ICS Security's 25-Year Reunion Is Headed to Nashville

Twenty-five years is a long time in any security discipline. In ICS and OT security, it's practically geological — spanning Stuxnet, a global ransomware epidemic that learned to cross the IT/OT boundary, and the slow, ongoing reckoning with legacy PLCs that were never designed to live on a network.

The 2026 ICS Cybersecurity Conference convenes October 6–8 at the W Nashville. The anniversary edition is a reasonable moment to take stock of how far the field has come, and how much unfinished business remains on the shop floor.

The conference has historically drawn the practitioners who keep power grids, water treatment facilities, and manufacturing lines running — the people who can't simply patch on Tuesday because their environment runs 24/7 and downtime means something other than a help-desk ticket. That tension between availability and security hasn't gone away. If anything, the push to connect OT environments to enterprise networks and cloud monitoring platforms has sharpened it.

The threat picture has changed too. Early ICS security conversations centered on nation-state actors with surgical intent. Today the field contends with ransomware groups that stumbled into OT impact — Colonial Pipeline being the canonical example — alongside adversaries who are deliberate about targeting industrial processes. Those are different threat models. They call for different defenses.

AI is starting to appear in this conversation in ways that are occasionally useful and occasionally theatrical. Anomaly detection on process data has real promise. Automated patch prioritization for environments where many CVEs will never be remediable is worth examining. Whether the vendor pitches at a conference booth match the technical reality is, as always, a separate question.

Nashville, October 6–8. Mark the calendar if OT security is your beat.