Ransomware, Remote Access, and the OT Reality Check

In this episode of Data Security Decoded, Cybersecurity veteran Dawn Cappelli joins host Caleb Tolin to unpack the rapidly evolving threat landscape facing operational technology environments. With decades of experience spanning CERT, Rockwell Automation, and now Dragos, Dawn breaks down how geopolitical conflicts, empowered hacktivists, and ransomware are reshaping OT risk. She shares the five critical ICS controls every organization should prioritize and discusses why community-driven defense models are now essential for resilience. A must-listen for leaders responsible for critical infrastructure, manufacturing, and industrial cybersecurity. What you'll learn: How global conflicts have dissolved previous norms that protected critical infrastructure from cyber retaliation. Why hacktivist groups are becoming more dangerous — and how state actors quietly support them. The five highest-impact ICS security controls and where most organizations fail. Why OT environments remain decades behind IT security — and what leaders must immediately address. How ransomware operators target manufacturing and critical infrastructure for maximum leverage. The risks of insecure remote access and unmanaged third-party connections. How OT-CERT and community defense can uplift organizations with limited resources. Episode Highlights: 00:00 – Opening + Guest Introduction Caleb introduces Dawn and frames her decades of OT and insider threat leadership. 02:00 – Dawn’s Early Journey into OT and Security How nuclear engineering, the CDC bioterrorism portal, and 9/11 sparked her cybersecurity mission. 05:00 – Founding the CERT Insider Threat Center Inside the origin story and its impact on insider risk theory. 07:00 – Moving to Rockwell: The Hidden OT Backdoor Risk Why insider sabotage in OT environments was a turning point in her career. 08:00 – The Geopolitical Shift in OT Threats How Russia–Ukraine changed everything about attacking critical infrastructure. 10:00 – The Rise of State-Aligned Hacktivists Why groups like Cyber Avengers now have real disruption capability. 13:00 – The SANS Five ICS Controls Dawn breaks down the controls that prevent and detect most attacks. 17:00 – Ransomware Trends in OT Why manufacturing is a prime target and how attacks are evolving. 19:00 – The Promise and Peril of Agentic AI in OT Why autonomous agents could cause catastrophic outcomes. 21:00 – OT-CERT: Free Global Resources How Dragos is empowering organizations worldwide with practical support. Episode Resources: Information on OT-CERT: OT-CERT Register for OT-CERT: Register for Dragos OT-CERT | Dragos Information on Community Defense Program: Community Defense Program | Dragos Register for Community Defense Program: Register for Dragos Community Defense Program | Dragos SANS Five ICS Cybersecurity Critical Controls: The Five ICS Cybersecurity Critical Controls