# Derek Harp

Derek Harp works in industrial cybersecurity education and events, sharing training and expert discussions about securing operational technology (OT) and industrial control systems (ICS).

- Profile: https://b2binfluencer.marketing/creators/derek-harp/
- LinkedIn: https://www.linkedin.com/in/derekharp
- LinkedIn followers: 23,426
- Topics: cybersecurity, career-development, incident-response
- Based on 17 dated posts, latest 2026-10-06

## Summary

Derek Harp is useful for explaining OT and ICS security to practitioner and training audiences.

- Best for: Industrial cybersecurity training or event partnerships focused on OT and ICS education.
- Not for: Enterprise IT or cloud security campaigns aimed at financial services buyers.
- Check first: Ask for recent comparable post results and audience role, region, and seniority data.

### Takeaways

- OT security should be taught by people who have worked the plant floor.
- IT and OT risk assessments are still run separately, with a unified view unfinished.
- A breaking advisory should become an expert session within days.

## Main ideas

- **OT security should be taught by people who have worked the plant floor**: Derek Harp argues that credible operational technology (OT) security instruction comes from practitioners with decades of field experience, and contrasts that with general AI answers and generic online courses. The argument is made by setting up a high-stakes technical question and then presenting a first-hand story instead of a course description.
- **Industrial cyber risk is an operations and board problem, not a slide deck**: Derek Harp frames OT security in energy and critical infrastructure as an immediate business-operations challenge, not a theoretical or quarterly-reporting item. The reasoning is that active campaigns against energy assets force leadership to close visibility, segmentation and governance gaps, which requires board-level authority and fast capital allocation.
- **IT and OT risk assessments are still run separately, and the unified view is unfinished**: Derek Harp writes that IT assessments focus on enterprise systems while OT and ICS assessments follow standards such as IEC 62443, with overlaps flagged to both teams. A consolidated picture of IT, OT, cloud and supply chain risk is a direction of travel, not yet a reality.
- **A breaking advisory should become an expert session within days**: Derek Harp's method for live threats is to translate a government advisory into an industry session almost immediately, with named incident-response practitioners rather than a written recap. The reasoning is that the severity and timing of an advisory make a same-week expert read more useful than a delayed summary.
- **Sector-specific security conversations beat one generic OT event**: Derek Harp treats major industrial sectors as distinct audiences with their own systems, threats and agendas, promoting dedicated sessions rather than one broad OT event. Manufacturing is described both as a prime target of digitization and supply chain risk and as a place where security innovation is happening.
- **Most people enter ICS/OT security with missing pieces, not full fluency**: Derek Harp argues that almost nobody arrives in ICS/OT security already fluent in engineering, safety, cybersecurity, physical security and risk—and that this is normal, not disqualifying. The discussion’s substance comes from guests presented as long-serving practitioners.

## Work to read

- [Zero internet-connected machines should be able to reprogram a safety PLC](https://www.linkedin.com/posts/derekharp_ics-lessonsfromthetrenches-otsecurity-activity-7513279518502125569-LR29)
- [Most people enter ICS/OT security missing pieces, not fully fluent](https://www.linkedin.com/posts/derekharp_most-people-do-not-walk-into-icsot-security-activity-7490189878694137856-2ras)
- [IT and OT risk assessments are still run separately](https://www.linkedin.com/posts/derekharp_riskmanagement-cybersecurity-itot-activity-7504528103923179520-r2Vc)
- [Joint advisory on Iranian-affiliated PLC targeting](https://www.linkedin.com/posts/derekharp_cisa-the-fbi-nsa-epa-doe-and-us-cyber-activity-7450945460560629761-l5CL)
- [Oil and gas OT security as an operations problem](https://www.linkedin.com/posts/derekharp_otsecurity-icscybersecurity-oilandgas-activity-7498097224296419329-nge5)
- [Manufacturing as a target and an innovation arena](https://www.linkedin.com/posts/derekharp_manufacturing-plays-a-vital-role-in-industries-activity-7320543133983789056-3Xri)
- [Live symposium on ICS/OT security for oil and gas](https://www.linkedin.com/posts/derekharp_ics-otsecurity-cybersecurity-activity-7498396576957063169-WNt3)

## Brand relationships

- **CambiOS Academy** (disclosed_partnership)
- **(CS)²AI Global - Control System Cyber Security Association International** (disclosed_partnership)
- **Level Zero OT Cyber Security Conference** (disclosed_partnership)

## Partnerships

Derek Harp's posts document collaboration through two channels: promoting the CambiOS Academy course catalog, which features outside practitioners as faculty, and running online symposium and conference sessions with named guest experts on panels. For an industrial cybersecurity training company, the practical route is to supply credible instructors or speakers and co-promote through course catalog and event registration pages rather than buy a defined ad package. The posts repeatedly contrast field experience with generic courses and AI-generated answers, making demonstrated plant-floor and incident-response experience central to a partner's value. The posts do not describe a published sponsorship program, rate card, partner policy, or official inquiry route. Ask directly about pricing, deliverables, contractual terms, and how to inquire.

## Alternatives

- Katie Colledge-Price: Choose Katie Colledge-Price when the training company wants to co-produce a published guidance document for electric-vehicle charging and critical-national-infrastructure operators rather than a course series. The posts show the working pattern end to end: convening an industry working group; writing a cyber security guidance document for local authorities, fleet operators, chargepoint installers and operators; launching it at an event with named collaborators; and packaging standards material that non-specialists can apply — ETSI EN 303 645, RED compliance, Cyber Essentials Plus supply-chain requirements, PCI/DSS for payments, and the role of CAF and licensing from 2028. A partner that needs a document other organisations can adopt, plus a launch moment, will get more from this route than from a course catalog. The partnership task is the same — a named contributor who brings a working group, a written deliverable and public/private convening — but the subject is charging infrastructure rather than plant-floor control systems.
- Andy Elizaire, MIS, GCED, GEVA: Choose Andy Elizaire when the education product is aimed at enterprise security leaders and focuses on how AI changes security operations. The two posts address that audience directly: one argues that AI is changing everyone's job rather than removing it, processes events faster but does not understand a business's risk tolerance, and leaves people, process and technology to decide outcomes. The other reframes ransomware from a backup and endpoint problem into a decision-speed problem across identity, endpoint, network, cloud and email, with 24/7 response as the test. Both end with a direct question to the reader, making them suited to a webinar or roundtable where the panel is expected to answer, and name specific product directions a partner could build a session around. For a partner whose product is AI-in-security-operations education for CISO-adjacent buyers, this is a closer audience match than industrial control systems material.
- Sandra Roberts, CSM, CySA: Choose Sandra Roberts when the buyer is a CISO or board-level audience and the education program frames cyber risk in business terms rather than teaching control-system practice. The posts are built for that conversation: one explains quantum computing risk, the harvest-now-decrypt-later pattern, and why board and executive continuity matters when CISO tenure runs under three years. The other lists five CISO priorities — demonstrating business value, adapting to AI, data security and privacy, security-conscious culture, and regulatory compliance — with a linked source for each. Each post offers a short, ordered argument a moderator could put to a senior audience, and both point to further reading rather than a course. For a partner whose product is aimed at executives who approve spending, this is a better starting point than practitioner training.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/