Writing on cybersecurity governance, risk management, and operational security in manufacturing.https://sten.eikrem.org/en-gbhttps://sten.eikrem.org/blog/cra-ce-mark-will-not-tell-you-what-you-bought/https://sten.eikrem.org/blog/cra-ce-mark-will-not-tell-you-what-you-bought/Seventeen draft standards now show what a CRA claim will consist of. The manufacturer declares its own scope, some requirements are handed to your environment, and for operational technology no standard exists yet.Wed, 02 Sep 2026 00:00:00 GMThttps://sten.eikrem.org/blog/business-resilience-interdependencies/https://sten.eikrem.org/blog/business-resilience-interdependencies/Business continuity plans and disaster recovery plans are not the same thing, and the interdependencies between business, IT and OT decide whether you pay for resilience up front or during the incident.Tue, 18 Aug 2026 00:00:00 GMThttps://sten.eikrem.org/blog/manufacturing-vm-problem-isnt-a-vm-problem/https://sten.eikrem.org/blog/manufacturing-vm-problem-isnt-a-vm-problem/Faster patching is the wrong investment for most legacy OT, because the supplier controls the calendar and the plant operator controls the change window. The money goes into compensating controls and into procurement.Fri, 31 Jul 2026 00:00:00 GMThttps://sten.eikrem.org/blog/supplier-lock-in-is-a-governance-problem/https://sten.eikrem.org/blog/supplier-lock-in-is-a-governance-problem/The system owner carries the security risk for the OT estate and mostly doesn't govern like it. The access restrictions were inherited from a build project where cybersecurity wasn't on the requirements list, and the aftermarket business model is what keeps them in place.Fri, 31 Jul 2026 00:00:00 GMThttps://sten.eikrem.org/blog/ai-broke-containment-to-cheat-a-test/https://sten.eikrem.org/blog/ai-broke-containment-to-cheat-a-test/Two OpenAI models escaped a sandboxed evaluation and hacked Hugging Face to steal the answer key for their own test. The AI is the headline, but the failure is older: a boundary that was assumed to hold, rather than proven to hold, did not hold. What that means for anyone signing agents into production.Thu, 23 Jul 2026 00:00:00 GMThttps://sten.eikrem.org/blog/certificate-signals-not-what-to-protect/https://sten.eikrem.org/blog/certificate-signals-not-what-to-protect/A certificate signals that you follow a recognised process. It won't tell you your risk context, or what your security programme should cover and what it shouldn't. That decision is yours, and it is the part that actually reduces risk.Fri, 10 Jul 2026 00:00:00 GMThttps://sten.eikrem.org/blog/ot-telemetry-soc-easy-part/https://sten.eikrem.org/blog/ot-telemetry-soc-easy-part/Chinna Botla's piece on integrating OT telemetry into enterprise SOCs gets the direction right. The harder part it understates is organisational. The automation teams own the assets, and detection only becomes response when the integration reaches the people who can act.Tue, 09 Jun 2026 00:00:00 GMThttps://sten.eikrem.org/blog/ai-in-your-business/https://sten.eikrem.org/blog/ai-in-your-business/The value of AI and its risk are the same feature: it acts without you scripting every step. You cannot control that decision yet, only what AI is allowed to do, and the controls that would change that are still a promise. So the question is not whether to deploy AI, but where you can afford the trade.Thu, 28 May 2026 00:00:00 GMThttps://sten.eikrem.org/blog/cyber-for-a-standalone-business/https://sten.eikrem.org/blog/cyber-for-a-standalone-business/A cyber programme for a newly standalone business should be dimensioned from its market position, management's actual intentions, and the mandatory floor. Not scaled down from the parent's programme. Here is the planning discipline that gets it right at the start.Tue, 26 May 2026 00:00:00 GMThttps://sten.eikrem.org/blog/risk-appetite-not-where-you-think/https://sten.eikrem.org/blog/risk-appetite-not-where-you-think/Most organisations confuse risk appetite with risk tolerance. Between the two sits governance, and almost nobody manages that gap. Here is why it stays open.Fri, 10 Apr 2026 00:00:00 GMThttps://sten.eikrem.org/blog/security-concepts-in-major-projects/https://sten.eikrem.org/blog/security-concepts-in-major-projects/Most