This talk is a follow up to last year’s keynote on the unknown ICS threat landscape. We have learned a lot in the last year about ICS threats. 2017 was full of targeted adversaries and new tradecraft to watch out for in relation to securing industrial operations. In this presentation, attendees will learn about the various activity groups targeting the industrial sector and explore their tradecraft. There will also be a discussion on what ICS-specific threat intelligence is and how to take this knowledge and apply it in a meaningful way. We have a very defensible infrastructure, and with knowledge of adversaries and a focus on the human defender we can move from defensible to defended.