AI Isn’t the Answer: Why Cybersecurity Fundamentals Still Decide OT and IT Success

Aaron Crow (0:1.294): Hey everyone, thank you for joining me on another episode of the Protect It All podcast. This is the end of 2025, kind of end of year wrap up. Wanted to kind of dive in and talk through all that we've seen in the last year and kind of what I see coming up over the horizon. So many times you see in the advertisements

Aaron Crow (0:28.350): speeches at conferences, et cetera. Everybody's talking about AI, AI. Almost every episode, somebody's talking about AI, the impacts of it, the benefits, the scare, you know, the, fears of it, all of that. But we're talking like AI is going to save us. We many times, pundits or whomever is talking about AI and all the amazing things that could do. And absolutely can.

Aaron Crow (0:57.288): And also most OT environments still don't have, you know, they don't know what they don't know. They don't have basic asset inventory. They don't do the basic fundamental things for cybersecurity in those spaces. They don't know what's connected. They don't know what's on their networks. They don't know how everything's connected and interconnected and what the dependencies are, what the most important assets are, right?

Aaron Crow (1:24.544): It's not that I'm anti AI. It's not that I'm anti tools. It's not that I'm anti any of those things because I absolutely believe that AI can help even in those places where they don't have advanced, you know, more mature is probably better way to say it more mature programs or capabilities in the spaces. AI can absolutely help. But we I don't think we should look at AI to be this savior.

Aaron Crow (1:53.430): right, to solve all of the problems. It can absolutely help just like any tool can, but you're gonna have to do a lot of the heavy lifting. AI can't replace fundamentals. You know, it's just like anything. If you put in a bad prompt, if you put in, you know, very generic things into AI, you're not gonna like the output that you get, right? So if you don't understand where you're at, then how can you expect AI to help, right? So what changed this year? AI flood.

Aaron Crow (2:21.474): You go to every conference, every product, everybody is talking about AI. It's slapped onto everything, whether it actually adds value or not. It is the fine print of every product in cyber and not cyber. Everything has AI integrated. Just like it reminds me of the appliance generation as everything became IoT and everything had intelligence.

Aaron Crow (2:51.170): You know, I can see use cases for a lot of those products, your smart TV and you know, all that type of stuff, but I don't freaking need my toaster to have wifi. I don't need my toaster have Bluetooth. It's just a toaster. You walk over to it, you put toast in or bread in it. You push it down and toast pops out. I don't need to know or alert or monitor as much of a nerd as I am. And I love that type of stuff. It is not a requirement in my space. And so you see all of this influx of let's

Aaron Crow (3:20.876): let's embed and make everything smart. But that doesn't actually necessarily always add value. Sometimes it just makes things more complex. I'm going through a process right now with, I've got a fairly new vehicle and it has all the computers and bells and whistles and it's got air suspension and all the things. And I had a problem with the suspension on the truck. So I'm pretty handy, I can work on things.

Aaron Crow (3:50.314): So I replaced the suspension, the shocks, air ride shocks in the front of my vehicle. Got new ones off the internet, sent them to my house, replaced them, had a couple hangups on the actual devices themselves. Anyways, got that fixed, got them installed. Computer doesn't recognize them. And I don't have the ability to talk to the computer. I don't have the program or the requirements to be able to recalibrate the computer. So I had to take it to a...

Aaron Crow (4:18.990): A mechanic. Luckily, I guess my brother-in-law is a mechanic. So I took it to him. I had it towed over to his house. Well, his computer doesn't have the right interface. So he's we've been waiting a week for him to get the right part. Now, granted, I could take it to Chevy. It's a Chevy Tahoe, you know, could have taken it to the dealership, but I know the cost would have been super expensive on those things. Right. So on the flip side of that, I'm actually considering once I repair this is to trade it in and get something different. And when I say different, you know, the days of

Aaron Crow (4:48.706): You know, my very first car was a 1984 Toyota Land Cruiser, right? That didn't have any computers. It was carbureted. I'm not going to necessarily go back to that, but there's a benefit or a value in simple, right? If it ain't broke, don't fix it. You know, this has been the mindset of OT for a long, long time. There's a reason why we have really old, I'm doing air quotes here, antiquated types of systems in these spaces.