projects treat security as a late-stage constraint. The system security concept, aligned to buy-build-run phases, makes it a business input from the start.Fri, 03 Apr 2026 00:00:00 GMThttps://sten.eikrem.org/blog/oti-score-response/https://sten.eikrem.org/blog/oti-score-response/Dale Peterson's OTI Impact Score addresses the industry signal problem. The partner it needs is organisational resilience, the ability to coordinate internally before communicating externally.Tue, 10 Mar 2026 00:00:00 GMThttps://sten.eikrem.org/blog/the-isms-beyond-the-certificate/https://sten.eikrem.org/blog/the-isms-beyond-the-certificate/Every organisation has an ISMS. Most of them don't have a management system. Here's the difference, and why it matters under NIS2.Tue, 03 Mar 2026 00:00:00 GMThttps://sten.eikrem.org/blog/dale-peterson-response/https://sten.eikrem.org/blog/dale-peterson-response/Dale Peterson asks where the evidence is that OT asset inventory reduces incidents. From building a global OT security programme across 40+ manufacturing sites, here are the answers.Mon, 02 Mar 2026 00:00:00 GMThttps://sten.eikrem.org/blog/recovery-targets-vs-reality/https://sten.eikrem.org/blog/recovery-targets-vs-reality/Recovery targets derived from a solid BIA are the right foundation. But five realities sit outside that formal scope, and they're where plans actually break down in practice.Tue, 24 Feb 2026 00:00:00 GMThttps://sten.eikrem.org/blog/vulnerability-management-ready-for-what-comes-next/https://sten.eikrem.org/blog/vulnerability-management-ready-for-what-comes-next/AI-driven vulnerability discovery is outpacing OT remediation cycles. What manufacturing security teams need to know about software composition visibility, response planning, and the growing gap between known and fixed.Thu, 19 Feb 2026 00:00:00 GMThttps://sten.eikrem.org/blog/security-concepts-bridging-risk-and-reality/https://sten.eikrem.org/blog/security-concepts-bridging-risk-and-reality/Without understanding the full system context, risk assessments default to compliance control catalogue validation. Security concepts, widely used in military classified systems, offer a better path.Sun, 08 Feb 2026 00:00:00 GMThttps://sten.eikrem.org/blog/cra-for-manufacturing-companies-in-europe/https://sten.eikrem.org/blog/cra-for-manufacturing-companies-in-europe/How new EU regulations reshape supplier relationships and procurement strategy, even if you don't manufacture digital productsFri, 23 Jan 2026 00:00:00 GMThttps://sten.eikrem.org/blog/control-frameworks-built-backwards/https://sten.eikrem.org/blog/control-frameworks-built-backwards/Most organisations start with standardised control catalogues and work backwards to justify coverage. Few start with business context, threat landscape, and actual vulnerabilities to determine which controls reduce risk and which waste resources.Tue, 20 Jan 2026 00:00:00 GMThttps://sten.eikrem.org/blog/outsource-work-not-accountability/https://sten.eikrem.org/blog/outsource-work-not-accountability/A Norwegian court case delivers a €5.6 million lesson on business continuity, supplier management, and why manufacturing executives can't outsource operational accountabilityFri, 16 Jan 2026 00:00:00 GMThttps://sten.eikrem.org/blog/governance-that-actually-governs/https://sten.eikrem.org/blog/governance-that-actually-governs/Most security governance is theatre. Committees that rubber-stamp, decisions that decide nothing, metrics that measure activity not outcomes. Here's how to build governance that actually works.Thu, 15 Jan 2026 00:00:00 GMThttps://sten.eikrem.org/blog/root-cause-hidden-risk-decisions/https://sten.eikrem.org/blog/root-cause-hidden-risk-decisions/Most cybersecurity incidents trace back to implicit risk acceptances hidden in everyday business choices. The hardest root causes to analyse are those buried in decisions we never understood we were making.Wed, 14 Jan 2026 00:00:00 GMThttps://sten.eikrem.org/blog/cyber-insurance-renewal-tips/https://sten.eikrem.org/blog/cyber-insurance-renewal-tips/Threshold-based IR coverage, pre-approved suppliers, and using preventative services strategicallyFri, 09 Jan 2026 00:00:00 GMT