LightChange Technologies
    Electric transmission infrastructure at sunset
    Operational Technology Security

    OT security for the infrastructure that can't go down.

    For the teams that keep the power on, the water running, and the production lines moving, uptime is the job. We bring deep OT security expertise most teams don't have in-house, and we build it around the way your operation runs.

    Why OT is different

    When it comes to OT, security is not one size fits all.

    OT is not IT. A substation, a water treatment plant, a plant floor. None of them run like an office network, and none of them can be secured like one. When downtime means a community loses power or water, or a production line goes dark, the security model has to be built differently from day one. We have done this work for critical infrastructure operators across the continental US since 2004, which means we have seen what goes wrong and what holds up.

    The harder problem is what sits between your operational network and your corporate network. Remote access, cloud telemetry, vendor connections, smart meters, cellular backup. Every one of them is a path that most operators have never fully mapped. Finding and closing those paths is where we come in.

    • Availability comes first.In IT you patch on Tuesday. In OT you patch when the plant goes down for scheduled maintenance, and that might be once a year.
    • The equipment is often older than the threats.A lot of it was installed before cybersecurity was a field, so the protection has to happen at the network layer instead of on the device.
    • The auditors are paying attention.NERC CIP, TSA directives, state utility requirements, cyber insurance carriers. The questions keep getting more specific, and we build programs that pass the audit and reduce real risk, in that order.
    Diagram showing the many paths between an IT network and an OT network
    How many paths run between your IT and OT networks? Most operators can't say.
    What we do

    Four things that matter in an OT environment.

    See what's on your OT network.

    You can't protect what you can't see. We deploy network detection and response, map your OT assets, and identify the segmentation gaps between your operational and corporate networks. This is where most engagements start.

    Secure the connections in and out.

    Cellular failover for remote sites through our Cradlepoint and AT&T partnership. BGP security for the ISPs among you through Routing Shield, our MANRS-compliant platform. Firewall and zero trust design for the pathways between IT and OT.

    Build the program behind the tools.

    Tools without a program is how operators end up with twelve dashboards and no answers. Guardian Giant, our Cybersecurity Strategy as a Service, sits on top of the stack you already have, turns the alerts into board-ready reporting, and builds the maturity roadmap against NIST, CIS, or whatever framework your regulator cares about. Incident response planning and tabletop exercises included.

    Train the team you already have.

    Every engagement includes mentorship. Guardian Realm, our security awareness training, handles the human side. Our engineers handle the technical side. The goal is a more capable internal team, by design.

    Where you stand today

    Crawl. Walk. Run. Aligning your security to the risk you carry.

    Most operators are somewhere on this line already. The job is knowing where, and what the next honest step looks like. This is also the first thing an OT Readiness Review tells you.

    ReactiveProactive
    01Crawl

    Where you are

    Reactive and tools-driven

    Security happens when something breaks.

    • Antivirus and a firewall
    • Ad-hoc patching
    • No incident response plan
    What we do here

    Get you visibility. Assessment, asset discovery, baseline policy.

    02Walk

    Where you are

    Documented, but stretched

    Tools and process in place. Coverage uneven, team thin.

    • Incident response plan
    • MFA and partial segmentation
    • Some monitoring coverage
    What we do here

    Build the program. Governance, segmentation, monitoring, and training that sticks.

    03Run

    Where you are

    Governed and continuous

    A posture you can prove to a board or an auditor.

    • Continuous monitoring
    • Red and blue team exercises
    • Framework alignment
    What we do here

    Stay your strategic partner. Guardian Giant oversight, advanced testing, plain-English reporting.

    How we work

    We do the work with your team, and we teach as we go.

    • We train your team on what we're doing.Your engineers should come out of every project more capable than they went in. Dependency is not our business model.
    • You get direct access to the engineer doing the work.No account manager in the middle. The person you talk to knows your network.
    • We're transparent about what things cost.Hardware, licensing, labor. When a different approach saves you money, we say so.
    • We'd rather earn your business than lock it in.Most of our clients have stayed with us more than a decade, by choice.
    A LightChange field engineer inspecting equipment with a tablet
    Sectors we specialize in

    Built for utilities, co-ops, municipalities, and the teams that keep them running.

