The OT security industry has been selling complexity when what organizations need is simplicity. After hundreds of deployments across manufacturing, oil & gas and building automation, we've discovered a fundamental pattern: the more complex the security solution, the less secure operations become. Not because the technology fails, but because teams abandon tools they can't readily use.
At Tosi, we believe the people who run operations should control their security—and be able to implement it in minutes, not months.
The real cost of OT insecurity
Industrial organizations experienced breach costs averaging $5.56 million in 2024—an 18% increase and the highest jump among all industries (Source: IBM Cost of a Data Breach Report 2024). Manufacturing facilities lose $260,000 for every hour of downtime, with some critical operations losing up to $5 million per hour (Source: ITIC found key verticals including manufacturing, energy and utilities experiencing losses exceeding $5 million per hour). Yet many organizations still approach OT security with layers of complexity that operations teams struggle to manage.
The Colonial Pipeline paid $4.4 million in ransom (Source: CEO Joseph Blount Jr. confirmed payment of 75 Bitcoin, equivalent to $4.4 million USD) and lost tens of millions more in operations. JBS Foods paid $11 million (Source: CEO Andre Nogueira confirmed payment of $11 million USD in Bitcoin). These massive payments came from major corporations with substantial resources.
We believe traditional OT security has failed because it's designed for security experts, not operations teams. A fundamentally different approach is needed.
150 Sites in six months: Oil & gas deployment insights
TSA's Security Directive requires pipeline operators to implement specific cybersecurity measures within strict timelines (Source: Security Directive Pipeline-2021-01D and Pipeline-2021-02E, issued 2024). Miss these deadlines, and organizations face operational restrictions or shutdowns. Traditional security approaches requiring IPSEC tunneling, certifications and specialized expertise make these timelines challenging.
The urgency is real: ransomware attacks on oil and gas surged 935% between April 2024 and April 2025 (Source: Zscaler ThreatLabz documented 935% increase), with 67% of energy organizations hit in 2024 (Source: Sophos research found 67% of energy, oil/gas and utilities organizations were hit by ransomware in 2024).
Civitas Resources secured 100+ sites across the Denver-Julesburg and Permian Basins in under six months. Another customer reached 150 sites in that timeframe.
What made the difference? Eliminating unnecessary complexity.
No certifications. No command lines. No port forwarding. Field teams connected power, configured an IP address, plugged in their equipment and clicked one button. Five minutes per site, not five hours. Behind the scenes, our Zero Trust architecture automatically verified every connection without operator intervention.
Howard Energy Partners' OT Manager started as a skeptic. Today, he's deployed over 100 devices because his operations team can manage everything independently—no dependency on IT, no vendor support calls, complete control.
The insight: TSA compliance doesn't require adding security layers. It requires making security so straightforward that field teams actually use it. When deployment takes minutes instead of days, compliance becomes operational excellence, not administrative burden.
Manufacturing's shift: From truck rolls to global support
Manufacturing executives know the scenario: a critical machine goes down, you dispatch a technician, they drive four hours, and fix it in two minutes. Multiply that by hundreds of machines globally—the costs add up quickly.
This matters because ransomware recovery in manufacturing now averages 49% taking a week or more, with 29% requiring over a month to fully recover (Source: Dragos - "49% said recovery took a week or more, and 29% required over a month to fully recover operations"). Those timelines are unsustainable when every minute counts.
But there's a deeper challenge: you can't protect what you can't see. Most manufacturers discover they have 30% more devices on their networks than they knew existed—including critical equipment completely outside their security perimeter. True control requires complete visibility into every asset and every connection.
Valmetal transformed their business model by solving this problem. They now support farm equipment worldwide without leaving Quebec. Their technicians connect to machinery as if physically plugged into the PLC—full Layer 2 connectivity, no protocol conversion, working with every platform from Siemens to Allen-Bradley.
Champion Door embedded our solution as standard equipment in industrial doors delivered to 60 countries. Their customers get instant remote support without travel delays or costs. Their electrical designers and licensed partners can troubleshoot and resolve issues the same day, building trust and confidence in Champion Door's global support capabilities.
The pattern we're seeing: Companies that scale globally differentiate themselves through their ability to support products efficiently. When teams can troubleshoot a machine in Shanghai from Detroit in minutes, they don't just save money—they transform their competitive position.
