Derek Harp works in industrial cybersecurity education and events, sharing training and expert discussions about securing operational technology (OT) and industrial control systems (ICS).
Derek Harp is useful for explaining OT and ICS security to practitioner and training audiences.
Best for
Industrial cybersecurity training or event partnerships focused on OT and ICS education.
Not for
Enterprise IT or cloud security campaigns aimed at financial services buyers.
Key takeaways
OT security should be taught by people who have worked the plant floor.
IT and OT risk assessments are still run separately, with a unified view unfinished.
A breaking advisory should become an expert session within days.
Check first: Ask for recent comparable post results and audience role, region, and seniority data.
Main ideas
OT security should be taught by people who have worked the plant floor · Industrial cyber risk is an operations and board problem, not a slide deck · IT and OT risk assessments are still run separately, and the unified view is unfinished
Derek Harp’s available work presents them as a voice in industrial cybersecurity education and events, focused on operational technology (OT) and industrial control systems (ICS).
Their posts connect technical risks—such as internet-connected access to safety PLCs or gaps between IT and OT risk assessments—to practical questions about training, governance, incident response, and operations.
They also promote practitioner discussions and sector-focused events through (CS)²AI and CambiOS Academy.
Readers interested in how industrial cybersecurity issues are explained and brought to expert audiences can start with their posts on PLC security, career paths into ICS/OT, and oil-and-gas security.
Harp’s posts make industrial security legible by connecting technical exposure with the people and decisions around it.
A question about who can reprogram a safety PLC opens onto a practitioner’s field experience; a post about separate IT and OT assessments makes clear that a unified view remains a work in progress.
Their event posts extend that approach, organizing discussion around concrete settings such as oil and gas and manufacturing, and subjects including segmentation, incident response, and governance.
The posts also include promotional content, showing how they frame education and events.
Derek Harp’s posts present industrial cybersecurity as a hands-on, operations-level discipline rather than a general IT topic.
Read more
They argue that OT and ICS training should come from people who have worked on plant floors, industrial cyber risk belongs in board and operations decisions, IT and OT risk work remains split in practice, and a live threat advisory should prompt an expert session within days. Harp works largely through events and named panels; several of the strongest claims come from guests.
OT security should be taught by people who have worked the plant floor
Derek Harp argues that credible operational technology (OT) security instruction comes from practitioners with decades of field experience, and contrasts that with general AI answers and generic online courses.
Read more
The argument is made by setting up a high-stakes technical question and then presenting a first-hand story instead of a course description.
One post asks how many internet-connected machines should be able to reprogram safety PLCs, answers 'zero,' and describes how everyday IT and OT trade-offs leave critical systems exposed until someone asks the right question. It then points to a clip of Andrew Ginter recalling early work at Waterfall Security Solutions and promotes CambiOS Academy faculty with 25-plus years on real plant floors.
Industrial cyber risk is an operations and board problem, not a slide deck
Derek Harp frames OT security in energy and critical infrastructure as an immediate business-operations challenge, not a theoretical or quarterly-reporting item.
Read more
The reasoning is that active campaigns against energy assets force leadership to close visibility, segmentation and governance gaps, which requires board-level authority and fast capital allocation.
A post promoting an oil and gas session says active threat campaigns have moved OT security out of the theoretical category. It lists panels on ICS/OT governance and safety, incident response readiness, IT/OT segmentation, and recent sector threats, with speakers from energy operators and other companies.
IT and OT risk assessments are still run separately, and the unified view is unfinished
Derek Harp writes that IT assessments focus on enterprise systems while OT and ICS assessments follow standards such as IEC 62443, with overlaps flagged to both teams.
Read more
A consolidated picture of IT, OT, cloud and supply chain risk is a direction of travel, not yet a reality.
The risk-assessment post says overlapping IT and OT risks are highlighted to both teams, but a single comprehensive risk posture across IT, OT, cloud and supply chain remains a work in progress.
A breaking advisory should become an expert session within days
Derek Harp's method for live threats is to translate a government advisory into an industry session almost immediately, with named incident-response practitioners rather than a written recap.
Read more
The reasoning is that the severity and timing of an advisory make a same-week expert read more useful than a delayed summary.
