OT security does not sell like IT security

I built an OT sales business from nothing. No installed base, no reference, no playbook, no market that already understood itself as a market. Still working the accounts myself at the time, not as a manager.

That was when I learned that you do not sell security on the shop floor the way you sell security in IT. Not slightly differently, fundamentally differently.

The customer is a different person, even when the company is the same

In classic IT security you talk to people whose profession is security. The CISO, the head of IT, the security officer. They know the language, they know the threat picture, they have a budget that exists precisely for this. Their trade-off is security against usability.

On the shop floor you talk to people whose profession is availability. The production manager, the maintenance engineer, the plant manager. Their trade-off is security against downtime. And in that conflict, avoiding downtime wins almost every time, because it is measurable and can be expressed in euros per hour.

Anyone arriving with an argument that at its core says something could happen here loses against an argument that says something will happen here the moment you touch my machine.

The sentence that ends every conversation

There is one sentence I heard again and again in the first months. It runs roughly like this: the machine has been running for twelve years, it is not on the network, and if it stops that costs more than any incident you are painting for me here.

The sentence is usually only two thirds right. The machine has indeed been running for twelve years. It does indeed cost a lot when it stops. But it is almost never as isolated as the person believes, because at some point a remote maintenance connection was set up, a machine builder’s laptop gets plugged in regularly, or there is a Windows PC in the production line that IT does not even know about.

Only there is no point in claiming that. You have to show it.

Why inventory is the door opener

That is why the first step in almost every successful conversation was not protection but visibility.

The first OT reference in a regulated industrial environment that I won was built exactly that way. Two things: getting Windows endpoint management on the shop floor properly under control, and taking inventory of the Siemens S7 controllers and assessing them for vulnerabilities. The customer manufactured medical glass, so an environment where both regulation and downtime costs are high.

The value of that project did not lie in everything being secure afterwards. It lay in somebody having, for the first time, a reliable list of what is actually installed in that production hall, at which revision level and with which known vulnerabilities.

That list changes every follow-up conversation. Before it, you discuss probabilities. After it, you discuss one specific controller with one specific firmware level.

The line you must not cross

There is one thing you learn immediately in OT sales, or pay for very dearly: production must not get the feeling that IT is now moving into its territory.

That is not touchiness, it has reasons. The maintenance engineer is accountable for the availability of a machine whose manufacturer withdraws the warranty as soon as anything foreign is installed on it. A patch that is routine in the office world is, on the shop floor, a procedure that needs approvals, a maintenance window and, in case of doubt, the machine builder.

A vendor who walks into that environment and argues with IT self-evidence does not lose the deal, they lose the person. And without the maintenance engineer there is no OT project, however convinced the CISO may be.

What NIS2 changed, and what it did not

Regulation has made this business easier. It has not made it easy.

Easier, because a deadline pressure has appeared that comes from outside. Whoever is affected has to act, and the question is no longer whether but with what. That creates exactly the momentum that in sales makes the difference between a cold call and a welcome conversation.

Not easy, because selling on fear ages badly in this environment. Anyone using regulation as leverage may get a meeting and after that a procurement process optimised purely for producing evidence. That leads to projects nobody loves and that do not get extended the following year.

The reverse route works better: regulation is the occasion, while the actual conversation is about transparency, availability and about the maintenance engineer finally knowing what is standing in his hall. Then the project holds up after the deadline too.

What I took from this about building segments

Building it took time, and for most of that time there were no wins to show. Every follow-up, every further approach ended without a result or with a clear no. That was not pleasant, but it was a data point.

A new segment feels like poor performance in the first months. Usually it is just a market that does not yet understand itself as a market. Telling those two cases apart is the most important distinction a sales leader has to make in such a phase, and it decides whether a segment gets buried too early.

What helps is an honest separation: the customer is not ready. The timing was wrong. Or I was. Those three cases look identical from the outside and demand entirely different consequences.