EP 27 — Turntide's Paul Knight on Zero Trust for Unpatchable Production Systems

When manufacturers discover their IP and other valuable data points have been encrypted or deleted, the company faces existential risk. Paul Knight, VP Information Technology & CISO at Turntide, explains why OT security operates under fundamentally different constraints than IT: you can't patch legacy systems when regulatory requirements lock down production lines, and manufacturer obsolescence means the only "upgrade" path is a pricey machine replacement. His zero trust implementation focuses on compensating controls around unpatchable assets rather than attempting wholesale modernization. Paul's crown jewel methodology starts with regulatory requirements and threat actor motivations specific to manufacturing.

Paul also touches on how AI testing delivered 300-400% speed improvements analyzing embedded firmware logs and identifying real-time patterns in test data, eliminating the Monday-morning bottleneck of manual log review. Their NDA automation failed on consistency, revealing the current boundary: AI handles quantitative pattern detection but can't replace judgment-dependent tasks. Paul warns the security industry remains in the "sprinkling stage" where vendors add superficial AI features, while the real shift comes when threat actors weaponize sophisticated models, creating an arms race where defensive operations must match offensive AI processing power.  

Topics discussed:

• Implementing zero trust architecture around unpatchable legacy OT systems when regulatory requirements prevent upgrades
• Identifying manufacturing crown jewels through threat actor motivation analysis, like production stoppage and CNC instruction sets
• Achieving 300-400% faster embedded firmware testing cycles using AI for real-time log analysis and pattern detection in test data
• Understanding AI consistency failures in legal document automation where 80% accuracy creates liability rather than delivering value
• Applying compensating security controls when manufacturer obsolescence makes the only upgrade path a costly replacement 
• Navigating the current "sprinkling stage" of security AI where vendors add superficial features rather than reimagining defensive operations
• Preparing for AI-driven threat landscape evolution where offensive operations force defensive systems to match sophisticated model processing power
• Building trust frameworks for AI adoption when executives question data exposure risks from systems requiring high-level access