The threat is operational. The org chart isn't.

An open port on a freezer controller, left open since commissioning. Three departments pointing at each other across a conference table. This month's OT security headlines – refrigeration controllers found exposed on the public internet, analysts warning that AI-assisted attackers can already manipulate industrial controllers and move robotic equipment – detonate on kit that operations runs, maintenance calibrates and IT has never walked past. I have sat in that meeting. Fifteen years ago the accused department was called quality, the escape was a scratch on a Class-A surface, and the room behaved identically: everyone present, nobody responsible.

Quality's old disease, security's new outbreak

For most of the twentieth century, quality was a department at the end of the line. It inspected, sorted and buried. The line built, shipped and forgot. The cure was never a bigger inspection department; it was ownership at the point of manufacture – standard work, reaction plans, escalation tiers – with quality designing the system rather than guarding its exit.

I learned the same lesson on bare concrete. Handed a greenfield site and told to build a QA/QC department for what became a 900-plus-employee plant, I spent the first quarter discovering the real brief: not an org unit, an ownership design. Every control I kept inside my department became a bottleneck. Every control we pushed into line standard work became a sensor. QRQC discipline did the rest – containment inside the shift, root-cause direction within 48 hours, A3 for the systemic fix – and defect costs came down 70%. None of it happened in the quality office. It happened at the line, because that is where the failure mode lives.

You cannot departmentalise a failure-prevention discipline. Left in a department, it decays into inspection.

You cannot inspect quality into a part, and you cannot patch security into a plant. Both are properties of the work, not of the department.

Why the governance gap is structural, not budgetary

A recent industry analysis found the same persistent gaps in manufacturing cybersecurity – accountability, funding and operational priorities pulling apart. Read that as a quality man and it stops being a cyber story. IT owns the patch but not the uptime. Operations owns the uptime but not the network. Finance owns the cost of downtime and books every patch window as pure loss. Nobody owns the failure. In our vocabulary that is a nonconformance with no report: an escape that happened not because detection was impossible, but because no role on the chart carries the detection point. In twenty years of PFMEAs I have never once seen "unauthorised access" listed as a failure mode, though it stops a line as dead as any broken tool.

The gap is not budgetary.

Investors have just put €7 million into a company whose entire pitch is unifying engineering data, OT security and process safety. The ISA/IEC standards world is writing the requirement that functional safety and cybersecurity be assessed together – a quiet admission that the plant is one system. Tools are arriving. Standards are arriving. Ownership is not. The org chart still files PLCs, robot cells, drives and refrigeration controllers under assets that operations runs and IT connects. The freezer controller did not attend the governance workshop.

The quality operating model, ported to OT

Don't build a parallel bureaucracy. Run OT security through the operating model quality spent forty years proving.

Put security deviations through NCR and 8D. An open port, a default password on a robot cell, a patch six months overdue – log it as a nonconformance with containment, root cause, corrective action and an effectiveness check. A security exception is a deviation without a nonconformance report. Close that gap first.

Respond at QRQC speed, not committee speed. Containment in hours. Verified cause in days. Countermeasure validated by the person who raised the flag. When attackers can probe OT pathways with AI assistance, a committee that meets monthly is not governance – it is another open port.

Escalate on structure, not heroics. The quarter I ran with zero critical customer escalations was not built on talent. It was built on tiered reviews, defined reaction times and escalation triggered by facts rather than volume. The same tiering absorbs a suspected compromise: who stops the cell, who isolates the segment, who calls the customer – decided on a quiet Tuesday, not during the incident.

Merge the audits. Extend the IATF 16949 and AS9100 internal audit programme with IEC 62443 zones and conduits. Your auditors already walk the floor and already know the asset map. Give them one checklist, one findings log, one corrective-action system instead of three stacked audit trails nobody reconciles.

My ethical-hacking work taught me the one lesson that transfers whole: attackers do not read org charts. I hold the CEH certification and a name on a telecom's public bug-bounty hall of fame for a clickjacking disclosure, and the mindset is the same craft as PFMEA – map the failure path before it finds you. Attackers treat the plant as a single connected system, from the maintenance vendor's remote portal to the robot cell, and their path never once crosses a reporting line. The defenders' structure should mirror the attacker's map, not the finance director's.

Treat a compromised controller exactly as you treat a suspect dimension: stop, contain, find the system cause, verify the fix. The headlines call it a governance gap; the floor would call it an escape. Security is not IT's quality problem – it is quality's next territory, and the org chart is the first thing that has to change.