Patrick Miller sits down with Scott Kannry, co-founder and CEO of Axio, to work through cyber risk quantification as a security decision tool for OT and critical infrastructure. Scott came up in the insurance industry at Aon in the early days of cyber coverage. He founded Axio with Dave White to close the gap between a technical security program and a number a CFO and a board can act on.

The conversation stays practical. Why you start on the impact side instead of arguing about probability. How NERC CIP already thinks in consequence. Why the events that matter most are rare, huge, and short on data. How to compare controls, insurance, and compliance spend on the same dollar scale. What AI and quantum do to the "it will never happen" excuse. And a new D&O option for CISOs built on top of consistent quantification.

Full show notes, links, and the episode transcript are on the Ampyx Cyber episode page at ampyxcyber.com/podcast.

Topics covered:

• The founding of Axio and the insurance-meets-frameworks origin
• A short history of cyber insurance, from data breach to business interruption to cyber-physical
• The four loss categories Axio uses, first and third party, financial and tangible
• Coverage gaps for industrial facilities and the danger of assumed coverage
• Impact-first quantification versus probability-first modeling
• NERC CIP and consequence-only risk rating
• Fiduciary duty, duty of care, and defensible decisions
• Security decision support versus vanity security metrics
• The art and science of pricing control ROI
• AI and quantum, and why low-probability high-impact events deserve attention now
• A D&O insurance option for CISOs tied to consistent quantification

The Attack Surface You Eat: Cyber Risk in Food and Agriculture

Kristin King joins Patrick Miller to make the case that food cybersecurity is not food security, and that food and agriculture is one of the most under-defended corners of critical infrastructure. From precision agriculture and processing plants to aquaculture, zoos, and aquariums, they trace where the OT and ICS risk actually lives, why the regulatory floor is so thin, and how the threat range runs from opportunistic ransomware to nation-state targeting and agroterrorism.

Guest: Kristin King, founder and CEO of AnzenSage, CEO and co-founder of AnzenOT, host of the Bites & Bytes Podcast, and author of Securing What Feeds Us: Cybersecurity in Food and Agriculture (Wiley).

Full show notes and every source referenced in this episode: https://ampyxcyber.com/podcast/the-attack-surface-you-eat-cyber-risk-in-food-and-agriculture

Guest links AnzenSage: https://www.anzensage.com/ Bites & Bytes Podcast: https://www.bitesandbytespodcast.com/about Kristin King on LinkedIn: https://www.linkedin.com/in/kingmkristin Securing What Feeds Us (Wiley): https://securingwhatfeedsus.com/

Patrick Miller reconvenes with Joy Ditto (Joy Ditto Consulting) and Earl Shockley (INPOWERD) for a tour of the past two months in critical infrastructure policy. The episode opens on the administration's new National Cybersecurity Strategy and its six pillars, with focus on the openly offensive "shape adversary behavior" posture and the asymmetric risk it creates for asset owners likely to absorb retaliation.

The panel then digs into the pressures reshaping the bulk electric system: data center designation, cloud-hosted control centers running NERC standards while the underlying compute is unregulated, and the physics of computational loads that behave nothing like traditional load. Earl walks through the recent NERC Level 3 alert on large load connections, an unusually serious signal that industry processes are behind.

The discussion also covers April infrastructure executive orders that release funding but ignore cybersecurity, hyperscalers displacing utilities as the top buyers of bulk electrical equipment, the multi-agency zero trust in OT guidance, and CISA's leadership uncertainty after Sean Plankey withdrew his nomination. On the AI front, the group unpacks what Anthropic's Mythos and the Glasswing response mean for vulnerability discovery at scale, and why no OT vendors are on the Glasswing list.

Closing thoughts include Joy's note on satellite cybersecurity and a rare bipartisan Senate trip to China, Earl's emphasis that computational load is now an enterprise governance issue rather than a technical one, and Patrick's plea to stop making the adversary's job easy.

Topics covered

• The new National Cybersecurity Strategy and its six pillars
• Offensive cyber posture and the asymmetric risk to asset owners
• Data center designation as critical infrastructure
• Cloud control centers and the NERC 100-series standards
• Computational load, grid stability, and loss of system inertia
• NERC Level 3 alert on large load connections
• April infrastructure executive orders and the missing cyber language
• Supply chain shifts and hyperscalers as the top equipment buyers
• Zero trust principles for OT environments
• CISA Fortify guidance and CISA's current leadership status
• Anthropic's Mythos, the Glasswing response, and the OT vendor gap
• Satellite cybersecurity and bipartisan engagement on China policy
• Basic hygiene: get exposed devices off the internet