In February 2022, a system administrator at an auto parts manufacturer rebooted a file server to resolve an unexpected file error. The administrator didn’t see the normal boot screens one might expect, but was instead greeted with a threatening message, providing the first sign that an active cyberattack was underway. The attack would continue to ripple through the automotive supply chain for days. By the time the full scope of the attack was discovered, this leading worldwide automaker was forced to suspend operations in 28 production lines across 14 plants, cutting global capacity by one third, representing hundreds of millions of dollars in losses. Today’s industrial networks are increasingly connected and vulnerable to OT cybersecurity threats. The costs of a cyberattack come in many forms, including expenses to restore lost data, repair or replace damaged equipment, compensate victims, and pay fines or legal fees. In industrial settings, however, the largest cost typically comes from operational downtime.