People. Culture. Drift.

The Human Factor Shaping Industrial Cybersecurity

What if the biggest human risk in your industrial systems isn’t hackers, malicious insiders, or social engineering? But the slow, invisible drift in how we work?

Marco Ayala (InfraGard National Members Alliance / ABS Consulting) and I explore these often-overlooked deviations in everyday choices.

He calls this “DRIFT” — where workarounds become permanent, defaults stay unchanged, remote access stays on.

Each seems small on its own, but together they quietly reshape an organization’s security posture over time.

That’s where drift audits come in: spotting these small changes before they compromise operations, safety or security, because why wait to audit the damage when you can audit the drift?

[embed]

00:49 — Intro — Human drift in industrial cybersecurity?

• 01:32 — Apply the concept of drift in industrial control systems, to Human Behaviour.
• 01:53 — Human drift accumulates long before leaders notice.
• 02:34 — Traditional focus: monitoring systems, not human drift.

03:17 — What is drift?

• 03:47 — Small behavioural drift gradually becomes the accepted norm

04:36 — Examples?

• 04:42 — Example 1: Temporary PLC keys become long term security risk
• 05:23 — Example 2: Shared passwords
• 05:46 — Example 3: Excessive remote access quietly becomes normal.

06:26 — Legacy OT systems reinforce human drift?

• 07:04 — Strong cultures reduce drift despite identical technology and policies
• 07:55 — Defense-in-depth and segmentation remain key to operational continuity
• 08:40 — Audit drift early to improve, not blame
• 09:32 — Positive culture prevents drift before incidents occur

10:12 — Safety pressures drive security trade-offs?

• 10:38 — Behavioral-based cyber bridges safety culture and cybersecurity
• 11:22 — Leaders recognize the need for drift audits.
• 11:57 — Rethinking incentives & engineering culture
• 12:21 — Redesign so that the safest and most secure choice is the default.
• 12:46 — Formalize exceptions through management of change.

13:38 — Monitoring drift?

• 13:47 — Start small: pilot a drift audit in one facility
• 14:20 — Track drift with audits, KPIs and behavioral metrics
• 14:37 — Drift audits: opportunity to improve
• 14:57 — Unaddressed cultural drift threatens safety, security and production.

15:37 — Building the business case for drift audit?

• 16:05 — Pilot drift audits across representative facilities before scaling.
• 16:37 — Drift audits cost no more than traditional risk assessments
• 17:04 — Start small, measure drift, then scale based on evidence

17:54 — Use technology to track drift?

• 18:02 — AI identifies the people, processes & technologies driving organizational drift
• 18:33 — Start small and correlate drift with cybersecurity and operational events.
• 19:15 — Without monitoring, small deviations become tomorrow’s incidents.
• 19:48 — Humans remain the ultimate guardians of our infrastructure/ systems
• 21:02 — Small operational drift quietly creates tomorrow’s cybersecurity risks

21:24 — Drift: Looking ahead?

• 22:09 — Prioritize the Top 10 Findings, Fix the Top Three.

Marco (Marc) Ayala (ISA Fellow, InfraGard Houston | National Sector Chief — Energy, ABS CoE)

Marco (Marc) Ayala is a process automation professional with over 25 years of experience working in petrochemical facilities where he designed, engineered and maintained process automation, safety systems and integrated networks.

Marco is active in the oil and gas, chemicals industry, maritime domain, including offshore facilities. Mr. Ayala is an established and respected instructor for ISA cyber courses. He is a member and contributor to the AMSC Cybersecurity efforts as Chair, InfraGard member; Sector Chief of the Maritime Domain — Cross Sector Council for ports and terminals.

Recorded 22nd July 2026, 6pm, Singapore.