The Career
I grew up around critical infrastructure before we called it that. My dad was a controls engineer for 40+ years, so power plants, substations, and control rooms were just part of the landscape. I got into technology early, building a coax network through cinder block walls in college and messing around with a Tandy TRS-80 and Apple IIe as a kid.
Over 30 years I've worked across both IT and OT, from large enterprises to critical infrastructure operators, consulting, and product companies. I started in IT, then found my way into the OT world when I joined a Texas utility supporting 40+ power plants across the state: fossil gas, coal, renewable, and nuclear. That's where everything clicked. Since then I've held roles across consulting, utilities, and cybersecurity product companies, including helping build the OT cyber practice at a Big Four firm, always focused on the intersection of IT and OT and the real-world challenges of securing critical infrastructure. Today I'm Head of OT Cyber at Arcova, building that practice and bringing the practitioner's perspective to everything we do.
The podcast started while I was CTO at Industrial Defender and rebranded from "PrOTect OT Cybersecurity Podcast" to "PrOTect IT All" because I've always believed OT security cannot be understood in isolation from IT. The whole picture matters.
The Family
Married to Kary Crow since 2008. She's the one who keeps everything running when I'm on the road for conferences, assessments, or recording sessions. We have three kids: Charlie, Sydney, and Tyler. They've heard more about firewalls and network segmentation at the dinner table than any kids probably should, but that's the deal when your dad can't stop talking about protecting the things that matter.
Born and Raised in Texas
I'm a native Texan and proud of it. Born and raised here, and this is home. Texas is a big state. If you haven't been here or seen it on a map, some of those power plants I supported were six hours from headquarters. You learn a lot about yourself on those long drives through the middle of nowhere.
Conferences like RSA, DEFCON, and ICS Village events in Las Vegas and Singapore have taken me to some incredible places. But at the end of the day, Texas is where the boots come off.
Rucking
If you don't know what rucking is, it's simple: you load up a backpack with weight and walk. That's it. No gym membership, no fancy equipment, just a good ruck and the road.
I ruck approximately 3 miles a day carrying as much as 65 pounds. It's not about going fast. It's about putting in the work, building mental toughness, and getting outside. I've also become a collector of GoRuck rucks. If you know, you know. Some people run. I ruck.
Outside the Screen
When I'm not talking cybersecurity or hauling weight on my back, you'll find me working on cars, out at the range, hiking, hunting, fishing, or just being outside. I'm a technology guy by trade, but I recharge in the outdoors.
I also train jiu-jitsu, though not as often as I'd like. There's something humbling about stepping on the mat and getting submitted by someone half your size. The kids train too, and watching them grow through it has been one of the best parts.
Lone Star Cyber Shootout
Events I host that bring together CISOs, security leaders, and sponsors for real conversations in a setting that's anything but a typical conference. The best relationships in this industry aren't built in a conference hall. They're built over shared experiences.
No sales pitches. No scripted panels. Just real people having real conversations about the things that matter.
Core Philosophy
- OT depends on ITSiloed OT-only thinking is insufficient. The industry needs a big-picture, end-to-end perspective.
- Fundamentals over hypeThe SANS Five ICS Critical Controls are the recurring defensive framework. Basic hygiene prevents most attacks.
- Compliance is not securityCompliance is a baseline and budget justification tool, not comprehensive protection. "99.999% compliant is not actually compliant."
- OT is different, not harderA core framing principle for positioning OT security to both technical and business audiences.
- All business is a people businessIT/OT team trust is an incident response asset. We do business at the speed of trust.