The OT Forum is Renaissance’s virtual event series for organisations operating critical national infrastructure and operational technology environments across the island of Ireland. Each session brings together security leaders, OT engineers, and technology specialists to address a single topic shaping the security of industrial control systems, cyber-physical systems, and converged IT/OT environments.

Our OT Forum series with ColorTokens follows a single thread across two connected sessions: building operational resilience in OT environments. The first session addressed the regulatory and commercial pressure driving that requirement. The second addresses the emerging threat that is making it urgent.

Who should watch

These sessions are for CISOs, IT directors, OT managers, and security leads in organisations operating critical national infrastructure, industrial control systems, or converged IT/OT environments. They are also relevant for CEOs, board members, and heads of risk and compliance responsible for overseeing cybersecurity risk and resilience under NIS2.

SESSION 1 – THE REGULATION

NIS2: The OT Problem Nobody Is Solving | Watch OnDemand

The real NIS2 challenge isn’t compliance. It’s whether your operations can survive a breach.

Most NIS2 conversations focus on compliance checklists, security controls, and audit readiness. This session asks a different question: when your organisation is breached, can your leadership demonstrate that operations kept running?

NIS2 places greater responsibility on CEOs and governing bodies to oversee cybersecurity risk and resilience. Across Europe, national implementations are strengthening accountability, making “I wasn’t aware” an increasingly difficult defence.

For organisations running operational technology, this creates a specific challenge. OT environments were designed for uptime, with flat architectures, long-lived devices, and limited capacity for the segmentation and containment that keeps a breach from spreading. If an attacker reaches the OT network, the question the board will face is whether operations continued or whether they had to shut down.

In the session, we walked through what breach readiness looks like in an OT environment, and how to move from a shutdown-and-recover posture to one where operations continue through an incident.

The session covered:

• What NIS2 accountability means for your organisation and its senior leadership
• The questions your board should be asking about OT resilience
• Where traditional OT security approaches fall short during a breach
• What an “operate-through” breach strategy looks like in practice, with containment enforced at the workload and device level

SESSION 2 – THE THREAT

When AI Finds the Gaps in Your OT Network | Tuesday 24th November, 11am

Building resilience against AI-accelerated attacks in OT and critical infrastructure environments.

OT networks were built for uptime, with flat architectures and devices that run for decades without patching. Now that they are connected to the wider enterprise, AI-driven attacks can turn small gaps into major operational incidents faster than traditional response processes can handle.

You will leave this session knowing:

• How AI changes the speed and scale of attacks against OT environments
• Which industry recommendations from the CSA and Gartner matter most for industrial networks
• Where attackers are most likely to exploit flat OT architectures
• The practical controls that can contain an attack before operations are affected, including devices that cannot run an agent

Join us as we map this guidance to practical, deployable controls for OT and industrial environments. Secure your place here.

How the Two Sessions Connect

These two sessions follow a single thread.

October – The Accountability

What does NIS2 require of your organisation when operations cannot afford to stop?

We addressed the regulatory and commercial pressure: NIS2 is increasing accountability for cybersecurity resilience at senior leadership level, while organisations and their supply chains are placing greater emphasis on the ability to maintain operational continuity during a cyber incident.

November – The Threat

How does AI change the speed and scale of attacks against OT?

We address the emerging threat that is making resilience increasingly urgent: AI-driven and increasingly automated attack techniques can accelerate reconnaissance, vulnerability discovery and lateral movement, creating risks that traditional response processes may struggle to contain quickly enough.

The Response

Contain the breach. Limit lateral movement. Keep operations running.

The answer in both cases is the same. Prevention alone is not enough. Organisations operating critical infrastructure and industrial environments need to contain breaches at the point of entry and keep operations running through an incident. That requires segmentation granular enough to isolate compromised areas without shutting down production, enforced across every device in the OT environment, including those that cannot run an agent.