CCE isn’t a product. INL runs it as a facilitated engineering exercise, and it needs people who can argue about process hazards as comfortably as about IEC 62443 zones. Buyers who treat it as another sensor overlay will rebuild the visibility pile with better vocabulary.
The informed counterargument deserves a fair hearing, because as a prerequisite it’s right. Fortinet’s own commentary on its 2026 report says that without a clear picture of assets, flows, users and dependencies, you can’t segment networks, spot abnormal traffic or set response priorities. You can’t run a CCE study on a box nobody can identify.
First, the binding constraint is rarely a missing IDS signature. It’s whether some control still works when authentication, the historian and the remote-access path are all untrustworthy. A pump protected by a properly sized mechanical relief, or a breaker scheme that needs a local permit, offers a different class of protection than a better SPAN port. The right safeguard depends on the process and how it fails, which is why engineers have to be in the room.
Plants Can See More and Still Lose the Process
At the other edge are approaches that don’t depend on catching anyone. Waterfall Security’s unidirectional gateways make a whole class of IT-to-OT intrusion physically awkward. INL isn’t a vendor at all, which is the point; CCE is a method you practice, not something you install. Neither replaces a SOC. Both limit consequences through design instead of detection.
Claroty, Nozomi Networks and Armis compete largely on breadth: more device classes, more protocol decoding, a bigger inventory for teams that still can’t name everything on the plant floor. That has been the dominant logic for five years, and it matches where SANS says the next two years of money is going. Dragos is narrower, focused on ICS threat groups and detections aimed at disruption. Seeing suspicious traffic and understanding how an attacker could halt a process are related skills, but they aren’t the same skill.
At the end of July, the physical cost showed up in drinking water. On July 30, the FBI and EPA warned that attackers were going after internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs at water and wastewater utilities. Utilities in at least seven states had reported incidents since July 27. The method was crude. Reach the controller over the internet, change its IP address and password, and lock operators out of their own monitoring and control. Reported effects included loss of pressure and flooding.
Consequence management starts from the process instead of the packet. Which unsafe states are credible? Which cyber paths could produce them? Which engineering or operational controls still work when the SOC is late, wrong or blind? Idaho National Laboratory’s Consequence-driven Cyber-informed Engineering (CCE) begins by assuming a skilled, determined adversary will get into the network, then asks what has to be engineered so the worst outcomes still can’t happen. The Department of Energy’s broader Cyber-Informed Engineering (CIE) guidance pushes the same thinking earlier, into design, using engineering controls to remove attack paths or shrink their consequences.
Fortinet sells the unified IT/OT fabric and publishes the survey many CISOs now quote. Its bet is that policy and telemetry belong on one platform. That can work, as long as it’s paired with controls aimed at unsafe command paths and not only at traffic.
Visibility Inventories Devices. Consequence Management Bounds Outcomes
Second, most OT incidents still start where IT lives. SANS found that unauthorized external access was behind half of reported ICS/OT incidents, with ransomware close behind. That’s how a plant can have rich Level 2–3 visibility and still be surprised at Level 1. Monitoring traffic can’t make up for a controller sitting behind an unsafe access path.
Full visibility into operational technology is still rare. Where it exists, it doesn’t decide whether a plant stays in a safe state. In Fortinet’s 2026 State of Operational Technology and Cybersecurity Report, a vendor survey of more than 700 OT professionals, the share of respondents claiming full visibility into their OT systems rose from 5% in 2025 to 14% in 2026. That’s real progress on the map. It says nothing about what the mapped devices can do to pressure, flow or safety once an attacker has a foothold.
The water attacks show how wide that path can be. CISA’s warning the same day pointed to cellular modems installed by operators, vendors or integrators that may never show up in documentation or routine attack-surface scans. The FBI also noted that when an integrator reuses the same network setup across customers, attackers can repeat a success wherever that configuration recurs. An inventory that misses an integrator’s modem has a hole exactly where the attacker walked in. And even a perfect inventory wouldn’t have taken a controller off the internet or put a hand-operated valve next to it.
None of those controllers was a mystery to its owner. What decided the damage was something else, and the advisory spelled it out: impact depended on whether the PLC monitored or controlled equipment, which model it was, what function it supported, and whether staff could switch to manual operations.
Boards have noticed OT. In the same Fortinet survey, 81% of respondents whose OT security doesn’t already sit under the CISO said they plan to move it there within 12 months. Money has followed the obvious gap. SANS found that asset visibility, threat detection and secure remote access dominated both 2025 deployments and planned 2026–2027 spending.
The work that matters now is consequence management: ranking the physical outcomes an attacker could force, then engineering the plant so those outcomes can’t complete even after the network is lost.
Work Backward From the Unsafe State
Where that argument overreaches is the implication that more complete telemetry is the main gap left. Organizations are still putting 2026–2027 money into visibility while recovery lags detection. After years of that spending, only a small minority call their OT view complete. And the water attacks didn’t exploit anything unseen. They used controllers that were known, reachable and able to change the process. That’s a failure of exposure management, access control and manual fallback. Inventory wasn’t the missing piece.
If visibility really were the remaining bottleneck, the next 12 months should show plants with mature inventories pulling ahead on disruption and recovery, not just on time to detect. The current SANS data points the other way: detection is improving while recovery lags. If that reverses in production, this argument gets weaker.
