IT Is Down. The Plant Is Still Running. Do You Shut It Off?

A Tabletop Tuesday demo: the OT tabletop, with IT, operations, and leadership in one scenario

OT Track: Technical + Executive IT, OT and Controls, Operations, Safety, Leadership Live Session: Half Day

Scenario: ransomware tears through corporate IT at 3 a.m. on a Sunday. The control room sees nothing. Work the first two injects as the response team, then vote with the leadership table on the decision that defines every OT incident.

Start the Exercise Why OT Is Different

Inject 1 of 2 Technical track T+00:00 | Sun 03:12

Decision clock15:00

Inject 1 | Detection

Ransomware is moving through corporate IT. The control room has no idea.

[03:12:44] ALERT EDR / corporate IT Hosts: FS-CORP-02, FS-CORP-04, ERP-APP-01 (+34) Detection: mass file rename (*.lockd), shadow copies deleted Parent: PsExec as svc-backup (domain admin) Spread: 37 IT hosts in 11 minutes [03:14:10] FIREWALL IT/OT DMZ ALLOW ERP-APP-01 -> HIST-DMZ-01 tcp/1433 (scheduled pull) ALLOW JUMP-VENDOR-01 -> OT-EWS-01 tcp/3389 (session open 6 days) OT alarms: none | Process: normal

A domain admin account is pushing ransomware across IT. OT shows no alarms and the process is running normally. But the IT/OT DMZ is still passing traffic, and a vendor jump host has an RDP session into the engineering workstation that has been open for six days. The night shift operator has not been told anything.

Facilitator note: This inject tests whether the team knows where the IT/OT boundary actually is, and whether anyone has pre-approved authority to cut it at 3 a.m. The clock starts now.

Your call, first 15 minutes

What does the on-call team do right now?

Cut the IT/OT conduits at the DMZ firewall and tell the control room they are on isolated operation Shut the process down now, before the ransomware can reach OT Keep the DMZ open, because the historian feed and production reporting depend on it Kill the vendor jump host session and preserve the jump host and historian for forensics

What strong teams doCut the conduits and call the control room. Isolation protects the process without stopping it, which is exactly what a pre-planned isolation procedure is for. Kill the six-day vendor session and preserve the DMZ hosts before anyone rebuilds them. Shutting down the process is not a call the on-call IT analyst makes at 3 a.m. It belongs to operations, with safety in the room. If nobody can cut the boundary without holding a meeting first, that is your first finding.

Inject 2 | Escalation

The ransomware loader has been on the engineering workstation for six days.

[05:41] OT-EWS-01 (engineering workstation) AV: Trojan.Loader.Gen quarantined File: C:\Users\vendor_svc\AppData\Local\Temp\upd64.exe Hash: matches the IT ransomware loader First seen: 6 days ago | Logon: vendor_svc via JUMP-VENDOR-01 [05:52] Controls engineer "Project files on the EWS were last modified 9 days ago. I can't confirm the controller logic matches them. The offline backup is on a USB drive in the plant manager's desk. I think." [06:00] Control room "Running on local control. HMIs normal. Operators logging readings by hand. Safety system is independent and healthy."

The attacker reached the one machine that can change controller logic, through the vendor's remote access path. Nothing in the process is misbehaving. But "nothing is misbehaving" is not the same as "OT is clean," and operations wants to know whether the process can be trusted.

Facilitator note: This is where IT and OT usually disagree. IT wants to reimage everything. Controls engineering knows a reimaged HMI may not come back without the integrator. Watch who owns the answer to "can we trust the process."

Your call, next 15 minutes

What happens to the workstation, and what do you tell operations?

Pull the engineering workstation off the network, image it, and verify controller logic against a known-good baseline Reimage every HMI and workstation in OT now, to be safe Disable all vendor remote access until each path is reviewed and re-approved Tell operations OT is clean, because the process is running normally

What strong teams doIsolate and image the workstation, then verify controller logic and firmware against a known-good baseline from a laptop that has never touched the IT network. Disable every vendor remote path. Do not reimage OT blindly: it destroys evidence and can take down hosts only the integrator can rebuild. Give operations a precise statement of what is verified, what is not, and when it will be. The missing offline baseline is the finding the room remembers.

Why OT Incidents Need Their Own Tabletop

A standard IT tabletop asks how fast you can contain and recover. In an OT incident, the fastest containment move can be the most expensive business decision you make all year.

The process comes first

Safety and physical operations outrank evidence, speed, and convenience. Responders who are used to IT need to know what they are not allowed to touch.

Shutdown is a business decision

Stopping operations costs revenue, customers, and sometimes public trust. It needs a named owner and written criteria, not an analyst at 3 a.m.

Your vendors are inside the fence

Integrators and OEMs hold remote access paths that often nobody inventories. In many OT incidents, that path is how the attacker got in.

IT pain is not OT risk

When ERP, scheduling, and billing go down, the pressure to stop the plant is real. The room has to separate "we cannot run the business" from "we cannot trust the process."

One Scenario, Every Seat at the Table

The OT tabletop joins our two formats into one session. The technical team works the injects, then hands leadership the update they would actually receive. Plant leadership and safety vote alongside the executives.

OT Tabletop

IT, OT and controls engineering, operations, EHS, executives

Technical injects with a decision clock, then executive decision points with a room vote
Tests the IT/OT boundary, vendor access, and the keep-running decision
Plan updated live, with owners and dates

Technical Tabletop

SOC, IT ops, security engineering, platform teams

Injects are alerts, logs, and tool output
90 minutes, 5 to 7 injects, 15-minute decision clock

Run the technical demo

Executive Tabletop

CEO, CFO, General Counsel, board or audit committee

Updates from the technical team and a room vote at each decision point
60 to 75 minutes, 3 to 4 decision points

Run the executive demo

Run This With Your Plant and Leadership Team

We build the scenario around your process, your vendors, and your network boundaries. We facilitate, your team decides, and you leave with a findings memo and a plan that has already been changed.

Book an OT Tabletop Incident Response Services