Aaron Crow (5:16.206): because they work, they do everything they need to do. I don't have to have all the whiz bangs on everything because it doesn't necessarily make it more beneficial, right? It's one of the problems that we have in the OT space is, yes, cyber is great, but it's a cost center, right? I'm not adding value. If I look at a process and OT, that's one of the biggest differences between IT and OT as we know, is OT is...

Aaron Crow (5:44.621): really tied directly to a physical outcome. So it's a manufacturing facility, it's a power plan, it's something that these things impact, you know, production. So if I'm adding cost on top of it, but my ROI is not increasing, then I'm just making it more expensive to do the same process I've been doing. So why would I want to do that, right? Obviously, well, because nation states and China and

Aaron Crow (6:10.670): ransomware and blockchain, all the things like it. And all those things are true. I do this for living. Obviously cyber is important to me. I absolutely think we need to be doing more in the OTS space and the IT space for that matter. At the same time, we have to consider what is the cost benefit analysis on, you know, implementing these tools. And there's a reason why so many spaces in so many environments, especially OT have not had this change. Cause they've been running this way for 40 years. Again, I'm doing air quotes here.

Aaron Crow (6:39.822): if you're just listening. We've been running this way for 40 years. Why would I change it? How can I protect this environment without reinventing the wheel? This is the conversation we're constantly having in OT. Yeah, that old system that's sitting in the corner that's running on some slarrers or it's running on Windows XP or it's running on whatever, Windows 7. Do I have to replace it?

Aaron Crow (7:3.852): the IT and the cyber guy and he says, absolutely, because it's in the support and you're not going to get patches and it's got all these vulnerabilities. Okay, but what? Well, let's pretend just for a second, take off your cyber hat and put on your management hat, your production hat, your plant manager hat and say, okay, but this is the only thing that works. And if I replace that with a newer version, it's not going to be as reliable. It's more expensive. Like all these types of things can take me six months to get there. Then I got to retrain all my people, et cetera, et cetera, et cetera, et cetera.

Aaron Crow (7:33.039): What if what is there a different way? Like how else can we approach this problem where I can just protect what's already there? If I put a big protection box around it, I don't allow remote access like I monitor the heck out of it. Wouldn't that be just as good? Like my my risk is never zero. Even even bringing in a brand new device. My risk is not zero. There's a whole bunch of other risks that I'm bringing in that are not cyber related.

Aaron Crow (7:58.297): But there are other risks. Again, we talked about they're not as reliable. They don't work as well. Like there's all sorts of things just like my refrigerator. We talked about appliances just a minute ago. The refrigerator you go buy at Best Buy now or Home Depot or Blows or wherever you buy your appliances is not probably going to last as long as the one that my parents had in the 70s. Those things ran for decades, but they were very simple. They were reliable like a G-E-M-A tag. Those things lasted forever. They just ran.

Aaron Crow (8:27.798): Now, again, they didn't have all the fanciest and have water in the door. They didn't have an ice maker. They just did the very basic things that they need to do, but they lasted forever. This is where AI, all these new tools, they can add complexity. They can add capabilities, add a lot of really awesome things, but you don't always need them. Sometimes you just need to make the thing cold. You just need to freeze the thing, right?

Aaron Crow (8:55.896): So what is AI good at in OT? Where does the fit come in, right? AI can help with obviously pattern recognition, alert, alert, in prioritization, faster triage. I really see AI, especially in OT, it's everywhere, but let's just continue down this OT path real quick. I really see it as the enter, right? What are some tasks that I can give it?

Aaron Crow (9:24.102): that I can take off the shoulders, the responsibilities of my lead technician, of my more senior people. What are those tedious everyday tasks that I can give AI just like I would an intern? And the reason I use that word intern, and maybe intern's not the right word, maybe it's entry level, fresh out of college, whatever that is, I would only want to give AI, especially an OT, until I build out those processes just like an intern.

Aaron Crow (9:52.183): I wouldn't want to give them something super important or beyond their capability until I've proven and trained them on how to do those things. So I see AI is the same way in all spaces, but especially in OT where the impact and the risk is so large. So I want to be able to give it things that worst case scenario, get something wrong, somebody's going to check it.