OT visibility means discovering industrial assets, their firmware and protocols, and the conversations between them, usually through passive taps or collectors that avoid disturbing a running process. It tells you what’s on the wire and who talks to whom.
Nor is this IT disaster recovery in a hard hat. Restoring a historian or a Windows jump box is an IT job with OT inconvenience. Restoring a process that was pushed outside its safe operating envelope is an engineering job, and the clock is set by the physics of the plant.
Seeing every PLC doesn’t stop an unsafe process state. OT programs should fund consequence management next.
Visibility programs grow until every protocol decoder looks mandatory. Consequence programs shrink the backlog. A serious answer explains how each vulnerability or architecture change gets scored against the event list, including an explicit “not now” category when the blast radius is small. Test that against the last maintenance window. If everything was still rated critical, the ranking is theater.
Three Questions Before the Next OT Platform
Which process states stay unsafe if every alert is late?
Two things should change how a CISO thinks about the technology.
Who can put the process in a safe state without the corporate identity stack?
If the only shutdown path runs through a jump box, a cloud broker or a VPN account, you have IT continuity, not OT consequence control. You want out-of-band procedures, local HMI permissions, and mechanical or electrical limits that don’t depend on Active Directory. Ask for the tabletop that begins after those paths are assumed lost. This summer’s FBI advisory named the ability to switch to manual operations as one of the factors that set how bad each incident got.
How do you turn down work that doesn’t touch a high-consequence path?
The speculative version of this shift is a single pane that ranks every tag by blast radius and auto-tickets the right engineer. Nobody is running that in a plant today. What plants actually have is far more telemetry than five years ago, a small minority who’d call their OT view complete, and attackers who don’t need a complete view. This summer, all they needed was a login on a controller left facing the internet.
| Approach | What it covers | Where it stops | Typical owner |
|---|---|---|---|
| Passive asset visibility | Device, protocol and flow inventory (e.g., Claroty, Nozomi Networks, Armis) | Doesn’t block an unsafe command or remove exposure | OT security / CISO |
| ICS threat detection | Protocol anomalies and known threat-group behavior (e.g., Dragos) | Alert quality, not process physics | SOC with OT analysts |
| Exposure and remote-access control | Taking devices off the internet; gating vendor and integrator access | Only covers the paths you know about | Network / OT security |
| Network isolation | Unidirectional gateways and tightly gated IT/OT links (e.g., Waterfall Security) | Doesn’t help a device exposed through some other path | Network / plant engineering |
| Consequence-driven engineering | High-consequence events and engineered safeguards (INL CCE, DOE CIE) | Needs process experts and plant time, not a sensor | Engineering with security |
| Unified IT/OT platform | Shared policy, access and telemetry (e.g., Fortinet) | Can end up treating OT as another VLAN | CISO / network security |
Who Is Selling the Shift, and Who Is Still Selling Maps
Three signals are worth watching:
A good answer is a short list of high-consequence events in plant language, such as overpressure, loss of disinfection or an unintended breaker trip. A heat map of CVE scores is not an answer. OT risk doesn’t scale with device count: one internet-facing controller on a critical loop can matter more than a hundred well-monitored historians, because only one of them can open a valve. Check whether operations and process safety helped write the list, and whether each item has a control that still works when the OT SOC is dark.
That last factor is the argument of this piece, written into a federal advisory. Visibility programs are still funded as if inventory were a control. Knowing a controller exists doesn’t limit what an attacker can make it do.
Consequence management reverses the usual workflow. Instead of cataloguing every controller and then trying to rank thousands of CVEs, you name a short list of events the business can’t tolerate: loss of view, loss of control, unsafe energy release, contaminated product, an environmental spill. Then you trace the cyber-physical path to each one and spend first on breaks in that path that don’t depend on a perfect alert.
What Would Prove This Wrong
The two get blurred because they share a budget line and both produce diagrams. They are different deliverables. A visibility tool can tell you a lift-station PLC exists, what firmware it runs, and that it speaks an old protocol with little or no authentication. Consequence work asks whether anyone could drive that PLC into a state that floods the wet well, and whether a local interlock, a float switch or a practiced manual procedure would stop it without a SIEM rule ever firing.
Expect the lines to keep blurring as visibility vendors add risk scoring and firewall vendors add protocol decoders. Bundling threat data and engineering guidance into one offering doesn’t make either one a substitute for the other.
- Whether 2026–2027 budgets actually shift from collectors to process-hazard work, or “consequence” becomes a slide title on the same asset platform.
- Whether water, energy and manufacturing incidents keep featuring internet-reachable controllers that nobody had trouble finding.
- Whether CCE and CIE show up in ordinary capital projects, like new treatment trains and substations, instead of a workshop held after the design is frozen.
Incidents haven’t waited for those programs to finish. In the SANS 2025 State of ICS/OT Security Survey, 22% of organizations reported at least one cybersecurity incident in their ICS/OT environment in the past year, and 40% of those incidents disrupted operations. Detection is getting better; nearly half of incidents were caught within a day. Remediation still stretched into days or weeks, and nearly one in five took more than a month. Vendors like to talk about detection. Plants live with recovery.
