Cyber Scheme Launches OT and PLC Security Training Courses

October 7, 2026

The Cyber Scheme has expanded its accredited training portfolio with new OT security training and PLC-focused penetration testing programmes, announced from Cheltenham, UK, on 7 October 2026. Participants will work on real industrial control system (ICS) hardware — programmable logic controllers, human-machine interfaces and specialist OT attack tooling — rather than slideware abstractions.

That distinction matters now. As factory floors, substations and water plants connect to enterprise IT, the firewall between a corporate inbox and a production line has largely dissolved. The professionals expected to police that boundary are usually trained on servers and cloud workloads, not on controllers that run physical processes.

Analyst Insight: Accredited, hardware-based OT training is a leading indicator, not a novelty. When a national certification body adds PLC attack labs to its public portfolio, it signals that OT skills have migrated from niche consultancy work into mainstream workforce planning — the same trajectory IT security followed two decades ago.

Why OT Security Training Is Suddenly a Boardroom Topic

Industrial environments were historically protected by obscurity and air gaps. Neither defence holds in a market where operators demand remote diagnostics, predictive maintenance and cloud dashboards on the same plant data.

The financial signal is unmistakable. Research houses now forecast the industrial control system security market expanding from roughly USD 18–20 billion in 2026 toward USD 28–38 billion by 2031, with growth rates quoted between 6.6% and 16.5% depending on the scope of definition.

Market Data: ICS and OT Security Spend, 2026–2034

ICS security market (MarketsandMarkets): USD 17.91 billion in 2026 rising to USD 38.48 billion by 2031 — a 16.5% CAGR.
ICS security market (Mordor Intelligence): USD 20.55 billion in 2026 reaching USD 28.37 billion by 2031 — a 6.66% CAGR.
ICS security market (Straits Research): USD 20.24 billion in 2026 reaching USD 34.51 billion by 2034, with Europe the fastest-growing region.
Attacker pressure: industrial organisations absorbed roughly 31% of ransomware attacks in a recent reporting cycle, with professional crews numbering around 80 tracked groups.
Consolidation: Accenture committed USD 4.1 billion to acquire OT security assets including Dragos, runZero and NetRise — a capital bet on industrial cyber defence.

Figures as reported by the respective research houses and industry trackers; definitions of OT scope vary between studies.

What the New Programmes Actually Teach

The portfolio splits into an entry path for IT professionals and a technical practitioner track. Both are built on the Hacktonics LINICS platform — a Linux-based distribution assembled for ICS security work — paired with Lab-in-a-Box industrial control system training equipment.

Course Specification: OT Security Testing – Foundations (1 Day)

Audience: IT security professionals new to OT and ICS environments.
Core content: introduction to ICS and operational technology, OT security case studies, and security testing methodologies for industrial networks.
Technical topics: asset discovery techniques and tooling, protocol and device vulnerabilities, and HMI exploitation demonstrations.
Practical work: exercises using industrial protocols, plus first contact with the LINICS environment and Hacktonics ICS training boxes.

Course Specification: Pentesting Operational Technology Systems – Practitioner (2 Days)

Audience: experienced testers and engineers moving into structured OT assessment work.
Core content: structured OT penetration testing methodology, asset discovery and vulnerability scanning in process environments.
Technical topics: security baseline assessment, industrial protocol exploitation, and PLC-based attacks.
Practical work: hands-on investigation of live control hardware to identify and demonstrate realistic vulnerabilities.

Market Trend: Training that stops at theory is being squeezed out. Buyers in regulated verticals increasingly treat hands-on lab content as a procurement filter, because an unvalidated tester who stalls a controller during an assessment creates liability rather than assurance.

Why Physical PLCs Matter More Than Simulators

A PLC is a deterministic device with cyclic scan times, latching logic and safety interlocks. None of those behaviours reproduce faithfully in a virtual machine, which is why the industry's serious training providers keep moving toward physical hardware racks.

Physical labs also force a discipline that software environments often skip: safe testing. Candidates learn to identify the blast radius of a scan or an exploit before running it, because a halted process is not a theoretical outcome in a lab wired to real I/O.

The Skills Gap Behind the Course Catalogue

The workforce numbers explain the demand. ISC2's most recent workforce study placed the global cybersecurity shortfall near 4.8 million unfilled positions, while a SANS 2026 report found 60% of organisations identifying skills gaps — not headcount shortages — as their greater problem.

Workforce Data: Where the OT Shortage Bites

Global cyber workforce gap: approximately 4.8 million unfilled positions in ISC2's last published workforce study.
Skills over headcount: 60% of organisations told SANS in 2026 that capability gaps outweigh staffing shortages.
Seniority squeeze: 27% of organisations report expert-level roles as the hardest to fill, versus only 4% citing entry-level difficulty.
Coverage gap: just 19% of organisations consider their teams fully skilled; 13% report gaps exceeding 30% of required competencies.

From IEC 62443 to NIS2: Compliance Is Driving the Syllabus

Regulation is shaping what OT training must prove. IEC 62443 defines industrial security requirements, NIST SP 800-82 guides control system deployment, and NERC CIP-013 and the EU's NIS2 directive push supply-chain and asset-level accountability into operator contracts.

The practical consequence is that vulnerability identification and baseline assessment have become documented obligations rather than optional good practice. Courses that map directly onto those tasks — asset discovery, protocol analysis, PLC attack surfaces — convert compliance pressure into individual competence.

Frequently Asked Questions

Who should attend OT security training?

Two groups benefit most: IT security professionals transitioning into industrial environments, and automation or control engineers who need to harden the systems they already maintain. The Foundations course assumes no OT background, making it the natural entry point for the first group.

Why is PLC security different from ordinary network security?

PLCs prioritise availability and deterministic behaviour over confidentiality. Traditional scanning and patching practices can disrupt production, legacy controllers often cannot be patched at all, and industrial protocols such as Modbus were designed without authentication. Assessment technique has to adapt to those constraints.

What are LINICS and Lab-in-a-Box?

LINICS is a Linux-based platform built for ICS security professionals, bundling specialist OT tooling with general-purpose cyber security utilities. Lab-in-a-Box refers to the portable industrial control system training equipment — PLCs, HMIs and related devices — that lets candidates practise on genuine hardware in classroom conditions.

Does hands-on OT training reduce organisational risk?

Indirectly, yes. Teams that can identify assets, test baselines and safely demonstrate exploitable weaknesses are better positioned to prioritise remediation investment. The measurable outcome is usually a faster, better-evidenced response to audit and compliance requirements rather than a single quotable metric.

The Bottom Line for Automation Teams

The launch is small in scale — two courses, one training partner, one certification body — but it marks a broader shift. Industrial cyber defence is moving from specialist consultancy into structured, accredited competence that plant engineers and security teams are expected to hold themselves.

For operators running PLC-driven processes, the strategic question is no longer whether OT skills belong in the workforce plan, but who inside the organisation holds them today.