Aaron Crow (10:17.121): It's going to have that human double checking. It's going to have peer reviews. It's going to. It's not going to shut down the plant or the process or or take something offline by itself without somebody that's capable and credible and understands the process and all of the things that would normally do this in a manual way. Looking at it, say, yeah, I agree with that. Let's do let's take this action. That's usually the way we do anything in in OT. You look at a sock.

Aaron Crow (10:42.325): you know, security operations center for an OT environment and analyst in an IT world may kick off a device, may knock it off the network, may isolate it, right? May reboot it in an OT space. I don't think anyone would do that. they shouldn't, in my opinion, your, your, the response of the analyst is going to be to call the local facility or the local person, the person in charge of that are responsible for that, that device and say, Hey, we're seeing this thing happen. Is this expected?

Aaron Crow (11:12.089): how would you like to proceed? Like you're not just gonna reboot something, you're not just gonna kick it off the network. The analogy I like to give sometimes is, we're talking to airplanes have computers. Let's say that there's a vulnerability that needs to happen or there's a vulnerability on the airplane control system and there's a patch. Do you wanna patch that when you're flying 30,000 feet in the air full of passengers?

Aaron Crow (11:40.705): No, I didn't think so. You probably want to wait until that thing's on the ground and it's in maintenance and it's not required to be in the air the next 30 minutes where you can actually install, patch, test, validate, et cetera, et cetera, et cetera. So this is the way that we need to look at all things in OT, but also IT, right? We shouldn't just turn everything over to AI no matter how great it is.

Aaron Crow (12:6.839): Just like we wouldn't turn everything over to a brand new hire, no matter how smart they are, because they don't have the experience and the understanding of your processes, of your environment. You can get the smartest person out in the world that has never been to your facility before. Will they be able to figure it out? Absolutely. But don't you think you want to train them and show them the ropes for a bit? Onboard them? Do that on-person training, in-person training, before just giving them the keys to the kingdom? Probably so.

Aaron Crow (12:36.761): So AI obviously can help with a lot of those tasks. can validate alerts that are coming in. There's a lot of things that we can have AI do. I see it as a force multiplier for teams. It's the difference between building a piece of furniture by hand and chisel or by using power tools or building a house with a hammer and nails as opposed to a nail gun and all of the modern tools that we have to

Aaron Crow (13:7.001): that doesn't necessarily make it better. can absolutely do it the old way, but it's going to be faster if I use those tools and I know when and where to use them and where it's safe to use them. Again, I'm not going to just turn on a brand new person that just came out of trade school and make them my plumber without some kind of oversight over what they're doing. Yes, they learned, they're smart, they're super capable.

Aaron Crow (13:29.613): but they don't know, they haven't seen this exact scenario because it didn't show up in their book, it didn't show up in their class, it didn't show up in their lab, just like AI, if it doesn't know how to respond, it's just gonna make something up. And that may or may not work. The hard truth is, is most OT environments aren't ready.

Aaron Crow (13:46.200): this is really the heart of my feeling in OT in general. And that has really limited to do with AI and everything to do with our OT spaces. We're just not ready. Like we need to slow down. and it's not, it's not only a tool problem, right? It's, it's pros, you know, people process and technologies, right? So many times in OT, we don't have enough people. We don't have them trained in the right ways.

Aaron Crow (14:11.631): And, you know, we don't have yet. Technology is definitely a factor there, but you can't just put technology in and expect it to fix the problem. Right. Most of the environments lack still lack in 2025, almost 2026 still lack an accurate asset inventory. They still they still lack network segmentation. They still lack clear and secure remote access, defined ownership during incidences like.

Aaron Crow (14:39.779): tabletop exercises, incident response plans, testing, response playbooks, not to mention having documented response ones, even the ones that do have them documented, do the right people know how to use them, where they are, what they're supposed to be and have they ran through them? It's the fire drill. Why do we do a fire drill? It's because we don't want the first time that we are responding to a fire to be in a fire. We want to know when that fire alarm goes on, everybody knows what to do.

Aaron Crow (15:7.833): They know where to go. They know not take the elevator. know here, here's the exit points. Where am I meeting to leave my stuff here? Like they they've already been through the drill in a safe way. So when that, when the real world scenario happens, they can, they can go through that process. At least they've been through it in their mind and they've gone through it and experience at least once or twice in a low stress environment, in a safe environment. We should be doing these same things and in high TOT, all these spaces.

