The Problem
Over the past six years, large ASX-listed enterprises with significant security budgets have invested heavily in OT and ICS Intrusion Detection Systems.
​
The intention was clear. Increase visibility, reduce operational risk, and strengthen resilience.
However, many of these platforms have not delivered their full value.
What We See
Most OT IDS deployments were implemented as point-in-time projects.
​
Sensors were deployed. Dashboards were configured. Initial reports were produced.
But like any security control - whether a firewall, SIEM, or IDS - without continuous tuning and maintenance, performance degrades.
Over time platforms become:
-
Noisy
-
Under-maintained
-
Operationally ignored
-
Difficult to justify at renewal
An unmanaged IDS does not reduce risk. It creates alert fatigue.
OT security platforms sit between two worlds.
They are too industrial for traditional IT teams.
Too cyber-focused for engineering teams.
​
As a result:
-
Alerts are not consistently reviewed
-
Logging policies remain unrefined
-
Firmware and sensor updates are delayed
-
Detection logic does not evolve
The technology is deployed. The platform is not operationalised.
​
This is the most common statement we hear.
Boards and senior leadership increasingly require measurable outcomes from cybersecurity investments.
When renewal cycles approach, Cyber Managers and platform owners must demonstrate:
-
What risk has been reduced
-
What threats have been detected
-
What operational improvements have been achieved
​
When IDS platforms are not actively managed, their perceived value declines - regardless of initial capital investment.
​
Leadership Expectations
Government Pressure
&
The Core Problem
Governments continue to mandate minimum cybersecurity requirements for organisations designated as Critical Infrastructure.
​
IDS platforms - or what Gartner refers to as Cyber Physical Systems Protection Platforms - are becoming baseline expectations.
​
As regulatory frameworks mature:
-
Compliance requirements will expand
-
Reporting obligations will tighten
-
Financial penalties for non-compliance will increase
At the same time, nation-state actors continue to target industrial environments.
Operational security is no longer optional. It is expected.
​
The Core Problem
The problem is not a lack of technology.
​
It is a lack of operational maturity and the bridge to enterprise.
Organisations have invested in OT visibility.
But visibility without sustained management does not deliver resilience.
​