Cybersecurity in an industrial environment isn't just an IT concern. It's a question of whether the business can keep operating, and whether people stay safe when systems fail.

Craig Duckworth talks with Tim Hoffman, a former NSA director of threat intelligence whose career spans military intelligence, defense, healthcare, finance, critical infrastructure, and industrial operations.

They discuss why CMMC needs to be treated as a cultural shift rather than a compliance exercise, how CISOs earn trust with plant teams, and why leaders have to translate cyber risk into terms the board actually understands.

Tim explains why tools alone can't protect OT. Craig ties digital safety back to the drills and routines plants already run. And together they look at where AI helps, where it adds risk, and why two fundamentals still matter most: clear processes and the discipline to practice them.

Chapters:

  • (00:00:00) Why Security Tools Cannot Solve Operational Risk
  • (00:01:00) Lessons from an NSA and Mission Critical Security Career
  • (00:05:00) Why CMMC Must Be More Than a Compliance Checklist
  • (00:08:00) Closing the Authority Gap Between IT and OT
  • (00:12:00) Translating Cyber Risk Into Cost and Human Consequences
  • (00:17:00) Why OT Security Demands More Than IT Tools
  • (00:19:00) AI, Faster Attacks, and the Need for Human Judgment
  • (00:25:00) Start With Process and Build the Discipline to Follow It
  • (00:27:00) Treating Cyber Response Like a Plant Safety Drill
  • (00:31:00) People and Process Come Before Technology


Links And Resources:


Thanks so much for joining us this week. Want to subscribe to Industrial Cybersecurity Insider? Have some feedback you’d like to share? Connect with us on Spotify, Apple Podcasts, and YouTube to leave us a review!

Rss Apple Podcaster
Podden och tillhörande omslagsbild på den här sidan tillhör Industrial Cybersecurity Insider. Innehållet i podden är skapat av Industrial Cybersecurity Insider och inte av, eller tillsammans med, Poddtoppen.