Aaron Crow (15:34.147): We're doing it at a high level. We're doing it once a year. We're doing a tabletop. Maybe we're doing a checkbox paper, you know, tabletop exercise, but not to the level that we should be. This shouldn't be seen as a check the box exercise. It should be seen as, I should be going through this so that I'm able to respond quicker, faster and better for my team, for my environment, et cetera.

Aaron Crow (16:1.517): You can't automate clarity you don't have. Like you can't, you can't automate things that you don't know. You don't know what you don't know.

Aaron Crow (16:12.377): This is why AI alone can't and won't save OT or IT and cyber in general, right? AI depends on clean data, stable architectures, known baselines, clear authority, like all of those things. You have to have that foundation to be able to feed the AI or any of your systems to understand where are my important systems? Where are my security architectures? Where are the critical systems? How do these things tie together?

Aaron Crow (16:41.197): What is supposed to talk to what, right? All of these things, if you aren't doing, if you don't have a base understanding of that, then how can you expect AI? Now, absolutely AI can help you figure those things out, but you can't just expect to just plug in an AI tool. Not yet, maybe sometime in the future, but as of right now, you can't just plug something in and expect it to learn your environment, know what to do, and do it correctly. Like it'll make a lot of assumptions, and you're just hoping that those things will be good.

Aaron Crow (17:9.231): Because the reality today in OT is that we've got a lot of flat networks. We have a lot of tribal knowledge where there's one person, there's two people, there's three people that really understand, know where the bodies are hidden. But if those people get hit by a bus or they're not there or they forget, many things aren't documented. There's a lot of, this is how it's always worked. Again, air quotes, I'm doing a lot of air quotes today. I can't tell you how many times of why is it this way? Well, it's always been that way.

Aaron Crow (17:38.487): Okay, but why? Well, I don't know. I inherited this from this person who inherited it from this person. You know, I worked in the power utility industry for a long time. My father worked in it for 40 years before me. And it was very funny because I would talk to him about things like we'd be looking at a control system and looking at how it's architecturally, hey, you actually implemented this plant when it was built. Why was it built this way?

Aaron Crow (18:4.953): Well, I don't know. That's the way that the vendor did it or whatever. He'd have some reason and explain it. But nobody else and he'd been retired from the company for 20 years. Nobody else really understood that reason. It's just the way it is. I don't know. I just happen to have some inside baseball of to why it was that way. And it doesn't mean it was right or wrong. It just means that's the way it was. And it never got changed because we just assumed that that was the best way to do it. Right, because change can be scary. Change can be difficult. Change can be not always good, but sometimes it can be good.

Aaron Crow (18:34.891): But we don't change just for change sake. So we really have to be able to justify why are we changing something? Not just because they came out, not just because there's this new capability. Do we need that capability? Fundamentals still win every time. Reinforcing the basics, like again, asset inventory, understanding your network, understanding your critical assets, access control, change management, backup and recovery. We see this ransomware is such a big deal.

Aaron Crow (19:3.791): If you had good backup and recovery, granted there's exceptions to that, but if you have good backup and recovery, ransomware wouldn't be as big of a deal. Yeah, you're gonna get hit, okay, then you restore. It's not a big deal, I restored before that happened. Unless it was sitting, there are exceptions, I'm not trying to make it too simple, but nine times out of 10, if you have a valid and tested and functional backup and recovery plan that's offline and doesn't get encrypted or impacted by that same thing,

Aaron Crow (19:33.411): then you're good. The bigger thing is, is that the, you know, the human side of this, the people side of this, right? Making sure that those people, and again, not the technology, the people know how to respond, know how to recover, know the path and the process to be able to move that thing forward.

Aaron Crow (19:53.689): So I see AI fitting in when the basics are done. Again, maybe you can use it to help you get to those basics. Maybe it can help you streamline some of those things, but you really have to, you once those fundamentals exist, that's where AI becomes so powerful, right? So you can reduce, that's when you start being able to offload those things we talked about a little bit earlier. I can take things off of the shoulders of my more,

Aaron Crow (20:20.985): higher level folks, that way I can have them focused on those higher level needs and they're not focused on those smaller things. The alerts that are coming in, maybe they can not have to look at everyone, that AI is doing that first pass of things. They're just doing that approval side, Engineering-led security, how are they doing the designs? AI can look at things and say, have you considered this? You can take a configuration, you can take a

Aaron Crow (20:50.979): You know, your policies, you can morph all those things together and help it find the needle in the haystack, right? Again, it should just be helping you make faster decisions. You shouldn't expect it to do everything for you. You still need that human element there. It should sit on top of your processes, not replace them. So what does this mean going into, you know, this new year? Again, it's today, I'm recording this. Sunday, December 28th, almost the end of the year of 2025.

