In our latest Hall of Fame interview, Industrial Cyber features Mike Holcomb, the ICS/OT cybersecurity leader who turned curiosity into a career, and then into a mission to help others follow him. He has worked inside some of the world’s largest industrial environments, and now spends much of his time making that world easier for newcomers to enter.
In 2010, Stuxnet showed the world that malware could wreck physical machinery. Most cybersecurity professionals saw a headline. Holcomb saw a question he could not shake: how could someone compromise the systems that keep essential services running? Because the field was unfamiliar ground for most security professionals at the time, he sought out operators and engineers on plant floors and in control rooms to learn how these systems really ran. That curiosity carried him deeper into industrial environments, and it later pushed him to make the road easier for those coming after him.
Holcomb founded UtilSec after his role as fellow of cybersecurity and ICS/OT cybersecurity global lead at Fluor ended about a year ago. At Fluor, he covered power generation, commuter rail, manufacturing facilities, and refineries. He holds a master’s degree in ICS/OT cybersecurity from the SANS Technology Institute, along with certifications that include CISSP, GRID, GICSP, GCIP, GPEN, GCIH, and ISA/IEC 62443.
Remembering how hard it was to enter a specialized field with few learning resources, he began sharing his knowledge in 2023 through LinkedIn and his UtilSec YouTube channel. His videos and courses cover the basics of ICS/OT, penetration testing, standards, threat intelligence, and defenses. His website offers free infographics, e-books, and TryHackMe rooms. His GitHub includes 23 repositories, among them Shodan quick start guides, Modbus testing tools, and a simulator inspired by the controllers targeted in the FrostyGoop attack in Ukraine.
Holcomb also founded the BSidesICS/OT and BSides Greenville conferences. His SANS Summit talks share the same practical streak: one showed how ChatGPT can help write ICS/OT defensive and offensive tools, and another addressed automating the SANS ICS 5 Critical Controls for free.
The community has taken notice. In 2026, he received the BEER-ISAC Community Builder Award for his contributions to the OT/ICS cybersecurity community. That followed his 2025 win of Practitioner of the Year for ICS/OT Defender, a Community Choice award, at the SANS Difference Makers Awards.
“We all ‘live’ in the same house and we have the same goals: keep someone from breaking in and burning it down to the ground from the inside,” Holcomb said of IT and OT teams.
Few people in the field have done more to widen the door. Holcomb keeps it open.
Origins and calling
Where and when did you first become passionate about ‘safeguarding civilization’? What led you into OT/ICS security from IT cybersecurity?
I first got interested in computer security when my dad took our family to watch WarGames in the theater when I was 11. I still remember being completely fixated as David Lightman logs into his school’s network and changes his failing grade to a passing one. While I was always the ‘good kid’ and a straight-A student (until my last year of high school) and would never do anything like THAT, I was fascinated that it could happen in the first place. At the same time, he had a pretty girl watching him put his hacking skills to work, so that might have had something to do with it as well.
So I had been working in IT cybersecurity for over 15 years when news of Stuxnet came out, and I was totally fascinated once again, just like when I was watching WarGames. But now it wasn’t in a movie where hackers controlled equipment and systems; it was happening in real life. Learning that the malware physically broke down the centrifuges used for enriching uranium was all I needed to be more than interested.
Then, when I heard the attackers hid their activities from the operators in the control room for months on end, I was hooked. And then I started wondering how cybersecurity worked in a power plant. I didn’t even know whether power plants had computers. If there were, could they be hacked? If so, how could we protect them? That’s where my quest to answer those questions began, and I’m still learning every day.
You’ve secured some of the world’s largest industrial environments, including power plants, commuter rail, manufacturing, and refineries. Which experience shaped your view of OT security the most?
I was fortunate to start my OT/ICS cybersecurity journey while working for one of the world’s largest engineering and construction companies, where I worked with some of the greatest engineering minds to design, build, and protect some of the world’s largest environments.
The one problem I had with our projects, though, was that the average time from initial start to commissioning was 6 to 7 years, so while I got to see more than a few giant environments, I didn’t get to see many. So with my boss’s permission, I started doing some side consulting and quickly realized that while I worked with the top 1% of companies with significant budgets for OT/ICS cybersecurity in my day job, the reality was that the vast majority of OT environments had little to no budget for it. And at that time, most OT environments didn’t even realize cybersecurity was something they were supposed to do.
Once I made that realization, my focus shifted to how we can protect under-resourced environments, especially in critical infrastructure, even while I was protecting some of the world’s largest environments with every resource imaginable.
Who have been the strongest influences on your career? What would you do differently if you could start again?
