Scenario: From 2014 to 2017, a malicious adversary breached the cyber defences of an oil and gas refinery using OT specific malware called Trisis or Triton to target the safety systems used for oil and gas production. After going undetected for three years by the oil and gas company’s security team, the attackers activated their malware to disrupt the refinery’s safety instrumented systems. But when the attack was deployed in the summer of 2017, an error in the malware caused the plant to shut down instead of causing significant physical damage and killing or severely injuring company workers as intended. Little did investigators know at the time that this failed attack was the first known cyberattack specifically aiming to kill people. Immediately following the attack, plant security personnel – and their third parties – did not consider the sudden shutdown to be a direct result of a cyberattack and, thus, did not investigate this possibility as a root cause in their analysis. Years of investing in IT security but without taking a specific approach to OT cyber protection left the organization unprepared to deal with the attack or conduct the investigation. Having failed to correctly recognize and block the ongoing cyber-breach threat, the plant went back into operation with the malicious actor still present. With the malware still active, a month later attackers made a second attempt to disrupt the refinery’s safety system, but this time attempted to shut down even more critical infrastructure; fortunately, the attackers again failed due to a different error. This time the plant’s security team requested support from OT specialists to investigate the shutdowns in greater depth. After the second investigation, security experts found that the plan’s OT systems were being manipulated. They discovered that attackers were maliciously manipulating OT network activity and took steps to secure the breach. Recovering from the incident and then restoring the refinery to full operation took over 70 days and cost tens of millions of dollars. This attack could have been detected with an OT-specific approach and with a rehearsed incident-response plan in place. Had these measures been deployed, the time lost and the impact of the OT-specific attack would have been significantly reduced. Key takeaways: Adversary errors prevented casualties in this incident, but board governance can – and should – make organizations more resilient against OT cyberthreats to critical safety infrastructure by taking an OT-specific approach to cybersecurity where appropriate. Attacks will happen as they cannot all be prevented, but organizations can also detect and respond, making themselves more resilient. After incidents, sharing information and lessons learned from past threats helps other organizations in the oil and gas value chain prepare.