When the Grid Gets Hit: Inside OT Incident Response in Energy & Renewables

In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and special guest Derrick Bethea, NERC Compliance Manager and OT Cybersecurity Leader at Cypress Creek Energy, for an inside look at how utilities and renewable energy operators prepare for, respond to, and recover from cyber incidents.

Drawing on years of experience securing operational technology (OT) environments, Derrick explains why incident response plans must be tested—not just documented—and how organizations navigate the complex intersection of cybersecurity, regulatory compliance, and operational resilience. Joe explores how AI is changing both cyber defense and attacker capabilities, why legacy infrastructure presents unique security challenges, and how security-by-design and security-by-demand must work together to strengthen the energy sector.

Together, Joe and Derrick discuss:

• Why OT incident response differs from traditional IT security
• The realities of NERC CIP compliance and regulatory reporting
• How AI is accelerating vulnerability discovery across critical infrastructure
• Why security must be part of procurement and engineering decisions
• The importance of testing incident response plans before an emergency occurs
• How utilities can balance innovation with operational resilience

Whether you secure power generation, renewable energy assets, industrial control systems, or other critical infrastructure, this episode offers practical lessons for strengthening cyber resilience before the next incident occurs.