I have been incredibly lucky to have several mentors throughout my life who have helped shape my career. My work ethic came from my dad, who was the nicest guy you would ever meet and worked hard to take care of his family. Later on, after working in IT and IT cybersecurity, I had a mentor named Lynn Buck, who was the one who pushed me to become an instructor at a technical training school where I started teaching the old Microsoft Certified System Engineer (MCSE) courses, along with some Cisco courses and a homemade penetration testing course I had written.
I also had an incredible manager, Dan Crowe, who taught me that you can’t tell the business no to doing something, because they’ll do it anyway. Instead, we need to help them understand the associated risk, then say, “Ok, let’s do this, but let’s do it as securely as possible.” Some of the other influences were people who didn’t set the best example, and I learned what not to do.
As far as what I would do differently, I wouldn’t change a thing at this point. If I did, I wouldn’t be where I am, and I wouldn’t change that for anything. I get to work with clients, going into their environments to help them become stronger tomorrow than they are today, and I’ve had incredible opportunities come up over the last few years because of my content on YouTube and LinkedIn, including starting BSidesICS/OT and seeing it grow to have several events around the world this year and people who have reached out to tell me they have their first OT/ICS cybersecurity job because of my content. I wouldn’t want to take any of that away by changing anything.
Education and community building
You’ve released free course content, covering topics from getting started in ICS/OT to OSINT, pen testing, and ISA/IEC 62443. What made you decide to give so much away, and what has that taught you about the people trying to enter this field?
I started sharing content because I remembered how frustrated I was when trying to learn about OT/ICS cybersecurity back in 2010, and it felt impossible. And I never want someone to feel that frustrated when learning, especially when it comes to helping protect our families, friends, and neighbors. At the same time, I realized that most industrial organizations weren’t going to be sending their team members for training, mainly because of a lack of money.
A water operator in the middle of Kansas, a power plant operator in Ukraine, and a manufacturing plant in Nairobi absolutely need the awareness and education, but would more than likely not be able to pay for it.
The only way to get them the awareness and education is to make it free, make it practical, make it approachable, and share it on global platforms like YouTube and LinkedIn. I was happy if one person read a post or watched a video, and it’s crazy to see how popular it has become.
You founded BSidesICS/OT and BSides Greenville. What gap were you trying to fill, and how has the community changed since the first event?
I started BSides Greenville over ten years ago as a way to bring ‘more’ cybersecurity, both IT and OT, to the area I live in, Greenville, South Carolina, where we have a large number of businesses and manufacturers struggling with cybersecurity. After attending my first BSides Augusta and seeing how amazing it can be to bring the community together for a day of learning, sharing, and connecting, I tried to get people to go to BSides Augusta for the next couple of years. Only a few would come, so I decided to bring BSides to them and started BSides Greenville, which I led until forming BSidesICS/OT in 2024.
I started BSidesICS/OT after getting a second rejection from a popular OT/ICS cybersecurity conference. When that happened, I remembered that the original BSides started because the original founders got rejected from DEF CON, the largest hacker conference in the world. And then I realized that we didn’t have anything like BSides in the OT/ICS world. But why not?
So I reached out and got permission from Jack Daniel at BSides to try it out, checked with Rob Lee to see what he thought, and he was very much into it from the start and super supportive. He even took time from his family’s Disney World vacation to come give our first keynote in Tampa. Overall, at the events, we’re seeing the community grow and the gatekeepers in the field becoming drowned out.
You’ve made a video on getting hired in OT security without the ‘right’ certifications, and another on picking certifications for 2026. What do hiring managers actually look for, and what is the most common mistake newcomers make?
What hiring managers look for can vary from person to person, and hiring in OT cybersecurity can be very different from IT cybersecurity. In IT, you often need certifications just to get someone to look at your resume. That isn’t the case in OT.
For people transitioning into OT/ICS cybersecurity, whether from IT cybersecurity or engineering/automation roles, certifications can show knowledge and passion for the field, but they aren’t always necessary. But it depends on the person doing the hiring. It can also depend on specific client requirements. I had a client at one time that required those working on their site to have all of the ISA/IEC 62443 certifications, so I went and got them.
The most common mistakes newcomers make are thinking they can shortcut the time required to learn and gain hands-on experience for a role in OT/ICS cybersecurity. Such a role isn’t entry-level; it requires candidates to have a solid understanding of both the cybersecurity and engineering worlds, and it just isn’t something you can do overnight, especially as you work to gain hands-on experience to reinforce what you’re learning and make you a much better defender.
You say the only way to protect OT/ICS is together. After the Practitioner of the Year award, what does that community support mean to you?