A post summarizing the joint CISA, FBI, NSA, EPA, DOE and U.S.
Cyber Command advisory says its warning that Iranian-affiliated actors were targeting PLCs across U.S. manufacturing, water, energy and building facilities prompted a last-minute expert panel on the first day of the Level Zero OT Cyber Security Conference.
Bryan Singer of Accenture, described as a founding chairman of the ISA99 (IEC 62443) committee, led the panel.
Sector-specific security conversations beat one generic OT event
Derek Harp treats major industrial sectors as distinct audiences with their own systems, threats and agendas, promoting dedicated sessions rather than one broad OT event.
Read more
Manufacturing is described both as a prime target of digitization and supply chain risk and as a place where security innovation is happening.
One post argues that manufacturing, spanning automotive, aerospace, food and pharmaceuticals, has become a prime cyber target as IoT, IIoT and supply chain interdependencies grow.
It announces a (CS)²AI online symposium dedicated entirely to cybersecurity for critical manufacturing.
Another post promotes a live four-hour symposium on ICS/OT security for oil and gas, with panels on governance, incident response, segmentation and real-world incident analysis.
It names experts from STV, ExxonMobil, Chevron and MITRE and offers CEU/PDU credit.
Most people enter ICS/OT security with missing pieces, not full fluency
Derek Harp argues that almost nobody arrives in ICS/OT security already fluent in engineering, safety, cybersecurity, physical security and risk—and that this is normal, not disqualifying.
Read more
The discussion’s substance comes from guests presented as long-serving practitioners.
The career post says most people are missing some of those puzzle pieces and introduces a (CS)²AI session with Marcus H.
Sachs, Christian Harter and Patrick C Miller on what that means for building a career in the field.
Those three professionals, not Derek Harp, carry the argument about career building.
It offers a memorable introduction to why safety and control systems need stricter separation than ordinary enterprise networks, and shows how one sharp question can carry an OT training pitch.
Read more
Derek Harp opens with a blunt question: how many internet-connected machines should be able to reprogram safety PLCs?
The answer is zero.
The post uses that gap between everyday IT/OT trade-offs and an unacceptable safety risk to introduce a clip of Andrew Ginter recalling early work at Waterfall Security Solutions.
Derek Harp contrasts general AI answers and generic online OT courses with instruction from faculty who have worked on plant floors for decades, and points readers to CambiOS Academy's catalog.
For brands planning a campaign
An OT security training partner can co-create content around a high-stakes control decision, grounded in named practitioners’ experience and shop-floor consequences rather than generic AI or textbook claims.
It addresses whether newcomers need expertise in every discipline before entering OT security and points to a multi-expert discussion on career building.
Read more
Derek Harp argues that most people entering ICS/OT security are not already fluent in engineering, safety, cybersecurity, physical security, and risk.
The post frames a (CS)²AI session with Marcus H.
Sachs, Christian Harter, and Patrick C Miller as a way to explore what that skills gap means for building a career.
For brands planning a campaign
Workforce development campaigns can use the missing-puzzle-pieces framing to reach career changers and early-career technical workers, drawing on multiple named practitioners rather than a single generalist.
It explains how IT and OT risk work is divided in many organizations and why a unified risk picture is harder than it sounds.
Read more
Derek Harp explains that IT assessments generally focus on enterprise systems, while OT/ICS assessments follow standards such as IEC 62443. When risks overlap, both teams are alerted, but a consolidated view of IT, OT, cloud, and supply chain risk remains a work in progress.
For brands planning a campaign
A vendor-neutral explainer or workshop on bridging IT and OT risk registers can be useful, provided it does not claim the integration problem is already solved.
It shows how a breaking national cyber advisory can inform an event panel and practical expert discussion, naming the agencies and target sectors involved.
Read more
Derek Harp summarizes an urgent joint advisory from CISA, the FBI, NSA, EPA, DOE, and U.S.
Cyber Command warning that Iranian-affiliated threat actors were actively targeting PLCs across U.S. critical infrastructure, including manufacturing, water systems, energy, and building facilities.
