About

A daily brief for the people who run and protect industrial sites

Every morning, the people who keep plants, grids, water systems and factories running are expected to know what changed in industrial cyber security overnight. The information exists. It is just scattered, written for the wrong audience, and never mapped to the equipment they actually own. Industrial Cyber Brief, an AI-powered news site for industrial cyber security, fixes that one step: it reads everything, keeps what matters to industrial sites, and tells each reader what it means for their part of the plant.

The problem

Scattered

National CERTs, equipment makers' advisories, research labs, the security press: dozens of places to check, each in its own format, with the same story repeated and the important one easy to miss.

Written for office IT

Most security news assumes a laptop fleet and a patch window every Tuesday. A plant cannot reboot a controller mid-batch. The reader has to translate every item into "does this touch my site, and what can I do before the next shutdown?"

Not mapped to the plant

Nothing tells the reader where a story sits in their architecture, who in the organisation should pick it up, or how to check whether they are exposed. So triage becomes an hour a day for someone senior, or it does not happen at all.

The scale of it: CISA published 508 ICS advisories in 2025, a record; fewer than a quarter of the ICS flaws vendors disclosed that year got one; and 82% of those advisories were rated high or critical, so the score alone cannot say where to start (Forescout Vedere Labs, February 2026). Most fixes then wait for the next planned shutdown.

How it works, in five steps

The full rules, the sources and the corrections policy are on Methodology.

Read. Every morning the Brief reads about thirty public sources: national CERTs and agencies, equipment makers' advisories, research labs and the security press. The same story from several sources is folded into one.
Understand. An AI model reads each item and records what it says: is it about industrial systems, how severe is it by published rules, and does the source report exploitation. It is told never to guess.
Prioritise. The AI, checked by code, decides when to act: Act today, Plan ahead (for the next maintenance window) or For awareness. They use CISA's list of exploited flaws, FIRST's EPSS forecast, the CVSS score and where the product sits in the plant. The rules.
Explain. A second AI model writes each story in three facts from the source (what happened, who is affected, what to do) and the editor's reading, labelled as inferred: the Purdue level and why, who should act, how to check whether you are exposed, what to do until you can patch, what to watch for, and the ATT&CK for ICS techniques. Code checks every field before it is shown.
Deliver. By email every morning and on this site, with a printable before-the-patch worksheet for every story and an executive report for any day, week or month.

The value it brings

The goal is simple: the right person at an industrial site knows about the right problem early, and acts on it before the next shutdown. Five things make that happen:

Time. One read replaces the daily rounds of dozens of feeds.
Focus. A fixed rule says which stories need you before the next shutdown and which can wait, so attention goes where the risk is.
Readiness. Every story that needs action comes with a check for exposure, controls to hold the line until the patch, and something for the monitoring team to watch for.
Reach. Written in plant terms and tagged by role, so a story reaches the plant engineer, the OT security lead or the SOC that can act on it, not just the security team.
Evidence. The executive report shows leadership what changed, what needs action and why, for a day, a week or a month, and keeps a record of what was known and when.

How to see it: every executive report opens with From noise to action: how many items the Brief read, how many were about industrial systems, how many it published, and how many need action. A team can also check the claim on its own in two weeks: minutes spent on triage before and after, stories forwarded to a site that would not otherwise have seen them, exposure checks actually run, and anything learned elsewhere first. Every miss is treated as a bug in the sources or the rules.

Built on frameworks the industry already uses

The question	What the Brief uses
Where in the plant?	The Purdue reference model, as used by ISA/IEC 62443: from enterprise IT (L5) to the physical process (L0).
Is it being exploited, or likely to be?	CISA's Known Exploited Vulnerabilities catalogue, FIRST's EPSS forecast and the CVSS score the source states.
When to act?	Act today, Plan ahead, For awareness: loosely modelled on CISA's SSVC decisions and the Now, Next, Never approach to ICS patching.
What to do?	The editor's reading follows the NIST Cybersecurity Framework: Are you exposed? (Identify), If you cannot fix it yet (Protect), Watch for (Detect), and when to act (Respond).
How does the attack work?	MITRE ATT&CK for ICS techniques, so a story slots into existing detection coverage.

Who gets what

Reader	What they take from a briefing
Plant or asset owner	The bold product names, the Are you exposed? line and the compensating controls: what to check today and what to do before the next shutdown.
OT security lead	Severity, Purdue placement and the reason for it; which stories to forward to which site; a defensible record of what was known and when.
Detection engineer / SOC	The Watch for lines and ATT&CK for ICS techniques: new hunts and coverage gaps, in the vocabulary the SOC already uses.
IT security	Stories that start in enterprise IT (L4, L5) and reach the plant: phishing, remote access, software supply chain. The handover points between IT and OT.
Vendor or integrator	Advisories for the products they install and support, and the customers' likely questions before they are asked.
Leadership	The executive report for a day, a week or a month: the bottom line, what needs action and why, and questions to put to the team. Printable.

What it is not

It is not a vulnerability database, a vendor advisory, a threat-intelligence platform or a substitute for a site's own risk assessment. It is the daily reading layer on top of those: the thing that makes sure the right person opens the right advisory on the right day. The disclaimer says this in full.

Where it goes next

OT security is a small community, and the plants it protects keep power, water and production running. The more of the people who run them get the right information early, the more resilient the whole system becomes. The Brief is built to grow with that in mind:

More readers, no extra effort. The pipeline runs unattended in the cloud; one more reader needs no extra work. Self-service sign-up and the weekly edition make it easy to join.
Closer to each site. My site already marks the stories that name the vendors and products a reader runs. Next: vendor and sector pages built from the archive.
Into the tools teams already use. Every briefing is already published as structured data; next is a documented feed for SOC platforms and ticketing systems.

About Girder

Industrial Cyber Brief is published by Girder, an independent, non-commercial project in industrial security, built in personal time. It sells nothing and takes no advertising. Each project starts from a job that industrial security teams do by hand today and tries to make it quicker, with people still making the decisions.

Project	What it does	Status
Industrial Cyber Brief	Reads the news for industrial sites each morning and says who should act, and how soon.	Live

To keep up with new projects, check girder.in, where each one is listed as it starts. The Brief carries no advertising or sponsorship, and sells nothing. Terms

Contact

Questions, corrections, takedown requests and ideas: email contact@girder.in. How corrections work