download it now! Guest Information Natalie Kalinowski: OT Security Specialist at Verve Industrial; leads proof-of-value engagements and vulnerability mapping. Lance Lamont: VP, Solutions Engineering at Verve Industrial; directs driver development and asset-inventory strategy. Andrew Wintermeyer: Senior ICS Architect at Verve Industrial; designs secure network architecture for critical infrastructure. Tyler Bergman: Principal Security Consultant at Verve Industrial; focuses on risk prioritization and framework alignment. Subscribe Follow and Subscribe Get in Touch LinkedIn | YouTube | Twitter/X | Contact Verve I Listener Q&A

In this episode, we explore the challenges and best practices for identifying and inventorying assets in operational technology (OT) environments. Join host Ken Kully, Systems Support Lead at Verve Industrial, along with guests Lance Lamont, Andrew Wintermeyer, Tyler Bergman, and Rick Herzing, as they discuss how to establish trust, safely discover assets, and navigate network complexities without disrupting operations. Key Takeaways Establishing Trust & Engagement: Successful asset identification starts with building relationships with site personnel, including ICS engineers and facility managers. Safe Asset Discovery Techniques: Using non-disruptive methods like passive network monitoring, ARP table collection, and targeted scans is key in OT networks. Common Challenges: Mismatched documentation, unknown legacy devices, and unconventional network setups often complicate the process. Collaboration is Crucial: Teams at Verve integrate expertise from research, engineering, and cybersecurity to ensure efficient and secure asset inventorying. Continuous Monitoring & Adaptation: The process doesn't end with identification—maintaining an up-to-date inventory is an ongoing effort. Listener Q&A Want to ask a question for the experts at Verve to answer? Let us know! Timestamps 00:00 – Introduction and sound check 01:10 – Welcome back to Season 2 of OT After Hours 03:14 – What is the core functionality of Verve in OT environments? 06:45 – Trust-building and engaging with OT personnel 12:30 – Real-world surprises: Unexpected device discoveries 18:05 – How Verve safely identifies assets without disrupting operations 27:38 – Leveraging Verve's capabilities for accurate inventorying 41:11 – Importance of communication and customer engagement 46:53 – The evolving role of Verve and IT-OT integration Guest Information Lance Lamont – Lead, Special Projects & Protocols, Verve Industrial Andrew Wintermeyer – Lead, Device & Integration Team, Verve Industrial Tyler Bergman – Lead, Field Deployment Team, Verve Industrial Rick Herzing – OT Systems Support Analyst, Verve Industrial Subscribe Follow and Subscribe Get in Touch LinkedIn | YouTube | Twitter/X | Contact Verve I Listener Q&A

In this episode, we explore the evolving challenges of cybersecurity maturity in operational technology (OT) environments. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Lauren Blocker, Industrial Cybersecurity Consulting Partner at Rockwell Automation; Drew Wintermyer from Verve's OT Research Lab; Zachary Woltjer from the Customer Success Team; Tyler Bergman, Operations Manager; and Rick Herzing from Verve Systems Support as they discuss the importance of assessing cyber maturity, bridging IT/OT security gaps, and implementing effective strategies for resilience. Key Takeaways Cyber maturity is not a one-size-fits-all process; it requires tailoring to specific organizational risks and priorities. IT/OT convergence brings unique challenges, necessitating a deep understanding of industrial environments. Frameworks like NIST CSF and ISA/IEC 62443 provide actionable pathways for improving OT cybersecurity maturity. Overcoming resource and talent shortages is critical to achieving sustainable cyber maturity. Collaboration across leadership, operators, and external partners is essential for effective implementation. Timestamps 00:00 – Introduction and sound check 01:26 – Welcome and episode overview 02:05 – Guest introductions and background 06:45 – What does "cybersecurity maturity" mean in an OT context? 15:20 – The challenges of IT/OT convergence 22:10 – Building and executing a cybersecurity maturity roadmap 30:55 – Real-world success stories and common pitfalls 40:30 – The future of OT cybersecurity and emerging technologies 50:10 – Closing thoughts Guest Information Lauren Blocker: Industrial Cybersecurity Consulting Partner at Rockwell Automation. Lauren specializes in assessing and enhancing cybersecurity maturity, helping enterprises implement globally consistent, standards-based strategies. Drew Wintermyer: Research Lead at Verve's OT Research Lab, focusing on OT-specific vulnerabilities and resilience strategies. Zachary Woltjer Customer Success Specialist at Verve Industrial, with expertise in helping organizations implement OT cybersecurity solutions. Tyler Bergman: Operations Manager, providing insights into the practical challenges of cybersecurity in industrial environments. Rick Herzing: Verve Systems Support analyst, and former industrial controls engineer. Subscribe Follow and Subscribe Get in Touch LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we explore the concept of Calculated Risk Rating (CRR) and its importance in OT cybersecurity. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests – Zachary Woltjer, Cyber Data Analyst at Verve, and Lance Lamont – as they discuss how to prioritize and address vulnerabilities in industrial environments. Key Takeaways Calculated Risk Rating helps tailor cybersecurity solutions to specific industrial environments CRR considers both the impact and likelihood of vulnerabilities being exploited The approach helps organizations prioritize their limited resources for maximum security benefit Trust between cybersecurity providers and industrial operators is crucial for effective risk management Active asset inventory solutions provide richer data for more effective risk mitigation strategies Timestamps 00:00 – Introduction and sound check 01:00 – Introduction of guest Zachary Woltjer 02:50 – Explanation of Calculated Risk Rating (CRR) 06:21 – Importance of contextualizing vulnerability information 09:47 – Discussion on EPSS (Exploit Prediction Scoring System) 12:43 – Identifying "crown jewels" in industrial environments 18:48 – Process of assigning criticality and likelihood ratings 26:50 – Importance of defense in depth strategies 31:01 – How Verve's teams work together to implement CRR 35:56 – Benefits of active asset inventory solutions 42:35 – Conclusion and outtro Guest Information Zachary Woltjer: Cyber Data Analyst on the Customer Success team at Verve Industrial Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security. Subscribe Follow and Subscribe Get in Touch LinkedIn | YouTube | Twitter/X | Contact Verve