The post says the severity and timing prompted a last-minute expert panel at the Level Zero OT Cyber Security Conference, led by Bryan Singer of Accenture with other industry leaders.
For brands planning a campaign
Partners can build rapid-response webinars or conference panels around live advisories, giving technical audiences a same-week expert read on threat activity instead of a delayed recap.
It explains why oil and gas OT security belongs in board and operations discussions and lists the panel themes practitioners can expect.
Read more
Derek Harp frames OT cybersecurity in oil and gas as an immediate business operations challenge, not a theoretical risk or quarterly slide-deck item.
The post says active campaigns against energy and critical infrastructure make it necessary to close visibility, segmentation, and governance gaps through board-level authority and rapid capital allocation.
It promotes a session with panels on ICS/OT governance and safety, incident response readiness, IT/OT segmentation, and recent sector threats, naming many industry speakers.
For brands planning a campaign
Energy-sector security vendors can sponsor or co-produce board-level OT governance content, making the case through operational continuity and capital allocation rather than compliance language alone.
It explains why manufacturing deserves its own security conversation and points to a sector-specific symposium rather than a general OT event.
Read more
Derek Harp describes manufacturing as vital across automotive, aerospace, food, and pharmaceuticals, and says digitization, IoT and IIoT integration, and supply chain interdependencies have made it a prime cyber target. The post also calls the sector a critical arena for cybersecurity innovation and promotes a (CS)²AI Online Symposium dedicated to cybersecurity for critical manufacturing.
For brands planning a campaign
Manufacturing security vendors can align with vertical symposium content that connects factory digitization, supply chain risk, and practical defense instead of treating all industrial sectors alike.
The event Derek Harp promotes offers multi-company practitioner panels, a sector focus, and continuing-education credit.
Read more
Derek Harp announces a live (CS)²AI symposium featuring four hours of panels on governance, incident response, IT/OT segmentation, and real-world incident analysis. The post names experts from STV, ExxonMobil, Chevron, and MITRE and notes that attendees can earn CEU/PDU credits.
For brands planning a campaign
Training and certification partners can co-market event attendance around CEU/PDU credits and multi-company panels, reaching practitioners who need documented professional development.
IT/OT convergence, segmentation and risk assessment practice3
Vertical symposia for oil and gas2
Practitioner-led OT security training1
Rapid briefings on active threats to industrial control systems1
Critical manufacturing as its own target sector1
Building careers in ICS/OT security1
Practitioner-led OT security training
Derek Harp promotes CambiOS Academy courses, arguing that operational technology (OT) security training should come from people who have worked on plant floors, not from general online courses or AI answers.
Read more
The post makes its case with a field story from Andrew Ginter about internet-connected machines being able to reprogram safety PLCs, and points to faculty with 25-plus years of operating experience.
Teaching through firsthand plant-floor stories and contrasting practitioners’ experience with generic information sources.
For brands planning a campaign
A direct fit for co-branded courses or webinars, with a partner supplying the curriculum or platform and the collaboration adding field credibility. Lead with real plant-floor examples, not course catalog features.
Rapid briefings on active threats to industrial control systems
When CISA, the FBI, NSA, EPA, DOE and U.S.
Read more
Cyber Command issued a joint advisory about Iranian-affiliated actors targeting PLCs in manufacturing, water, energy and building facilities, Derek Harp summarized it and added a last-minute expert panel to the first day of the Level Zero OT Cyber Security Conference. The panel was led by Bryan Singer of Accenture, who has ISA99 (IEC 62443) committee background.
Turning a government advisory into an industry session that same week, with named incident-response practitioners.
For brands planning a campaign
A model for time-sensitive collaboration: a sponsor can fund or co-host a threat briefing timed to a public advisory. This depends on an existing events and speaker pipeline, so plan lead time accordingly rather than assuming an instant turnaround.
Derek Harp promoted a (CS)²AI online symposium and a follow-up session on ICS/OT security for oil and gas, framing OT risk as an immediate business-operations problem requiring board-level authority and fast capital allocation.
Read more
The agenda covered governance and safety alignment, incident response readiness, IT/OT segmentation, and analysis of recent sector campaigns, with speakers from energy operators and MITRE and CEU/PDU credit for attendees.
