Design Out the Risk: The Cyber-Informed Engineering (CIE) Masterclass Stop reacting to threats. Start engineering them out of existence. In an era where digital threats have physical consequences, traditional "bolt-on" security is no longer enough. We invite you to a session on Cyber-Informed Engineering (CIE)—the framework developed to integrate security directly into the engineering design lifecycle. (pre-cursor to a more intensive option at the Level Zero Conference). This isn't just a lecture; it’s a toolkit handover. Whether you are managing microgrids, BESS, or complex gas compressor stations, you will walk away with the exact blueprints needed to bridge the gap between the control room and the boardroom. The Agenda Part I: The Paradigm Shift Meet the Architects: Introduction to the team leading the national transition toward CIE. The CIE Core: What is Cyber-Informed Engineering, and why is it the definitive answer to sophisticated infrastructure attacks? Battle-Tested: The CIE Case Study: A deep-dive post-mortem into how CIE principles transform vulnerable systems into resilient assets. Part II: Strategic Integration From Engineering to the Boardroom: How to connect CIE to Enterprise Risk Management (ERM). Learn the adoption pathways that secure executive buy-in and funding. The Implementation Roadmap: A guided discussion on applying these frameworks to your current cybersecurity program without reinventing the wheel. Part III: The Specialized Toolkit Sector-Specific Deep Dives: Tailored tool demonstrations for: Microgrids & BESS: Securing the distributed edge. Gas Compressor Stations: Protecting high-consequence kinetic environments. The Engineering Controls Database: A tour of the universal tools and general application libraries available to you right now. The Future—CMM for CIE: An exclusive first look at the upcoming Capability Maturity Model to help you measure and scale your organization’s resilience. What You’ll Carry Home By the end of this session, you won’t just have "information"—you’ll have capability: Total Clarity: A master-level understanding of CIE principles. Day-One Application: The ability to plug CIE directly into your existing security workflow. The CIE Vault: Full access to workbooks, tools, and the Engineering Controls Database. Direct Access: A directory of experts and resources for ongoing implementation support. Host: Derek Harp, Founder & Chairman (CS)²AI Speakers: Virginia “Ginger” Wright, Program Manager for Cyber-Informed Engineering (CIE), Idaho National Labs (INL) Benjamin Lampe, Instrumentation & Control Engineer, CIE Principal Investigator, Idaho National Labs (INL) Originally aired: March 18, 2026

Background: Cybersecurity risk has evolved from merely an IT issue to a core strategic and operational challenge, especially due to the convergence of IT and vulnerable, legacy Operational Technology (OT) systems. Recent, high-impact attacks (Colonial Pipeline, MWAA, Volt Typhoon) on critical infrastructure demonstrate that disruptions are inevitable and lead to severe financial, operational, and reputational costs, risking national economic stability. Objective/Hypothesis: Boards that shift from passive oversight to active ownership and integration of cyber resilience into enterprise strategy will significantly mitigate the financial and reputational costs of breaches, achieve sustained operations during disruptions, and leverage resilience as a source of competitive advantage and long-term growth. This includes the strategic use of cyber insurance and liability management to transfer residual risk and protect the balance sheet. Methods: The approach focuses on translating complex technical OT risks into board-level strategic actions. This is achieved through: 1) Cyber Risk Quantification (CRQ) (using Axio's expertise to express risk in dollar terms for informed decision-making and insurance optimization); 2) AI-Driven Simulation (using ThreatGEN-powered exercises to model realistic, tailored attacks); 3) Cross-Functional Collaboration (engaging boards, executives, and field teams); and 4) Continuous Feedback Loops to evaluate and update incident response plans. The process relies on an ecosystem of strategic partners for risk transfer, adversarial testing, compliance, and zero-trust solutions. Results: A resilient enterprise is defined by its ability to Sustain operations during an event, Recover quickly, Adapt based on lessons learned, and Grow market advantage by demonstrating superior risk management. The strategic use of CRQ and AI-powered exercises with a comprehensive continuous feedback loop secures board approval for investment and ensures that both internal defenses and external risk transfer mechanisms (insurance coverage and liability protection) are optimized and aligned with the organization's true financial exposure and risk appetite. Conclusions: Cyber resilience is a board-level fiduciary responsibility that encompasses both technical preparedness and comprehensive financial risk transfer. Boards must move beyond oversight to ownership, using quantifiable data to optimize cybersecurity investments, negotiate appropriate cyber liability insurance limits for first- and third-party losses, and position the organization to thrive in a volatile digital economy by turning preparation into a source of confidence and competitive strength. Host: Derek Harp, Founder & Chairman (CS)²AI Speakers: Shaun Six President UTSI Joe Carroll Chief Information Officer & Head of Cybersecurity, CITGO Scott Kannry CEO Axio Nick Jennings Vice President & Philadelphia Market Leader, Cyber Solutions Aon Originally aired: March 11, 2026

