OT incident response is moving in the wrong direction. The SANS 2025 ICS/OT survey data shows that detection, containment, and recovery timelines are getting longer, not shorter. In an industrial environment, that decline is not just a security problem; it becomes lost production, safety validation, customer impact, and executive scrutiny.

This practical session shows how to turn that problem into a defensible funding case. Using a representative manufacturing facility and the response stages of compromise-to-detection, detection-to-containment, and containment-to-remediation, we will quantify how OT incident response maturity changes expected loss, severe-event exposure, and residual risk.

Risk is delivered as a dollar value, that can be used with leadership to secure real funding to improve OT incident response.

Attendees will see how response-time improvements can be modeled as financial risk reduction, why containment often delivers strong early value, and why trusted recovery still determines resilience. The goal is simple: give ICS/OT practitioners a hands-on example, supporting data, and a reusable technical paper they can take back to leadership to justify improved OT incident response before the next incident proves the need the hard way.