For brands planning a campaign
A fit for sponsorship or speaker placement aimed at energy asset owners and operators. A brand gets a defined agenda and credentialed attendee base without building the event itself.
Derek Harp presents manufacturing—including automotive, aerospace, food and pharmaceuticals—as a prime cyber target as IoT and IIoT adoption and supply chain interdependencies grow, and as a distinct arena for security innovation.
Read more
A (CS)²AI online symposium focused entirely on cybersecurity for critical manufacturing.
Segmenting audiences by industry and building the agenda around each industry's systems and threat profile.
For brands planning a campaign
Useful for manufacturers' security vendors and industrial software brands seeking sector-specific reach rather than general cybersecurity attention. Creative should name production systems and supply chain risks, not generic enterprise threats.
IT/OT convergence, segmentation and risk assessment practice
Derek Harp writes that IT and OT risk assessments are still largely conducted separately, with IT focused on enterprise systems and OT/ICS following standards such as IEC 62443; overlaps are flagged to both teams.
Read more
A consolidated view of IT, OT, cloud and supply chain risk is described as the direction of travel, not something available today. Event panels return to IT/OT segmentation as a way to eliminate flat-network exposures and lateral movement paths.
The post treats a unified risk posture as unfinished work, so content built around it should describe where practice is heading, not present it as a solved problem.
For brands planning a campaign
Strong territory for educational content on segmentation and convergence. A vendor selling a unified risk product can use the acknowledged gap to start a conversation, while framing the topic as a work in progress.
Derek Harp notes that most people entering ICS/OT security are not already fluent in engineering, safety, cybersecurity, physical security and risk.
Read more
They convened three long-serving practitioners—Marcus Sachs, Christian Harter and Patrick Miller—to unpack what that means for building a career in the field.
For brands planning a campaign
Opens a talent and career-development track, useful for software vendors and training providers seeking professionals early in their move into OT security.
Derek Harp's short-form LinkedIn posts typically run a few paragraphs and promote an upcoming or live event, react to a government advisory, or pose a technical question.
Read more
Most name collaborators and speakers; technical posts address the issue without offering a full walkthrough.
Event-linked publishing: posts typically point to a scheduled session, a course catalog or an advisory response.
For brands planning a campaign
Publishing is tied to events and news cycles. Creative that plugs into scheduled sessions and advisory moments will fit better than standalone brand announcements.
Derek Harp's posts repeatedly promote (CS)²AI Global events and CambiOS Academy training.
Read more
They also reference organizing a panel at the Level Zero OT Cyber Security Conference. The posts describe disclosed partnerships but do not specify their formal roles; ask what their roles are at these organizations.
CambiOS Academy
Disclosed partnership
Derek Harp promotes CambiOS Academy as a source of OT security training, says its faculty has 25+ years in the field, and directs readers to its course catalog.
Read more
The post discloses a partnership but does not specify their role; ask whether they own or work for the business.
(CS)²AI Global - Control System Cyber Security Association International
Disclosed partnership
Derek Harp repeatedly promotes (CS)²AI Global symposia and online panels on ICS/OT security, using first-person language such as 'we' and 'us' to describe the organization's events.
Read more
The posts disclose a partnership but do not specify their formal role; ask what their role is.
Derek Harp says a joint government advisory prompted a summary and a last-minute expert panel added to day one of the Level Zero OT Cyber Security Conference.
Read more
The post shows an organizing or promotional connection to the conference but does not specify their formal role; ask what their role is.
Derek Harp writes about industrial cybersecurity—operational technology (OT) and industrial control systems (ICS)—as a hands-on, operations-level discipline.
Read more
Recurring threads include practitioner-led training, fast briefings after government advisories, sector-specific symposia for oil and gas or manufacturing, and the ongoing work of joining IT and OT risk assessments.
Similar creators take related but distinct paths: Katie Colledge-Price works on EV charging infrastructure security, Andy Elizaire on AI and ransomware in enterprise security operations, and Sandra Roberts on CISO-level strategy and quantum readiness.
Each offers a contrast in sector or leadership focus.
