OT/ICS Security Selling to the Plant Manager and CISO — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **OT/ICS Security Selling to the Plant Manager and CISO** is a 60-minute training for AEs, SEs, and channel managers running $250K–$2.5M ACV cycles against incumbents like **Claroty**, **Nozomi Networks**, **Dragos**, **Armis**, **Tenable OT Security**, **Forescout**, **Microsoft Defender for IoT** (CyberX), **TXOne Networks**, **Industrial Defender**, and **Honeywell Cyber Watch**. The session teaches sellers to qualify against the **three-buyer reality (CISO, Plant Manager / OT Operations, Chief Engineer)**, run a structured discovery on **asset-discovery and safety-impact economics**, demo against the customer's actual OT environment, and trap-set the multi-year renewal at month 18. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why OT/ICS Security Selling Is Different (5 min)

Open the room by killing the IT-seller default. OT/ICS deals are sold to **engineers who think in availability and safety**, not confidentiality. The Plant Manager will reject any solution that risks downtime. The CISO is secondary in the technical evaluation.

Set the frame on the whiteboard.

- **Three buyers, one safety thesis.** CISO funds; Plant Manager / OT Operations gates the deal on downtime risk; Chief Engineer signs off on protocol compatibility. **Dragos's 2026 customer survey** shows 81% of OT deals stalled by Plant Manager veto.
- **Passive asset discovery is non-negotiable.** Active scanning crashes PLCs. **Claroty, Nozomi, and Dragos** lead on **passive network-tap-based discovery** with zero traffic injection.
- **Safety impact dominates security risk.** A ransomware attack on IT is a business interruption; on OT, it's a **physical safety event**. **Colonial Pipeline 2021** and **Norsk Hydro 2019** are reference cases.

End the segment with **Mark Roberge's** rule: *"Sell the safety preserved, not the asset count discovered."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your OT environment — plants, PLCs, HMIs, SCADA, historian. What's the IT-OT boundary?"
> 2. **Asset-discovery baseline (10 min):** "How many OT assets does your team officially inventory vs. What you suspect actually exists? **30%+ shadow OT** is typical."
> 3. **Protocol coverage (10 min):** "Which OT protocols do you need covered — Modbus, DNP3, Ethernet/IP, Profinet, OPC UA, BACnet, IEC 61850? Most enterprises need **5+ protocols**."
> 4. **Passive vs. Active scanning (10 min):** "Active scanning crashes PLCs. **Passive, network-tap-based discovery** is the modern bar — and your Plant Manager will require it."
> 5. **IT-OT integration (8 min):** "How does OT signal flow to your IT SOC? **Claroty xDome** and **Nozomi Vantage** lead on IT-OT data flow."
> 6. **Vendor-specific posture (7 min):** "Which OT vendors dominate — Siemens, Rockwell, Schneider, ABB, Yokogawa, Honeywell, Emerson?"
> 7. **Renewal posture (5 min):** "When is your current OT-security contract up? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CISO + Plant Manager + Chief Engineer?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[Asset Discovery + Protocol 20 min]
    E --> F[Passive Scanning + IT-OT Flow 18 min]
    F --> G[Vendor + Renewal 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[Passive Tap Deployed at One Plant in 14 Days]
    I --> J[Joint Plant Manager Review at Day 30]
    J --> K[Bind Decision at Day 60]
```

---

## Section 3 — The POC That Wins (15 min)

**Failure modes to ban.** **Sample-PLC POCs.** **Active scanning.** **30-day POCs without Plant Manager sign-off.**

**Wins to coach.** **Passive network tap at one plant.** Walk through **Claroty's and Nozomi's published POC agendas** — both deploy a passive tap at one production plant in under 14 days. **Asset inventory delivered.** Deliver a **shadow-OT inventory** within 7 days. **Safety risk assessment delivered.** Map discovered vulnerabilities to safety-impact ratings.

End with **Andy Paul's** rule: *"Show the Plant Manager their safety risk reduced, not your detection count expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **Claroty**, **Nozomi Networks**, and **Dragos** in eight of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The protocol-coverage wedge.** Ask the Chief Engineer: *"Does your incumbent natively support all your OT protocols — Modbus, DNP3, Ethernet/IP, Profinet, OPC UA, BACnet, IEC 61850?"*

**Counter-move 2 — The vendor-specific wedge.** Ask: *"Which OT vendors does your incumbent deeply support — Siemens, Rockwell, Schneider, ABB? Vendor-specific knowledge matters for protocol nuance."*

**Counter-move 3 — The safety-impact wedge.** Ask the Plant Manager: *"Does your incumbent map

OT/ICS Security Selling to the Plant Manager and CISO — 60-Min Training

Direct Answer

Section 1 — Why OT/ICS Security Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

OT/ICS Security Selling to the Plant Manager and CISO — 60-Min Training

Direct Answer

Section 1 — Why OT/ICS Security Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

What does the score mean?