In this episode, we explore the implications of the recent Crowdstrike incident for OT cybersecurity. Join host Ken Kully, Systems Support Lead at Verve Industrial, and his guests Tyler Bergman and Ryan Zahn as they discuss the impact of IT security tools on OT environments, the importance of staged rollouts, and the delicate balance between automated updates and manual controls. Key Takeaways: The Crowdstrike incident highlights the risks of using IT-focused security tools in OT environments Staged rollouts and thorough testing are crucial for minimizing risks in critical infrastructure OT environments require a different approach to updates and security compared to IT systems The incident underscores the need for better collaboration between IT and OT teams Kernel-level access in security software presents both benefits and risks that must be carefully managed Timestamps: 00:00 – Introduction and discussion of recent events 03:08 – Overview of the Crowdstrike incident and its impact 05:50 – Discussing the differences between IT and OT security approaches 14:57 – Exploration of staged rollouts and testing processes 23:43 – The importance of human safety in OT environments 28:36 – The need for OT-specific considerations in security tool deployment 35:36 – Discussion on the risks associated with kernel-level access 43:18 – Reflecting on the broader implications for cybersecurity and critical infrastructure 48:06 – Closing thoughts and wrap-up Guest Information: Tyler Bergman: Utility engineering expert with 20 years of experience, focusing on cybersecurity efforts for the past five years. Ryan Zahn: Customer Success professional at Verve Industrial with over 11 years of experience and a background in OT as a state engineer for a Midwest power utility. Subscribe: Follow and Subscribe Get in Touch: LinkedIn | YouTube | Twitter/X | Contact Verve

In our second episode, we ask the question: "what is OT?", and attempt to provide an answer. Join host Ken Kully, Cyber Tech Lead at Verve Industrial, and his guests and colleagues Lance Lamont, Tyler Bergman, Doug Artze, and Drew Wintermyer as they discuss what characterizes an OT environment and OT equipment, the impact of IT/OT convergence on distinguishing one realm from the other, and how a device's usage is often the deciding factor as to whether it is an IT device…or an OT device. Key Takeaways: OT is the collection of hardware and software that is principally concerned with process availability: monitoring the process, providing safety oversight, and the automation, supervision, and control of the core processes for any industry. The same device can be both an IT device and an OT device, depending on usage. OT systems are often – though not always – characterized by device isolation, and can also be spread over a large geographic area. There are some industries – healthcare is an example – where the distinction between IT and OT becomes very blurred. Timestamps: 00:00 – Introduction and sound check 00:35 – Welcome to OT After Hours 00:43 – Host introductions and background 03:40 – What is OT? 04:32 – Parallel terms: IT and OT 05:56 – Other terms: DCS, SCADA, etc. 11:43 – Hardware differences between IT and OT 14:20 – The role of context in defining OT devices 17:34 – The evolution and convergence of OT and IT 19:52 – The CIA triad and its different priorities in IT and OT 22:36 – The timeliness element in OT systems 23:30 – Engineering workstations and their classification 32:36 – The criticality of availability in OT environments 34:30 – The sensitivity of OT control systems 37:41 – Examples of OT in non-industrial settings 44:27 – The importance of physical access in OT security 46:55 – The unique challenges of healthcare OT 50:59 – Concluding thoughts on defining OT Guest Information: Lance Lamont: Creator and Explorer at Verve Industrial Protection, leading the research team in exploring OT devices and their security. Tyler Bergman: Experienced in utilities and OT security with over 20 years in the industry. Doug Artze: Operations team lead with experience in nuclear power and wastewater treatment. Drew Wintermyer: Research team member and overseer of Verve's internal labs of OT devices. Subscribe Follow and Subscribe Get in Touch LinkedIn | YouTube | Twitter/X | Contact Verve