OT/ICS securityIndustrial control systemsCritical infrastructure securityCybersecurity trainingIncident responseIT/OT convergenceEnergy sectorManufacturing sectorOil and gasCareer developmentEvents and webinarsGovernment advisories
Both write about cybersecurity for critical national infrastructure and turn guidance into practical resources for operators and authorities.
Read more
Katie Colledge-Price led an EV charging cyber security working group and published a guidance document; Derek Harp promotes practitioner-led OT security training and event briefings.
Katie Colledge-Price focuses on EV charging infrastructure, secure-by-design standards, and payment compliance, while Derek Harp concentrates on industrial control systems, plant-floor operations, and OT/ICS training.
Both discuss how AI and automation change cybersecurity work and argue for human expertise alongside technology.
Read more
Andy Elizaire writes about AI in security operations and ransomware readiness; Derek Harp makes similar arguments about AI versus field experience in OT training.
Andy Elizaire addresses enterprise security operations, MDR, and ransomware at a broad organizational level, while Derek Harp focuses on industrial control systems, plant floors, and sector-specific OT events.
Both translate technical risk into leadership decisions for people who need to act on cybersecurity at an organizational level.
Read more
Sandra Roberts covers CISO priorities and board communication; Derek Harp frames OT risk as a board and operations problem requiring rapid capital allocation.
Sandra Roberts writes about CISO strategy, quantum readiness, and business value across enterprises, while Derek Harp focuses on industrial operations, ICS standards, and practitioner training.
Placement decision: Derek Harp’s LinkedIn audience offers a credible reach pool for OT/ICS security education and event-led campaigns.
Read more
The profile shows 23,426 LinkedIn followers as of 2026-10-23.
Seven dated posts, from 2025-04-22 to 2026-10-06, promote OT/ICS training and conferences, summarize a joint government advisory on PLC targeting, and discuss IT/OT risk assessment and manufacturing-sector security.
Those topics fit a campaign aimed at industrial cybersecurity training.
The posts don’t identify followers’ employers, occupations, job seniority, geography, age, or gender, so treat the follower count as a measure of reach and topic fit—not verified access to control-system engineers, plant managers, or security leaders.
Ask for recent results from comparable OT/ICS education posts or training promotions, including reach, engagement, and any audience survey or platform demographic data documenting roles, regions, and seniority.
Derek Harp's posts document collaboration through two channels: promoting the CambiOS Academy course catalog, which features outside practitioners as faculty, and running online symposium and conference sessions with named guest experts on panels.
Read more
For an industrial cybersecurity training company, the practical route is to supply credible instructors or speakers and co-promote through course catalog and event registration pages rather than buy a defined ad package.
The posts repeatedly contrast field experience with generic courses and AI-generated answers, making demonstrated plant-floor and incident-response experience central to a partner's value.
The posts do not describe a published sponsorship program, rate card, partner policy, or official inquiry route.
Ask directly about pricing, deliverables, contractual terms, and how to inquire.
Course faculty or guest instructor
Buyer requirement
The course promotion names faculty with 25 or more years of hands-on OT experience and argues that general online courses and AI answers cannot replace people who have worked on plant floors and taken part in boardroom debates. A training partner would need identifiable instructors with that profile who are willing to be named and featured in catalog marketing.
Expert panelist at online symposiums and conferences
Buyer requirement
Sessions are built as multi-hour panel blocks covering governance and safety, incident response readiness, IT/OT segmentation, and recent sector threat campaigns. Panels draw speakers from operating companies and research organizations, so a partner should expect to supply named experts who can speak to live incidents, authority decisions, and cross-asset execution—not product pitches.
Joint session or event co-promotion
Buyer requirement
At least one panel was added to an existing event day at short notice around a joint government advisory, so partners need scheduling flexibility.
Promotion uses a shared registration link and a named speaker list published in advance.
Speakers are expected to contribute perspectives at a national or global level.
An industrial cybersecurity training company wants to assess Derek Harp for an OT/ICS security education partnership or content collaboration.
Read more
This is a strong fit.
Their posts already promote practitioner-led OT security training, argue that instruction should come from people who have worked plant floors rather than generic online courses or AI answers, and point readers to a course catalog.
