Jori VanAntwerp

Geek, Gearhead, & Founder

[Ember_OT @Ember_OT]

CIP-015 compliance doesn't have to start with a 40-site rollout.

In @Ember_OT's latest article, @CSecDaemon shares a realistic 90-day path for utilities that need INSM, real visibility, and budget discipline.

https://t.co/XaNG7zIxTU

#OTsecurity #CIP015 #ICSsecurity

[Ember_OT @Ember_OT]

The future OT analyst needs more than cyber fundamentals.

They need OT/ICS depth, protocol fluency, & enough AI literacy to challenge model output instead of trusting it blindly.

New article by @CSecDaemon on why the cross-disciplinary OT analyst wins:
https://t.co/bzKPbvXOig

[Jori VanAntwerp @CSecDaemon]

Foundations first. AI second. The order matters more than people realize.
Without the craft, AI is a confidence amplifier with no validation layer underneath. With the craft, it's a real multiplier.
Full article here: https://t.co/mC25NaSz9b
#cybersecurity #AI

[Jori VanAntwerp @CSecDaemon]

The most dangerous AI take in cybersecurity right now isn't "AI will replace us."
It's "AI will up-skill us."
A thread on what most leaders are missing about AI in cyber.

[Jori VanAntwerp @CSecDaemon]

The pitch: AI will up-skill your team. Juniors will operate like seniors.
The reality: AI gives juniors access to senior-shaped output. Not the same thing.
The senior can interrogate the output. The junior often can't yet.

[Jori VanAntwerp @CSecDaemon]

CIP-015 is not a loot drop.
A matrix full of green checkmarks won’t help if you’re still blind at Levels 1 and 2.
The real question: if an attacker were already inside your ESP, would you know?
I wrote about the compliance trap here:https://t.co/O00xn5iBQ8

[Ember_OT @Ember_OT]

CIP-015 is not a loot drop.

Checking every R1 through R3 box does not guarantee real detection. You can be compliant on paper and still stay blind where it counts.

@CSecDaemon on alert floods, tool mismatch, and visibility gaps at Levels 1 and 2:
https://t.co/aoAYWQsJ0t

[Ember_OT @Ember_OT]

When remote OT environments span hundreds (or thousands) of miles, teams need usable data they can act on. Better visibility helps operators reduce blind spots, improve detection, & support safer, more reliable operations.

New article from @CSecDaemon
https://t.co/YlDTnHQ7Fn

[Ember_OT @Ember_OT]

New #OT Vuln Intel Report w/@AdvisoryIcs
. 2,203 High/Critical vulns tracked 2024-2025. 29 (1.32%) confirmed weaponized via CISA KEV. Five-lens prioritization method: exploit evidence, reachability, asset criticality, operational impact, patch feasibility.
https://t.co/91beddvZNO

[Jori VanAntwerp @CSecDaemon]

#BSidesICS & #S4x26 week felt like the right time to share this...

I wrote a bit of a manifesto about how I think OT security should be practiced, focusing on one idea:

“No Noise. Just Signal.”

Clear thinking. Respect for operations. Awareness of real-world impact.🤘🔥

[Ember_OT @Ember_OT]

As #BSidesICS & #S4x26 kick off, our founder @CSecDaemon has written an article (a manifesto of sorts) that captures how @Ember_OT approaches #OTsecurity.

“No Noise. Just Signal.”

Clarity. Discipline. Respect for operations.

https://t.co/nI3TTVWH0h

#ICSsecurity #SCADAsecurity

[Ember_OT @Ember_OT]

IT lets you move fast.

OT requires you to move carefully.

Vendor contracts, validation cycles, legacy PLCs, and operators who know every edge case. Security changes can affect real-world processes.

Part 2 of our OT Curious series:
https://t.co/Lvqr54EEgW

[Ember_OT @Ember_OT]

More IT defenders are becoming “OT curious,” but #OTsecurity isn't just IT with different gear.

OT systems run for decades, control physical processes, and come with very different constraints and consequences.

https://t.co/wiU16jfdjf

[Ember_OT @Ember_OT]

Join us for an exclusive #S4x26 evening social with #cybersecurity & tech leaders. Connect w/ peers, continue conference convos, & unwind in a relaxed setting.
🗓️ Tues, Feb 24 | 8:00–11:00 PM
📍 Preston’s Terrace and Dining Room, Loews Miami Beach

RSVP at https://t.co/8z58hN2byd

[Ember_OT @Ember_OT]

EmberOT announces new partnerships w/ @e2eassure & @PhoenixContact to expand OT visibility, managed detection, and industrial security at scale.

"Together, we are enabling defenders & operators to secure critical systems more effectively."
~@CSecDaemon

https://t.co/xQPBXSr8sM

[Ember_OT @Ember_OT]

If you work in OT, you already know this truth: humor is a coping mechanism.

Asset inventories, Patch Tuesdays, legacy systems that can't be touched, these 17 #OTcybersecurity memes are painfully accurate.

https://t.co/tgeBMbZjlj

h/t @_mikeholcomb_ for creating many of these!

[Ember_OT @Ember_OT]

#OpenSource tools in #OT can be powerful, but only if they're selected & deployed w/ discipline.

In this piece, @CSecDaemon shares realistic tips to choose tools that respect operational risk, legacy systems, & real-world constraints in ICS environments.

https://t.co/pXjhEOCF7q

[Ember_OT @Ember_OT]

#OT #cybersecurity strength is built through consistent habits that respect uptime & safety.

@CSecDaemon shares helpful #OTsecurity tips with a workout mindset: asset visibility, access control, patching & monitoring that actually fit real operations. 💪

https://t.co/iZiv3BrvOR

[Ember_OT @Ember_OT]

Quantum is often discussed as a future risk to #OTsecurity. There's also a defender advantage taking shape.

Dr. Rishabh Das shares how #QuantumTech can strengthen encryption, integrity, timing, & anomaly detection in OT environments w/out disrupting ops.

https://t.co/L4tyf05MC8

[Ember_OT @Ember_OT]

Choosing the right OT tools shouldn’t be guesswork.
In his latest article, @CSecDaemon shares a practical guide to some of the tools operators and defenders actually use to understand their environments and strengthen security.

https://t.co/9njHeNurGE

#OTsecurity #ICSsecurity

[Ember_OT @Ember_OT]

"Every CIP standard exists because somewhere, sometime, something bad happened."

@aaronccrow gets into the nitty-gritty details in part 2 of the "What to Expect When You're Expecting... a NERC CIP Audit" blog series.

https://t.co/4ap8hYXnoq

#OTsecurity #ICSsecurity #NERCCIP