The community support meant A LOT. Since so much of my educational efforts are done virtually on LinkedIn and YouTube, it’s hard for me at times to know how it resonates with folks. Even when someone tells me I helped them get a job or start a company, it often doesn’t register. That just isn’t something that ‘I do.’ But receiving the award directly from the community helped me understand that what I do is clicking with a lot of people who want to learn more about OT/ICS cybersecurity, whether they are operators, transitioners, or just someone wanting to learn what the heck OT and ICS are. And ultimately, it is helping our environments become more secure, which helps keep the services our families rely on every second of their lives online and available.
State of the industry
Dragos’s 2026 Year in Review found that organizations with comprehensive OT visibility detected and contained OT ransomware incidents in about 5 days, against an industry-wide average of 42 days. Yet fewer than 10% of OT networks have that level of visibility and monitoring. Why is progress so slow, and what is the minimum viable first step for an under-resourced operator?
At the end of the day, most environments aren’t performing network security monitoring because they simply can’t afford it. A water treatment system that supports 500 customers in the middle of nowhere simply does not have the resources it would take, especially the budget. And even if someone provided free software like Dragos does with their Community Defense Program, the owners and operators of these environments don’t have the people to install, configure, manage, and monitor such a platform over time.
For under-resourced operators and other environments of any size, I always suggest starting with what you have, which includes using AI to bolster your defense. If you don’t have a firewall between IT and OT yet, you need to get one and configure it appropriately.
Once that’s done, you can use AI to help review your firewall event logs for suspicious traffic or operational issues you need to know about. Even if it’s a $30 firewall from China you order off of Amazon, get something in place today and start monitoring it. 99.9% of what you find won’t be a cyberattack, but it could help you prevent future operational issues. And when you do have a cyberattack in the future, you’re better equipped to identify it and limit its impact.
After years of teaching fundamentals such as segmentation, asset inventory, and incident response planning, what should the industry stop doing, and what should it start doing right away?
Some environments still think, ‘this won’t happen to us,’ and they still aren’t taking OT/ICS cybersecurity seriously, which is another reason I post on LinkedIn and YouTube: to raise awareness so some might learn enough to change that. Hopefully, before they (and their customers) have to learn the hard way. I always focus on mastering the five B.A.S.I.C.s in any OT environment – Backup & Recovery, Asset Management, Secure Network Architecture, including Secure Remote Access, Incident Response Planning, and Continuous Vulnerability Management- my own variation of the SANS ICS Critical Controls that’s effective for operators of any size.
The point is to never stop improving, no matter your size, and as long as you’re even a little bit stronger tomorrow than you are today, you’re getting the job done. I’d love to see even bigger leaps in improvement, sure, and some of those do happen, but we have to remember that under-resourced operators can only do so much, and many are moving the needle with very limited resources, which they don’t get enough credit for.
You’ve said OT and IT are the same house. Where does IT/OT collaboration still break down in practice, and who should own the fix? Do you see this happening on the ground?
I always hear the term ‘IT side of the house’ and ‘OT side of the house,’ which drives me crazy, because we all ‘live’ in the same house and we have the same goals – keep someone from breaking in and burning it down to the ground from the inside. Unfortunately, many IT and OT teams can end up with an adversarial relationship, and it reminds me of a bad marriage or partnership where the two parties are constantly at each other’s throats, or they just aren’t talking to each other at all. And when we’re not working together, only the attackers win.
Unfortunately, I still see environments I go into to help where their teams are not working together, but I also see environments where they work really well together, and everything in between. Some environments where teams don’t work together need the equivalent of a relationship therapist to help them build a way to work together, or at least someone to help leadership build a culture of working together rather than letting them tear each other apart. If they aren’t going to work together for whatever reason, unfortunately, they’ll find out the hard way what the results of allowing such a culture to exist are.
Technical and emerging themes
You’ve spoken at SANS on using ChatGPT to write ICS/OT tools and on automating the SANS ICS Five Critical Controls for free. How is AI changing both attack and defense in OT, and where do you draw the line on its use in the control loop?
AI only amplifies our efforts, and that goes for both attackers and defenders. Unfortunately, attackers have been embracing and using AI for much longer than defenders have, which puts us on the losing side for now. I am seeing more and more environments starting to look at how to use AI to defend their environments, which is encouraging, but we need to see adoption pick up significantly, because it’s only picking up more and more on the attacker side.
As far as where we draw the line on using it in the control loop, I’d love to say we don’t, from a cybersecurity perspective. But from an owner-and-operator perspective, why would I want a plant completely controlled by AI?
I mentioned what Dan Crowe had taught me early on in my career. You can’t tell the business not to do something, because they’ll do it anyway. AI is coming fast, and it’s coming hard for our OT environments. So we have to accept the fact and work with the business to identify the associated risks, and work to ensure that any implementation is as secure as possible, with the main focus on ensuring safety.