One post makes the case through a field story from Andrew Ginter about internet-connected machines and safety PLCs, and names faculty with 25 or more years of operating experience.
The fit extends beyond course marketing.
The posts also show a working event and speaker pipeline: multi-hour symposium panels on governance and safety, incident response readiness, IT/OT segmentation, and recent sector campaigns, with named speakers from operating companies and research organizations, and CEU/PDU credit for attendees.
A training partner can plug into that pipeline rather than build its own audience.
Speed is another advantage.
When CISA, the FBI, NSA, EPA, DOE and U.S.
Cyber Command issued a joint advisory about Iranian-affiliated actors targeting PLCs, Derek Harp summarized it and added a last-minute expert panel to a conference day, showing the collaboration can respond to advisory cycles rather than only a fixed calendar.
The audience section measures 23,426 LinkedIn followers as of 23 October 2026, supporting reach and topic fit, though it does not establish whether followers are control-system engineers or plant managers.
Co-created content and co-promotion look like the practical route; ask directly for pricing, deliverables, and terms.
A partner should bring credible, named instructors or panelists with real OT and incident-response experience, since the posts repeatedly judge value on that basis.
When to choose a specialist
An enterprise IT and cloud security vendor wants a product-led demand campaign aimed at financial-services security leaders, built around gated demo assets, analyst-style comparisons, and hard pipeline reporting.
Read more
Derek Harp's posts do not support this campaign.
Every substantive post is about industrial control systems and operational technology: safety PLCs, IEC 62443 risk assessment, IT/OT segmentation, oil and gas operations, critical manufacturing, and a government advisory on PLC targeting.
None address financial services, cloud security buying criteria, or enterprise IT procurement, so a pitch to that audience would rely on topic transfer the posts do not support.
The commercial format is also mismatched.
The posts show co-promotion through a course catalog and event registration pages, with named speakers on panels; they do not show paid placements, product demonstrations, gated asset funnels, or offer testing.
The audience information is limited to follower count and topic fit.
Employer, occupation, seniority, geography, age, and gender are not published, so a budget tied to verified job titles cannot be justified from this material.
Performance information is also missing: no reach, engagement, click, or conversion results for comparable posts or training promotions are published, though a pipeline-reporting campaign would require them.
Before considering a narrower version, ask for recent results from comparable OT education or training posts and confirmation of any paid or contractual partner terms.
Without that evidence, reject this campaign rather than stretch an education-first, event-led relationship into a product-led enterprise campaign.
A worked campaign example
Campaign angle for the training partnership: a co-branded practitioner series built around one control decision per episode, tied to the partner's course or platform. Working title: Zero Connected Machines.
Format and cadence: four 45-minute live roundtables over one quarter, each pairing one partner instructor with one named OT practitioner who has field experience.
Each session takes a single control decision and works through it on the plant floor, as in the concrete cases Derek Harp's posts already use: how many internet-connected machines should be able to reprogram a safety PLC, why IT and OT risk assessments are still run separately, and what changes when a government advisory names PLCs in water, energy, and manufacturing.
Schedule two sessions as flexible slots so the series can absorb a live advisory, as the Level Zero panel did.
Roles: the partner supplies the instructor, curriculum framing, and registration or learning-platform handling, including any CEU/PDU credit logistics.
Derek Harp's channels carry the practitioner stories, speaker lineup, and event registration link, while both sides publish to their own audiences.
Name speakers in advance, and keep panel slots open to a second operating-company voice so the sessions do not read as a single-vendor pitch.
Assets the audience can use: a short field-story clip per episode, a one-page control-decision checklist for each topic, and a closing slide directing attendees to the partner's course or product page. Since Derek Harp's posts contrast practitioner teaching with generic courses and AI answers, every asset should carry the practitioner's name and years in the field rather than generic claims.
Placement: course catalog and event registration pages are the routes shown in Derek Harp's posts. Each post in the series promotes the next session and links to the shared registration page, following the approach in their existing posts.
What to measure: registrations through the shared link, attendance and completion, CEU/PDU claims, and checklist-asset uptake.
Since no prior performance figures are published, use the first session as the baseline.
Before launch, ask for recent results from comparable OT education posts or training promotions and any paid or contractual terms; the posts show collaboration but no pricing, deliverables, or inquiry route.