Do you have cyber skills and want to make a real impact? If you’ve ever wondered how the private sector could be better leveraged during major cyber incidents—or how you could play a meaningful role—this event was built for you. We are at a critical turning point. Incredible cyber capabilities exist across the private sector, government, and nonprofit communities, yet we still lack a unified framework to mobilize them effectively at scale. That changes now. Join us for a first‑of‑its‑kind experience focused on building a common Incident Command System (ICS) for cyber response through Civilian Reserve ISAC. At this event, you will: Learn exactly how ICS can transform your cyber response approach—and finally bridge the coordination gap between companies, government, and critical infrastructure partners. Discover how to earn nationally recognized credentials, preparing you to contribute confidently during real-world cyber incidents. Engage directly with CR‑ISAC leadership, the team building a nationwide civilian cyber reserve capable of supporting federal surge operations when it matters most. Gain clarity, connection, and mission-ready skills that allow you to step off the sidelines and into the arena. If you're feeling the urgency to get trained, get involved, and stand ready to help your community and country during a major cyber event—don’t miss this. Be part of the movement to build cyber resilience. Your skills matter. Your participation matters. The time is now. AGENDA 11:30a-12p - Intro and framing presentation o Megan Samford, VP, Chief Security Officer, Schneider Electric 12-1p - Govt angle on incident management using incident command system panel o Speakers: To be announced 1-2p - Private sector application of incident command system panel o Chuck Weissenborn, Chief Technology Officer, Dragos o Chris Sistrunk, Technical Leader, Mandiant (Part of Google Cloud) 2-3p - Framing of the future panel – what can be done in the USA, EU, MEA, Asia, etc to create global incident management structures o Mark Montgomery, Senior Director of CCTI and Senior Fellow Foundation for Defense of Democracies (FDD) o Bryson Bort, CEO and Founder SCYTHE, ICS Village, GRIMM o Vic Macias, Founder/CEO, Civilian Reserve-Information Sharing & Analysis Center (USAF, UMGC, CR-ISAC) Originally Aired: March 4, 2026

Exclusive first look at two new training courses that will equip your OT workforce with how to prepare and respond to a cyber incident As industrial environments become increasingly connected, the need for specialized skills in Operational Technology (OT) security has never been higher. Standard IT practices are no longer enough to protect real-time automation and SCADA systems. Many of you in the OT Cybersecurity industry are likely building out your OT monitoring solutions, either staffing up and building your own SOC or deciding to outsource your OT monitoring and SOC functions to a credible managed service provider (MSP). Knowing what to do to prepare for a cyber incident that impacts operational systems is another timely topic given the increase in connectivity between IT and OT systems and cloud adoption within the OT industry. Join us on January 21 at 1PM ET for a comprehensive 60-minute webinar featuring a panel of three industry-leading experts that will provide an exclusive first look at two new OT Cybersecurity training courses developed for instrumenting OT systems for monitoring, building out an effective OT SOC, and how to prepare your organization to respond to an incident affecting your operational control systems. The first 30 mins will focus on the topic of OT Monitoring and SOC, and Pollet, Visser, and Singer will use the first 20 mins to outline the highlights of this new 1-day training course coming to Level Zero and to a browser near you so anyone can take the course anytime, anywhere, on any device on-demand. The last 10 minutes will be left open for discussions and Q&A. The second half of the webinar will shift into the topic of Incident Response for OT systems. The three panelists will provide some highlights from this new 3-day deep dive training course for the first 20 minutes and leave the remaining 10 minutes for open discussions and Q&A. What You Will Learn: Part 1 - OT Monitoring & SOC: Building on foundational OT knowledge and testing methodologies, participants learn how to implement continuous monitoring, threat detection, and incident response capabilities for industrial control systems. This 1-day course covers OT-specific SIEM deployment, custom signature development for industrial protocols, security event correlation across IT/OT boundaries, and staffing models for 24/7 OT security monitoring operations. Part 2 - Incident Response for OT: Traditional IT playbooks can be catastrophic in an Industrial Control System (ICS) environment. When physical safety and operational uptime are the priorities, "unplugging" is rarely an option. Developed by three OT cybersecurity pioneers, this intensive 3-day course moves beyond data protection to focus on physical safety and operational resilience. You will learn to manage the full IR lifecycle—from preparation to post-incident hardening—while maintaining mission-critical systems under fire. Expert Insight: Direct access to our panel for Q&A and open discussion. Webinar Agenda (60 Minutes) Part I: Seeing the Threat – OT Monitoring & SOC (30 Mins) Course Overview (20 mins): Our experts will highlight concepts from this new course on topics including how to instrument your OT system for monitoring, how to setup an OT-specific SOC, the role asset discovery plays in incident detection and response, identifying anomalies in SCADA/ICS protocols, and how to use automation to build maturity into your SOC systems, policies, and procedures. Open Q&A (10 mins): Engage directly with the panelists regarding monitoring challenges and toolsets. Part II: Stopping the Threat – Incident Response for OT (30 Mins) Course Overview (20 mins): A deep dive into the unique constraints of OT Incident Response, including preparation, alert triage, determining whether patterns of alerts are due to normal operations or when to escalate and trigger the IR plan, containment strategies, safety considerations when responding to a cyber incident on the plant floor, communicating effectively with operations for a safe return to business as usual, safe recovery protocols, hardening OT systems post incident, and extracting key knowledge from lessons learned Open Q&A (10 mins): Discussion on building playbooks and coordinating between IT and OT teams during a crisis. Speakers: Jonathan Pollet, Marc Visser, Bryan Singer Originally aired: January 21, 2026

Did you attend this year's Level Zero Conference? Come, hear a panel of SMEs (two presenters and two senior attendees) discuss it - what took place, what they thought of it, and what they think about its future. Find out what you missed and what gems can be found in the recorded sessions. Were you able to attend the conference, either in person or virtually? Join us and share your own thoughts and experiences. Whether you were there or not, bring your questions about this, the first ever Level Zero ICS/OT Cybersecurity Conference, and provide us (and the conference steering committee) with input that will help shape the future of this vital and valuable learning and networking event! Aired Date: April 16, 2025