Today’s leaders understand that managing operational technology (OT) cybersecurity is more than a 24/7/365 job. Continuous monitoring and detection are indisputably critical but, more than that, the quality of the monitoring matters. It’s the team’s ability to quickly identify threats, potentially proactively, to reduce time to detection (TTD) that makes a difference. Understanding the highly complex nature of keeping critical infrastructure secure is critical to advanced threat protection. Security event triage, hunting in OT networks and responding to incidents must be performed by skilled industrial control systems (ICS) cybersecurity practitioners. Increasingly, asset owners and ICS operators understand that working with teams whose specialty is focused on OT cybersecurity — within critical infrastructure — is effective in keeping assets safe.