Cyber resilience is often measured by how quickly an organisation can detect, contain and recover from a cyber incident. In operational environments, however, resilience starts earlier — with the ability to recognise what matters, connect information, and make sound decisions as a situation develops.

​

This was at the heart of the recent OT-ISAC Predictive Resilience Exercise conducted with Thailand’s National Cyber Security Agency (NCSA) and TXOne Networks in Bangkok last August 18, 2026.

​

The exercise brought together participants to work through a realistic, evolving operational scenario. Rather than focusing on identifying a particular attacker or malware, the exercise strengthened participants’ ability to identify critical signals, validate information, engage the right people, and determine actions that support both cybersecurity and safe operations.

​

The objective was not to predict the next cyberattack.

​​

It was to build Predictive Resilience — the ability to anticipate possibilities, recognise weak signals, challenge assumptions, and make better-informed decisions before the complete picture is available.

​

As one participant reflected:

“The design's refusal to anchor on a single attacker trains decision-making from actual evidence, not pattern-matching to known attacks.”

​

Building Decisions Around Evidence

Real operational incidents rarely arrive with a complete explanation of what is happening.

Information may emerge from security monitoring, engineering systems, vendor activity, operational observations, or changes in physical processes. Individually, these signals may appear insignificant. Together, they can tell a very different story.

​

The exercise encouraged participants to work from evidence rather than assumptions, continuously validating what they knew and reconsidering what they thought they knew as new information emerged.

​

It also demonstrated the value of bringing IT, OT, cybersecurity and operational perspectives together.

​

One participant observed:

          “This exercise can build knowledge between OT and IT people to focus more on security. It helps them understand each other in ways they might not have considered before.”

​

Another highlighted the value of seeing suspicious activity develop across sectors without relying on a traditional malware signature, providing insight into why detection and response increasingly need to bridge IT and OT boundaries.

​

What Participants Valued Most

Participant feedback consistently centred around five themes: decision-making under uncertainty; realistic, evidence-driven scenarios; stronger IT and OT understanding; facilitator expertise and shared best practices; and recognising that an OT cyber incident is ultimately an operational and physical challenge, not simply a digital one.

​

Rather than testing whether participants could find one predetermined “correct” answer, the exercise explored how teams arrived at their decisions.

What evidence should be prioritised? What requires further validation? Who needs to be involved? Which assumptions are influencing the response? And what could be the operational consequences of acting — or waiting?

​

These conversations are particularly important in OT environments, where cybersecurity decisions must also account for safety, availability and continuity of operations.

​

Turning Insights into Readiness

The exercise also surfaced practical opportunities for strengthening organisational resilience.

Participants highlighted the importance of greater visibility and traceability of vendor access and OT system changes, stronger logging and monitoring, better controls around shared accounts, configuration comparison capabilities, and clear escalation pathways across teams and sectors.

​

One participant captured an important lesson:

           “Organizations often confuse an approved login with a legitimate action — authentication is not the same as intent.”

 

A successful login may confirm that an authorised account has accessed a system. It does not necessarily confirm that the actions that follow are expected, appropriate or safe.

​

Understanding that distinction requires more than technology. It requires context, communication and collaboration between cybersecurity, engineering and operations.

​

Collective Learning as a Resilience Capability

Perhaps the greatest value of an exercise like this comes from bringing people with different responsibilities, experiences and sector perspectives into the same conversation.

​

An engineer may recognise an operational anomaly. A cybersecurity practitioner may identify unusual access behaviour. Another participant may challenge an assumption others have accepted. Someone from another sector may have encountered a similar problem and approached it differently.

​

Each perspective contributes another piece of the picture.

​

This is where collective learning becomes a resilience capability.

By sharing how different teams interpret evidence, validate information and make decisions, participants learn not only from the scenario but also from one another.

​

That collective experience can then be brought back into individual organisations — strengthening processes, conversations and readiness before a real incident occurs.

​

Building Readiness Through Practice

Predictive Resilience is not about predicting exactly when, where or how the next cyberattack will happen.

​

It is about preparing organisations for the reality that the next incident may not resemble the last one. Threat actors change. Technology changes. Operational dependencies change. But the ability to recognise weak signals, validate evidence, challenge assumptions, collaborate across disciplines and make informed decisions remains fundamental.

​

Exercises provide a safe environment to practise those capabilities before they are needed in a real operational situation.

And when those experiences are shared across a community, the value extends beyond a single organisation.

​

Predictive Resilience creates an opportunity to practise decision-making, share perspectives, and strengthen readiness across the community.

​

​