    We work across the 16 critical infrastructure sectors, with deep specialization in the operators communities run on.

    Electric utilities and cooperatives.

    Distribution co-ops, municipal utilities, generation facilities. SCADA protection, substation security, advanced metering infrastructure.

    Utilities

    Municipalities and county governments.

    City halls, public safety networks, fiber infrastructure. We serve the IT leaders and the administrators who back them up.

    Municipalities

    Water and wastewater authorities.

    Treatment plants, pump stations, remote monitoring. Pragmatic OT security built for small teams with big responsibilities.

    Water

    Manufacturing with OT exposure.

    Plant floors where IT and OT have already converged. Segmentation, monitoring, and incident response planning that works around production.

    Manufacturing

    ISPs and telecom providers.

    BGP security, IPv6 deployment, network infrastructure for the providers who keep their communities online.

    ISPs

    Energy and generation.

    Solar, wind, and traditional generation. Cybersecurity programs built for the compliance environment you operate in.

    Energy
    Common questions

    What operators ask before they call us.

    OT security is the practice of protecting the hardware and software that monitors and controls physical processes: the systems that run a substation, a water treatment plant, or a manufacturing line. It is different from IT security because OT systems prioritize availability and safety over confidentiality, and because much of the equipment in use today was installed before modern cybersecurity existed.
    IT security protects data. OT security protects physical processes and the people who depend on them. IT systems get patched on a schedule and replaced every few years. OT systems often run for decades and can only go offline during scheduled maintenance. The controls, the risk math, and the regulations are all different. A generalist firm applying IT playbooks to an OT environment usually adds more risk than it removes.
    LightChange does. We deliver OT security, managed cybersecurity, and network infrastructure to utilities, co-ops, municipalities, water authorities, ISPs, and manufacturers across the continental US. The work includes network detection and response, segmentation, firewall and zero trust design, cellular failover, BGP security, maturity assessments, incident response planning, and awareness training. We've done it since 2004, and we work the way operators need, around your uptime and your maintenance windows.
    Probably not the way it used to be. The fully isolated OT network is mostly a thing of the past. Remote access, cloud telemetry, vendor connections, smart meters, and cellular backup all open paths between your operational systems and the outside world, and most of them were never fully mapped. Finding and closing those paths is the work.
    Start with visibility, then segmentation, then a program you can sustain. You map what's on the network, separate the operational systems from the corporate ones, monitor the paths between them, and build governance and incident response around uptime instead of around an office IT calendar. Our Crawl, Walk, Run model lays out that path stage by stage.
    We work at the network layer and around your maintenance windows. A lot of OT equipment can't be patched or rebooted on demand, so the protection goes around it: segmentation, monitoring, and detection that don't touch the process. We plan changes for the windows you already have, and we never trade uptime for a checkbox.
    Any organization that operates industrial control systems, SCADA, or network-connected operational equipment. In practice that means utilities, electric cooperatives, municipalities, water and wastewater authorities, manufacturers, oil and gas operators, and transportation systems. If you're part of one of the 16 critical infrastructure sectors defined by CISA, OT security applies to you.
    Yes. On a plant floor, IT and OT have usually already converged, which means a security gap can stop a line. We handle segmentation, monitoring, and incident response for manufacturers, and we work around production instead of shutting it down.
    NIST Cybersecurity Framework, CIS Controls, CMMC, PCI DSS, HIPAA, and ISO 27001. For utility regulations we work with clients on NERC CIP alignment and state public service commission requirements. For water and wastewater we align with AWIA and EPA guidance. For ISPs we support MANRS compliance through Routing Shield.
    It's a scoped look at your OT environment: what's on the network, where the operational and corporate networks connect, and which gaps matter. It's the same diagnostic we walk through in a first conversation, and you come away with a clear picture of where you stand whether or not you work with us further.
    We're headquartered at 13000 Equity Place, Suite 205, Louisville, Kentucky 40223. We serve clients across the continental US. For critical infrastructure engagements, we travel where the work is.

    Have an OT environment you can't fully see into? Let's talk.

    Tell us what you're running and what's keeping you up, and you'll talk it through with an engineer who knows this world. If we're not the right fit, we'll tell you who is.