Your GitHub includes a Modbus testing toolkit and a controller simulator modeled on the one targeted in the FrostyGoop attack. How important is hands-on, safe-to-break practice for building OT defenders, and how can employers provide it?
Anyone who wants to learn how to defend OT and ICS environments needs to understand how attacks work and how to protect against them. I remember when I was starting in IT cybersecurity, I’d talk about different attacks such as Remote Code Execution (RCE) and Local Privilege Escalation (LPE), and how to protect against them. And I did an ‘ok’ job defending against them. But once I learned how to launch those attacks, their impact, when they failed, and what it took to run them successfully, I became exponentially more effective at my job. And that’s even more true in the OT/ICS world.
Which is why I say that everyone in cybersecurity, whether you’re in IT or OT, needs to learn more about penetration testing through hands-on experience. Until you’ve successfully altered or shut down a physical process over the wire (in a test environment, of course), you might be doing an ‘ok’ job, but we need people who are much more effective than ‘just ok’ at protecting our environments.
You’ll also discuss food and agriculture at Industrial Cyber Days, a sector that rarely gets a seat at the table. Which critical infrastructure sectors do you think are most underserved, and why?
It seems that the industries with the least visibility to the general public, and even the OT/ICS cybersecurity community, are the most underserved. Unfortunately, it typically takes cybersecurity incidents to raise that visibility. We saw this with the recent attacks against 100+ water systems across the United States, which are getting a lot of attention now, even though we’ve been struggling to help them for years. And with the recent French grocery stores having their refrigeration units compromised, we’ve seen a huge surge in interest not only in stronger security for food and agriculture, but in other sectors as well.
But ultimately, we need the owners and operators of OT/ICS environments, no matter what type or sector, to take a few minutes each week to look around and see what is happening. And then ask, ‘Could this happen to us? If the answer is yes or maybe, they need to look into how to prevent it and take appropriate action, as resources permit. I firmly believe if we did this, we would be much more secure than we are today, and it’s why I built OT Threat Feed, so people can answer those questions for free in just a few minutes a day or week.
Personal and forward-looking
What are your top three tips for people entering industrial cybersecurity today?
For those just entering the field today, I always suggest a few things. First, take advantage of the free resources out there, especially on YouTube, LinkedIn, and Reddit. You can learn so much not only by watching different content, but by reading the comments and learning from those who work in the field. We each only have visibility into our part of the world, so it’s an amazing opportunity to learn from others in environments we haven’t been exposed to yet. Second, reach out to operators in your local area to start making connections, ask for tours of their environments, and build relationships that could lead to opportunities down the road, like jobs. And finally, remember that learning OT/ICS cybersecurity is challenging and definitely a marathon, not a sprint. In IT cybersecurity, you have to learn A LOT.
In engineering and automation, you have to learn A LOT. If you want to work in OT/ICS cybersecurity, you need to learn both worlds, and that takes time, so remember that and don’t be too hard on yourself when you feel like you’re not as far as you think you should be. I have to remind myself of that pretty much every day.
What scares you most, and excites you most, about where OT security is heading?
What concerns me most is that the growing number of attackers we see are far ahead of most defenders, and we’re seeing that play out not only in the increasing number of attacks, but also in the growing impact. What used to be one water treatment plant or grocery store being impacted now results in hundreds of sites being impacted at a time. Add on top of that, when we add AI into the mix from an offensive standpoint, we’re pouring jet fuel on the fire that threatens to burn it all down.
I am excited to see how far the community has come over the last few years, how OT environments of all sizes have improved their defenses, moving the needle, even a little, which can be enough to prevent many of the attacks we’re seeing today. And we are seeing some environments start using AI to help defend their environments, even under-resourced operators doing the best with what they have, so there are a lot of positives that are encouraging to see. But we definitely need to see more progress, or there is going to be pain of all types in the near future for us all, no matter where we might live in the world.
What are you most proud of so far, and what’s next for UtilSec and your education work?
When I stop and think about how far BSidesICS/OT has come in a short amount of time, bringing the community together, not just in the US each year, but seeing versions now in the UK, Australia, and Paris (with more to come), it’s pretty humbling to be able to extend the incredible work started by the original BSides team into the OT/ICS world. And, I mentioned it before, but when just one person tells me that I helped them get their first OT cybersecurity job, I do get a certain sense of excitement that I can feel, though it only typically lasts a few seconds, because we can’t stop there. There are many more folks in both the OT and IT worlds out there that we need to embrace and help teach how to secure critical infrastructure and other OT/ICS environments.
The post Hall of Fame – Industrial cybersecurity practitioner and community builder Mike Holcomb appeared first on Industrial Cyber.