Aaron Crow (21:20.959): And, you know, looking forward, what do I see or what I expect coming in, right? I expect there's going to be more AI in control environments. There's going to be a lot more. We've called it shadow IT in the past. I think there's going to be a lot of shadow AI usage in these spaces because they these operators don't have enough people. Maybe they don't have enough funding to do.

Aaron Crow (21:47.919): some of the things they need to do so they're going to start using these tools. There's going to be a lot more high level executive board level type scrutiny on those types of things. AI in these spaces and there's going to be more pressure to show resilience against these things. We see more and more attacks and OT in the news that we haven't seen as much in the past. So I think there's going to be more.

Aaron Crow (22:16.441): pressure to show resilience over alerts? Like why are we, you know, maybe you've rolled out the passive monitoring, the active monitoring, you you've rolled out some of these things, but what is it getting me? Right? That's the next thing is, okay, I've spent all this money, I've done all these things, and what are we doing with it? Like what does it say? How has it helped us? How are we being more efficient with this? What are we going to do with it? How are we going to use it? Right?

Aaron Crow (22:44.301): The side of this, it's that continuing feeding of these things. I can't tell you how many times I've been part of a process where we rolled out a big, we rolled out all that we built the design, we rolled it all out and then there was no plan to take it over and run it. So then it just sits there and collects dust and then it gets end of life because nobody's actually using it. All this capability, but if nobody uses it, then it doesn't matter. I can absolutely help with some of that, but.

Aaron Crow (23:15.103): the organizations that skip those basics and just try to jump ahead to AI, I think they'll feel that pain, especially in these OTSpaces. I know I'm harping on OT a lot, but I think it's because you're going to see the bigger impact. If you implement AI and it impacts your web server, maybe that's a big deal. If that's all you do is sell web things. But if you're at a power plant and you implement AI and it shuts down the plant,

Aaron Crow (23:45.401): that's going to be a little bit different impact to these environments. advice to OT and cyber leaders. If you're cyber security in general, whether it's IT or OT, stop chasing shiny tools. I know that it's exciting. I'm a nerd. I've got flashy lights all behind me and I'm always playing with the newest tech and playing with stuff all the time. I get it.

Aaron Crow (24:14.189): but those tools aren't necessarily the biggest problem or the biggest result or outcome or goal or things like that that you need, get brutally honest about fundamentals. This is where a lot of times as a consultant, I get brought in. And a lot of times I get varying responses because I'll come in and they'll say, hey, we wanna do an assessment on these environments. So I come in and I do the assessment and I, unfortunately many times I'm having to say, hey,

Aaron Crow (24:43.405): the baby's ugly. Here's the problems that you have. You've got any, rules on your firewall. And then I get all the justification of why that's not a problem. And I'm like, yeah, but it is a problem. And here's why it's a problem. And you don't have secure mode access and you've got, you have really have no segmentation and VLANs not segmentation and all of these types of things I come in and I try to be as honest without beating them up as I can working with them.

Aaron Crow (25:11.084): and working with the team like, guys, this is not a negative against you as a team. was just a, hey, these are the things that we see as an outsider that you guys brought us in to do.

Aaron Crow (25:22.541): And sometimes it's really hard to take that pill. Because it's their environment, it's their baby. They've worked really hard to get it to where they are. That's not to downplay the work they've done. It's just to say, hey, this is where you're at and this is where your organization says you want to go and here's the gaps between those two.

Aaron Crow (25:46.423): Another big one I see is clarify ownership before incidents. And this goes back to the tabletop exercise, right? So the how or the what or the how is good, but the who is super important, right? So obviously you need to know what are my environment? What are the important pieces? How am I going to recover? All those things are due. Like what am I going to do in these environments? But the who is a big part and the who needs to be so important that not only do you need to have it

Aaron Crow (26:16.365): define the roles and responsibilities, but make sure that those responsible parties are part of those tabletop exercises, you know, disaster recovery plans. They're actually creating and helping write those plans, not just a line item. Because if their name is in it, they need to be part of it. They need to understand it. They need to be part of the decision-making and the writing of those procedures and policies because...

