Cybersecurity Isn't A Retrofit—It's A Foundation

Forbes

21-07-2025

Ian Bramson is the Vice President of Global Industrial Cybersecurity of Black & Veatch.
For all the boardroom rhetoric about cybersecurity being a priority, it still gets short shrift in new industrial construction. Capital projects often ignore cybersecurity or include it in name only, relegating it to the status of an afterthought, something bolted on after construction. However, retrofitting cybersecurity into a live, connected environment can be expensive, risky and disruptive.
Why does this keep happening? It stems from a gap in the strategic planning phase. Engineers and project teams focus on cost control and schedules, so cybersecurity rarely gets treated like other operational technology (OT) systems in capital projects. Safety officers, for instance, help shape asset design from day one. Cyber experts deserve similar authority because cyberattacks can lead to safety failures that affect people, communities and the environment.
Misperceptions Around Cost And Scope
Some mistakenly assume that integrating cybersecurity early adds cost when the fact is that a security-by-design approach avoids costly retrofits and unplanned disruptions later on. Yet, when capital committees face tight financial scrutiny, they tend to treat anything that feels extra—especially something they don't fully understand—as a threat to the budget. So, if they choose to build in cybersecurity later at a higher cost or skip it altogether and face the consequences, those costs may not show up in the initial budget, but they will show up eventually.
Let's recognize that industrial cybersecurity is about more than protecting data; it's about protecting people, uptime and physical infrastructure. If a cyberattack compromises a valve or a safety mechanism, the results can be catastrophic, including environmental disasters, equipment failure and even loss of life. Although capital teams take these risks seriously, they don't view them as cyber risks.
Framing cybersecurity as a process safety issue changes the conversation. These teams already understand HAZOPs, failure modes and emergency protocols. Cyber fits directly into those same frameworks. It doesn't require a new language; it just requires translating cybersecurity into the language that capital teams already speak.
The Risk Of Assumption
The most dangerous assumption in capital projects is believing that 'someone else' is taking care of cybersecurity. Industrial builds include thousands of interconnected devices and systems from multiple suppliers. If nobody is looking at potential systemwide vulnerabilities, that's an invitation to trouble.
The owners assume the OEMs or the engineering, procurement and construction (EPC) contractor have it covered; the EPC contractor assumes suppliers and OEMs are locking down their equipment. But no one's really checking, and even when they do their part, it only covers one piece of the puzzle. New vulnerabilities are bound to surface once all the components are woven together.
Instead, we should think about protecting systems—including monitoring, asset management and segmentation—and move beyond just ensuring that an individual component is secure. We need shared accountability, where everyone does their part.
Ultimately, the owner must step up because it's their name on the line when something goes wrong. That means defining requirements immediately, embedding them into contracts, enforcing them during commissioning and validating them before handoff.
Bringing Cyber Into The Build
What does it look like to integrate cybersecurity into a capital project? It starts at the top, where your leadership must treat cybersecurity as a safety and reliability issue. When executives make clear that cybersecurity is nonnegotiable, it sets the tone for everyone involved. From there, project teams need a playbook to know where cybersecurity fits.
They need clear expectations: What does being cyber secure mean at pre-FEED, at FEED, at design review, during construction and commissioning and, lastly, handover? Spell it out in familiar terms. Translate cyber milestones into the stages that project teams already plan around. Procurement needs to play a role as well. Cyber requirements must be written into RFPs, contracts and vendor agreements. This includes specs for secure-by-design, clean build protocols and validation procedures.
Training is also essential. Capital teams don't need to become cybersecurity experts, but they do need to understand how cyber affects their world. A construction lead should know what insecure remote access looks like, and a procurement manager should be able to flag risky vendor practices.
Finally, cybersecurity must be verified throughout the project, not just at the end. That means testing during construction, requiring commissioning to include cyber validation and ensuring that the handoff process includes documentation of known vulnerabilities, mitigation measures and accepted risk.
Why Now?
Capital project teams can't afford to treat cybersecurity as tomorrow's problem. Consider the following:
• Attackers now use AI to scan for vulnerabilities, create tailored phishing attacks and automate exploitation at scale. If your adversaries are using AI and you're not, you're already behind.
• Digitalization is expanding the attack surface. OT systems are now connected to the cloud, enterprise systems and each other. Every new IIoT device becomes a potential entry point, and traditional isolation models break down.
• Regulatory requirements and standards around industrial cybersecurity are becoming more stringent. Compliance is becoming table stakes, whether it's the NIS2 Directive in the EU or the NERC CIP regulation in the U.S. Failing to integrate cybersecurity can now mean legal and financial exposure.
• Finally, the market itself is demanding better. Investors, insurers and acquirers scrutinize cybersecurity as part of due diligence. If a new asset isn't secure, it could affect the valuation or even derail the deal.
The Clear Message
The build phase is your one shot at complete visibility and control. After that, complexity explodes and your ability to make changes without disruption only gets harder. Waiting until the end isn't just inefficient—it's negligent.
Organizations that integrate cybersecurity from the start will be safer, more resilient and, ultimately, more valuable. So, don't start the discussions after commissioning a project or suffering a breach. Make this front and center, starting with the project strategic planning and capital committee table, when the stakes and opportunity are greatest.
Because in the age of AI, you can't afford not to build it right.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?