Building automation: Achieving operational independence
Red Rock Community College's experience reflects a common challenge: IT controls the BAS. They perform maintenance without warning, dropping access. They change firewall rules, breaking connections. Facilities teams can't get the data they need.
Universal Controls helped them gain independence. Moving their Niagara supervisor to our cloud environment gave facilities complete control. Their manager noted: "Giving us back control over our BAS networks not only makes our building run at an optimal level, but we also appreciate that managing the systems is now completely off the IT team's plate."
A major retailer consolidated from four gateways per site to one across 600 locations, saving $1.2 million in hardware alone. But the real value? Their facilities teams now manage everything independently—no IT tickets, no vendor dependencies, complete control.
The opportunity: As buildings become smarter and more connected, facilities teams can't afford to be dependent on IT departments for every operational decision. They need autonomy to innovate, optimize and operate efficiently.
Three critical decisions
After hundreds of deployments, we've identified which organizations succeed with OT security and which struggle. It comes down to three decisions:
Decision one: Who Owns Security? The most successful deployments share one characteristic: operations teams own the security of their systems. When security teams provide tools and expertise while operations owns the outcomes, both teams succeed. When security tries to manage OT without operational involvement, friction develops.
Decision two: What's Your Complexity Tolerance? Consider this test: Can a field technician deploy your security solution at 2 AM in a remote location with no support? If not, it may be too complex. Every certification required, every expert needed, every support call made is a potential point of failure. It's notable that over 60% of organizations cite OT security solution complexity as their top concern (Source: Palo Alto Networks State of OT Security 2024), with 70% of companies who've already invested facing implementation challenges (Source: McKinsey research cited by DXC Technology).
Decision three: How Fast Can You Scale? Organizations might acquire 50 sites tomorrow or expand to three new countries next quarter. Security must scale at the speed of business, not the speed of IT projects. If adding a new site takes more than minutes, competitive challenges arise.
The 2026 timeline
The window for gradual change is closing. TSA pipeline requirements are enforced now, with stricter requirements coming in 2026. Insurance companies are already excluding companies without proper OT security. Competitors who can support operations globally in real-time are winning deals today.
The shift is already happening: 62% of oil and gas organizations increased cybersecurity spending in 2024 (Source: DNV's Cyber Priority Research 2023), with OT security now reaching the C-suite at 60% of companies (Source: "60% planning to move responsibility to CIO/CTO/COO level within 12 months").
Additionally, the talent situation is evolving. Experienced operators are retiring. New workers expect modern, digital tools. Security requiring specialized expertise that takes months to develop becomes increasingly difficult to staff.
Organizations that can deploy secure OT networks in minutes will have advantages. Those requiring hours or days face challenges. Those requiring weeks may struggle to compete.
Moving forward
Evaluate OT security based on both deployment time and technology capability. If it takes more than five minutes to deploy, complexity may be an issue. If it requires certifications, sustainability becomes a question. If operations teams can't manage it independently, it becomes a dependency.
But deployment speed alone isn't enough. The solution must also deliver the technical capabilities you need—complete visibility into every asset and data flow on your network, proper network segmentation, protocol support for your equipment, reliability for critical operations and the security architecture to protect your infrastructure. You can't secure what you can't see, which is why comprehensive asset inventory and real-time network traffic analytics are becoming essential capabilities. The key is finding solutions that provide both: enterprise-grade capability without enterprise-grade complexity.
Companies succeeding today—deploying hundreds of sites in months, supporting global operations without travel, giving facilities teams independence from IT—are using technology that's both powerful and accessible to operations teams. Organizations that choose solutions focused on simplicity, operational ownership and rapid deployment achieve both better security and transformed competitive positions.
The question isn't whether organizations are ready for this change. It's whether they can afford to wait.
Our perspective
At Tosi, we've built our approach around a simple belief: OT security should be accessible enough that a field technician can deploy it, a plant operator can manage it and a facilities manager can control it—all independently. Organizations that choose solutions focused on simplicity, operational ownership and rapid deployment achieve both better security and transformed competitive positions.
Our platform combines Zero Trust architecture with operational simplicity. We're expanding our capabilities with comprehensive asset inventory (coming Q4 2025) and advanced network traffic analytics—but always maintaining our core principle: powerful security without overwhelming complexity.
From our experience across hundreds of deployments, organizations choosing simplicity, operational ownership and rapid deployment achieve both better security and transformed competitive positions.
The opportunity is available today. It simply requires choosing simplicity over complexity, operations over IT and minutes over months.