Aaron Crow (26:39.809): If not, then your policy and procedure probably isn't accurate because if you're not including them and they're the ones doing it, either they're not gonna do it correctly, they don't know what to do, or you don't know what to do, they do and they weren't part of that process. Use AI next, I would say to use AI to assist people, not replace thinking. I know I said this before, but it's a tool, just like any tool. It's not going to reduce your workforce, it's not going to replace people.

Aaron Crow (27:9.421): not yet, at least in these spaces, it's going to assist them. It's going to be a way for them to work smarter, faster and better sometimes. And sometimes it may take them longer to build the AI capability in upfront so that it becomes a tool and resource for them down the road.

Aaron Crow (27:33.229): Build for recovery, not for perfection. I don't think anybody really has this problem in OT, other than maybe consultants and vendors. But most OT organizations are not looking for perfection. They're building so that they can recover. They're building so that they can protect their environments. And sometimes that means they're not making a decision. They're not installing that product.

Aaron Crow (28:0.756): segmenting that area as much as you want them to because it's expensive, it's hard, there's a lot of factors that go into these things. The basics are not old.

Aaron Crow (28:13.007): They're not changing. They're not out of out of style. They're they're they're unfinished. They're not well implemented. They're missing in many spaces. So to close out, I would say AI is definitely coming fast. You're definitely going to see it in OT.

Aaron Crow (28:33.847): OT is still catching up just like in all things. AI will be a slower adopter in most OT spaces, but that does not mean it's not coming. And slower does not mean 10 years. Slower may mean a few months later, maybe a year later, but not decades later like many of the things in the OT and IT differences have been. But I think the future really belongs to teams that master the basics. And then they employ up

Aaron Crow (29:2.831): They apply intelligence on top of them. They're using the tools. Many of the basics that we're talking about do not take tools. They don't take fancy, expensive licensing products, hardware, et cetera. It's basic stuff, asset inventory. It's walking around with a clipboard. Can you do it with a tool? Absolutely. And you should. I absolutely should. You should have a product that does that and automatically updates and documents and has level of detail. But if you don't,

Aaron Crow (29:32.931): That doesn't mean you can't do anything. That means that you need to get the clipboard and get a, get an intern or an entry level person or an operator or somebody and walk down every single machine, make sure it's labeled, make sure you know what it is. Make sure you have all the everything in a spreadsheet. Having a spreadsheet asset inventory is better than no asset inventory. And don't wait to get a tool.

Aaron Crow (29:55.919): before you do something, right? Take action today.

Aaron Crow (30:0.655): So that's it. I'm sure there'll be a lot more talk about AI in 2026 and how it impacts OT, IT, cybersecurity. AI is changing fast, it's growing fast, it's going to impact everything. I think we'll continue to see AI bolted onto everything. And that's not necessarily a bad thing. Sometimes it can be though, right? You can be falsely secure or you feel a false sense of security

Aaron Crow (30:30.043): in some of these capabilities that you haven't necessarily tested. And again, when you're missing the foundational functional capabilities in your environments, then it doesn't matter what tool you add AI or not. Those foundational things are the key, right? Garbage in, garbage out, right? You've got to have that foundational understanding and capability in your spaces. And that's the hardest thing to do. Anyways, hope everyone had a great

Aaron Crow (31:1.098): 2025, looking forward to 2026. Thank you for listening. Please definitely go out and like and subscribe, comment. I'd love to have, you know, always looking for folks to come on the podcast, talk about IT, talk about OT, talk about cybersecurity, talk about AI, talk about all of those things, always looking for good conversations. As always, I do this because I enjoy it. I like having these conversations. I think it's important to have these conversations.

Aaron Crow (31:30.695): and get ahead of these things as we see new trends coming out, as we see old trends that are not going away and what do we do about those things. Again, thank you again. I look forward to seeing everyone, whether that be at a conference, in the airport, or happy to be on site until then. Definitely don't hesitate to reach out and thanks a lot.

Transcript lightly edited for readability.