Choose Katie Colledge-Price when the training company wants to co-produce a published guidance document for electric-vehicle charging and critical-national-infrastructure operators rather than a course series.
Read more
The posts show the working pattern end to end: convening an industry working group; writing a cyber security guidance document for local authorities, fleet operators, chargepoint installers and operators; launching it at an event with named collaborators; and packaging standards material that non-specialists can apply — ETSI EN 303 645, RED compliance, Cyber Essentials Plus supply-chain requirements, PCI/DSS for payments, and the role of CAF and licensing from 2028.
A partner that needs a document other organisations can adopt, plus a launch moment, will get more from this route than from a course catalog.
The partnership task is the same — a named contributor who brings a working group, a written deliverable and public/private convening — but the subject is charging infrastructure rather than plant-floor control systems.
The tradeoff is scope.
Every post focuses on EV charging, chargepoints and critical national infrastructure; none covers safety PLCs, IEC 62443, IT/OT segmentation, process safety or incident response on an operating site—the core of Derek Harp's posts.
The posts also show no teaching format, faculty bench, recurring session series, registration or learning-platform mechanism.
A training partner would need to bring its own education design.
Two posts are a thin basis for judging delivery capability.
Choose Andy Elizaire when the education product is aimed at enterprise security leaders and focuses on how AI changes security operations.
Read more
The two posts address that audience directly: one argues that AI is changing everyone's job rather than removing it, processes events faster but does not understand a business's risk tolerance, and leaves people, process and technology to decide outcomes.
The other reframes ransomware from a backup and endpoint problem into a decision-speed problem across identity, endpoint, network, cloud and email, with 24/7 response as the test.
Both end with a direct question to the reader, making them suited to a webinar or roundtable where the panel is expected to answer, and name specific product directions a partner could build a session around.
For a partner whose product is AI-in-security-operations education for CISO-adjacent buyers, this is a closer audience match than industrial control systems material.
The tradeoff is the loss of the industrial control layer.
Neither post mentions OT, ICS, PLCs, plant floors, process safety or IEC 62443, so an OT/ICS education program would need to be rebuilt rather than extended.
The content is also product-anchored: the posts discuss Sophos Fusion, Sophos MDR and AI-driven security operations.
A training partner would need to address that in co-branded material to keep sessions from reading as a single-vendor pitch.
Only two posts are shown, both conference commentary and opinion rather than evidence of a teaching or course cadence.
Choose Sandra Roberts when the buyer is a CISO or board-level audience and the education program frames cyber risk in business terms rather than teaching control-system practice.
Read more
The posts are built for that conversation: one explains quantum computing risk, the harvest-now-decrypt-later pattern, and why board and executive continuity matters when CISO tenure runs under three years.
The other lists five CISO priorities — demonstrating business value, adapting to AI, data security and privacy, security-conscious culture, and regulatory compliance — with a linked source for each.
Each post offers a short, ordered argument a moderator could put to a senior audience, and both point to further reading rather than a course.
For a partner whose product is aimed at executives who approve spending, this is a better starting point than practitioner training.
The tradeoff is that neither post touches industrial control systems, operational technology, plant floors or incident response on physical operations, making an OT/ICS education partnership a topic transfer rather than a fit.
The posts show no course, event series, faculty roster, registration route or other delivery mechanism, and the arguments rely on linked external sources rather than firsthand operating detail.
Ask for examples of how this framing would hold across a longer series.
This profile draws on the full text of seven LinkedIn posts by Derek Harp, along with descriptions of topics, work, audience and partnerships based on those posts.
The posts are event and course promotions, a summary of a joint government advisory on PLC-targeting threats, and commentary on IT/OT risk assessment and manufacturing security.
Posts from three other creators are compared in the similar-creator and alternatives sections, and a follower count of 23,426 observed on 23 October 2026 supports the audience section.
The posts have no publication dates, so their order and any change in emphasis over time could not be established.
Derek Harp's posts do not document signature books, shows, or earlier career history, and no performance metrics, audience demographics, sponsorship pricing, or partner terms are published.
These details remain unknown rather than settled facts.
