The Dragos Industrial Security Conference (DISC) celebrated its tenth year in Hanover, Maryland, November 4-6, bringing OT asset owners and operators together for three days of OT and ICS security research, industry discussions, and hands-on training.
A lot has changed in OT cybersecurity since DISC began in 2017. Adversaries have continuously developed new capabilities designed to target industrial environments, the paths into those environments have become more complex, and AI is introducing new questions for defenders.
The conference has grown alongside the OT security community, but its purpose has remained steadfast in bringing the best and brightest OT cybersecurity professionals under one roof to discuss the evolving OT threat landscape and collaborate on the best practices for defending industrial systems.
Here’s a look at how we marked ten years of DISC.
There are hundreds of cybersecurity conferences around the world each year, and some of them are major flagship events like RSA, Black Hat, and DEF CON. However, there are only a handful that touch on cybersecurity topics relevant to the OT asset owner and operator, and DISC happens to be one such annual event.
DISC is a free, in-person technical OT security conference built for OT asset owners and operators. It brings together practitioners across electric, oil and gas, manufacturing, water, chemicals, public sector, and other industries with the Dragos teams responsible for identifying, investigating, and analyzing threats to those practitioners’ environments.
The focus is on technical research, firsthand findings, OT thought leadership, and lively conversations with people who understand the operational realities behind security decisions, in a safe environment where the OT community is center stage.
Sessions aren’t recorded or livestreamed. That format gives our researchers and attendees room to get unique insights that otherwise wouldn’t be available, discuss the evidence with the OT cyber threat experts directly, ask detailed questions, and explore challenges that don’t always have straightforward answers.
As one attendee put it, DISC is “practitioner focused and not a vendor circus.”
Every DISC has a theme, and for our tenth year, we chose “Origin Story.”
For many OT defenders, their origin story begins with a moment when traditional security assumptions didn’t hold up in an industrial environment. Maybe it was an asset missing from an inventory, a protocol existing tools couldn’t interpret, a patch management tool that didn’t account for operational uptime, or an unexpected connection into a critical system.
This year’s theme recognized the practitioners who work through those challenges every day.
Comic-book inspired artwork featuring refineries, transmission lines, water facilities, and factory floors filled the venue. A Wednesday evening reception brought the theme to life, with plenty of attendees joining in.
Wednesday: The Community
Wednesday brought customers together for industry-specific user groups across electric, oil and gas, manufacturing, and the public sector.
These sessions gave attendees space to compare how they’re using the Dragos Platform, discuss challenges specific to their environments, and provide feedback directly to the teams building it. This is critical feedback for Dragos because we want our products and services to be relevant, accurate, and effective for the OT community. Our customers have a voice, and this presents one of the most opportune moments in the year to ask questions, raise challenges, and provide distinct use cases that are incredibly helpful to everyone else in the room, whether they’re a Dragos customer or an OT engineer at a small electric power utility organization. That same spirit carried into the afternoon’s Dragos OT-CERT workshop, where members of our free community of more than 3,000 asset owners and operators led the conversation on the challenges they’re facing and what the program should take on next.
Thursday: The Research
Kurt Gaudette, Senior Vice President, Intelligence and Services, opened the mainstage before joining Robert M. Lee, Dragos Founder, Chairman, and CEO, for a keynote fireside chat on how the OT threat has evolved over the past decade. It’s one of the first times that Kurt has “formally” interviewed Rob, and anyone who has ever engaged with Rob or heard him speak knows that the conversation is going to be candid, inspiring, humorous, and authentic above all else. This is one of the best qualities of DISC.
The DISC audience brings deep OT expertise of its own. It’s why Kurt starts the Thursday sessions off with a reminder to “look to your left and to your right” and take advantage of the knowledge in that room.
Ten technical sessions followed, drawing on the investigations, threat hunting, analysis, engineering, and research our teams conduct throughout the year.
The discussions covered the changing OT threat landscape, AI capabilities and limitations, incident response lessons, insider threats, and the visibility and access challenges facing industrial organizations.
But the value of the mainstage goes beyond hearing the findings. After the presentations are finished, attendees can interact with the presenters and ask questions, examine how conclusions were reached, and consider what the evidence means for their own environments. In many cases, attendees will provide invaluable insight to the presenters that, on multiple occasions, has helped inspire additional related investigations and threat hunts.
Friday: The Practice
Friday closed out the week with hands-on Dragos Platform training through Dragos Academy. Two instructor-led courses ran side by side. Dragos Platform Essentials helped teams build their day-to-day workflows, from asset inventory and vulnerability management to notification management. Dragos Platform Analyst Training took experienced users deeper into the Platform’s architecture and how to apply threat hunting techniques inside it.
Having our instructors and Platform experts at the same event as the researchers who presented on the mainstage means questions can get answered by the people closest to the work. It’s also a chance for us to see customers using the Platform in real time: where they move quickly, where they get stuck, and what they wish it did differently. That feeds back into how we build both the product and the training, the same way Wednesday’s user group feedback does.
One of the most valuable parts of DISC happens between the scheduled sessions.
It’s hearing how an organization approaches a problem we’ve investigated elsewhere. It’s a question from an engineer that challenges an assumption in our research. Or a conversation with a customer about what actually works within the constraints of their operation.
Those exchanges inform our work long after the conference ends. They help shape intelligence reporting, detections, and Dragos Platform development, while communities like Dragos OT-CERT keep practitioners connected throughout the year.
Ten years in, and it feels like we are just getting started. That’s what keeps DISC worth building.
Thank you to everyone who joined us in Hanover, shared their experience, and helped make the tenth annual DISC possible and a memorable one.
If you own or operate OT, plan to join us at DISC 2027, November 2-4 in Hanover, Maryland. It’s free, it’s built for the people who defend industrial environments, and the technical sessions are led by the Dragos experts who track adversary tradecraft.
