Cybersecurity Under Pressure podcast artworkCybersecurity Under PressureReal Attacks. Real Lessons.Subscribe
Real attacks. Real lessons.

Cybersecurity analysis and tools for engineering decisions.

Understand real incidents through sourced analysis and podcasts. Use free worksheets to identify evidence gaps, assign owners and prepare your next review.

For engineers, cybersecurity teams and decision owners across OT, automotive, rail, product and AI security.

Prefer a weekly briefing?

Antonio González in the Cybersecurity Under Pressure studio
Antonio González, PhD · Founder & Editor
Featured analysisSCADA · Session Authority · Gateway · 2 sources ↗

Ignition: When a Runtime Session Gains Designer Authority

A valid operator-facing session must not authorize engineering changes. The October 2026 Ignition advisory makes that separation a testable release decision, not merely a role-name assumption.

The decision

For an OT owner, a completed ticket needs the installed fixed version, cross-module Vision-session-to-Perspective negative test, authorized design positive test, production function check and the Gateway process's effective rights over databases and devices. If historical access cannot be resolved from logs, record the uncertainty instead of asserting a clean history. The broader lesson is that a session used for runtime work cannot be trusted for engineering just because both sessions belong to the same SCADA product.

Read analysis →
Explore the library

Start with your system or your decision.

Choose an operating context, or follow an assurance question across sectors.

Need to review a real decision? Choose from six free evidence worksheets →
OT access · SBOM/VEX · Automotive · IEC 62443 · CRA · AI Act

By sector

OT & ICSAutomotiveRailwayProduct SecurityAI SecuritySupply Chain

By decision

Recovery & AssuranceSoftware IntegrityIdentity & Remote AccessTrust BoundariesAll decisions →
New to CUP? Start here →
Latest analysis

Signals worth keeping.

All analysis →
IT · Payment Security · Third-party Risk

Arkéa: How Far Can a Compromised Provider Move Money?

A provider-linked attack enabled fraudulent transfers. The practical review is what a connected payment service can cause, which limits remain independent and how containment affects legitimate operations.

Read analysis →
SBOM · Tool Benchmark · Supplier Evidence

Three SBOM Generators, Three Different Claims About the Same Source

When tools disagree, the release question is not which vendor wins a headline benchmark. It is what artifact, dependency scope and identifiers the SBOM claims to describe, and which checks make that claim usable.

Read analysis →
OT & ICS · AI Security

Can a Connected OT AI Agent Be Revoked Safely?

A proposed OT test method for withdrawing AI-agent authority across active sessions, delegated identities, queued work and recovery, with independent enforcement and evidence.

Read analysis →
V2X · EEBL · Response Safety

MIRAGE: Signed V2X Warnings Still Need a Bounded Braking Decision

An enrolled vehicle can send a fabricated emergency brake-light message. The hard question is how to detect a false warning without suppressing a real one, and how to limit the receiver's response when detection misses.

Read analysis →
From the archive · OT & ICS

The Restart Bottleneck Is Not the Backup. It Is the Evidence.

Read analysis →
From the archive · Railway

When a Security Patch Collides with the Safety Case

Read analysis →
The podcast

One case.
More room
to reason.

Read the evidence and technical implications, or take the same case into the podcast for a deeper discussion of trade-offs and decisions.

Browse episodes
01
14 Oct · 33 min

The Integrator Is Part of the OT Trust Boundary

  • A secure tunnel does not constrain what an authenticated third party can change.
  • Integrator identities should be named, time-bounded, least-privileged and reconstructable after an incident.
  • Customer engineering data held by suppliers is part of the downstream attack surface.
→
03
9 Oct · 100 min

Cybersecurity Evidence Has to Stay Connected to Type Approval

  • CSMS, SUMS and vehicle configuration evidence support one approval argument rather than isolated compliance packages.
  • Software identity and update evidence need traceability to the exact approved vehicle baseline.
  • Changes should preserve authority, version and evidence continuity across OEM and supplier boundaries.
→
CUP original videos

One security question. A different format.

Short professional perspectives and technical briefings, published on our verified CUP channel. Choose the format that fits your time.

All videos →
Short video · 10 Oct 2026Software Updates: Signed software. Authorization required.Open in the video library →Weekly Brief · 10 Oct 2026Weekly Brief #10 | Evidence Has to Reach the Product DecisionOpen in the video library →
Free tools & worksheets

One review. A practical action plan.

Choose the decision in front of you. Identify missing evidence, assign owners and export a report to take into your next review.

Compare all six worksheets →

A supplier needs access to your plant.

OT remote access →

Review one supplier connection: who can connect, what they can change, when access ends and who can stop it.

You need to assess a vulnerability claim.

SBOM & VEX assurance →

Challenge one product-component-vulnerability claim and record the evidence, response owner and unresolved actions.

A vehicle change or update needs a review.

Automotive cybersecurity & updates →

Review one vehicle change or software update across engineering evidence, supplier responsibilities and the release decision.

You need evidence for an industrial system.

IEC 62443 system assurance →

Connect an industrial system boundary, accountable roles and implementation evidence to the operational acceptance decision.

You are preparing a product for CRA review.

CRA product readiness →

Scope one product and market activity, then review product security, vulnerability handling and reporting-readiness evidence.

An AI use case needs a deployment decision.

AI Act use-case review →

Define one AI use case, your role and the applicable pathway, then identify evidence gaps before a deployment decision.

Free · No account required · Fictional examples included. Entries stay in your browser; use non-sensitive references only. These tools organise evidence and actions; they do not certify compliance.

Looking for a comparison of the frameworks? Open the separate R155 & IEC 62443 evidence map →

Guided discovery

Follow a decision, not a feed.

Reading Paths connect incidents, engineering constraints and the next decision across the existing library.

Guided path · 5 stepsSecuring Internet-Exposed OTSee the reading plan →Guided path · 6 stepsSoftware Integrity & Product TrustSee the reading plan →Guided path · 5 stepsSupplier Trust & EvidenceSee the reading plan →

Browse all Reading Paths →

The Weekly Brief

Three real incidents. The engineering consequence. The decision that matters.

About five minutes, once a week. For OT, product security, automotive, railway and critical-infrastructure professionals who need evidence and decisions, not another alert stream.

Read Issue 14 →Browse the archive →