[B]Early and Strategic Cybersecurity Design is Essential for Cyber-Resilient Infrastructures[/B]

[Erkan Teskancan]

A new report by Black & Veatch and Takepoint Research reveals that operational technology (OT) cybersecurity in industrial capital projects is often implemented too late or not at all, increasing long-term risks and costs.

According to the report dated April 14, 2026, from Overland Park, Kansas, while OT and industrial control systems, which are critical for the smooth operation of energy, water, and industrial processes, are increasingly targeted, cybersecurity is not included in the early stages of the vast majority of industrial investments.

### "Secure by Design" Approach to Cybersecurity

The report emphasizes the importance of integrating cybersecurity early in the construction of new critical infrastructure. 72% of survey respondents stated that cybersecurity is either included late or not at all in the project development process. Data from over 450 property owners, critical infrastructure operators, and engineering stakeholders supports this finding.

Charlie Sanchez, President of Black & Veatch Infrastructure Consulting, states, "Cybersecurity should not be an afterthought; it must be integrated early into investment requirements and procurement decisions. If it's not included in the project scope, it won't be implemented. Cybersecurity is a critical factor for public safety, economic stability, and national resilience."

### Critical Security Decisions Must Be Made Early

The "secure by design" approach advocates that OT systems and industrial control architecture, network connections, and responsibilities should be determined at the project's inception. Once design and construction phases begin, making impactful changes to security often becomes difficult and costly.

Ian Bramson, Vice President of Global Industrial Cybersecurity at Black & Veatch, explains, "Security must be continuously validated throughout system design, acceptance testing, and delivery phases. As regulations advance, mere compliance is no longer sufficient. Leaders must go beyond minimum standards and design for long-term resilience."

### Other Key Findings

• 78% of participants state that early cybersecurity implementation reduces operational disruption in OT systems and networks.
• 43% cite a lack of expertise as a barrier, while 77% find significant external support important for starting early.
• Only 24% state that cybersecurity is always or frequently included early in industrial projects.
• 75% emphasize that a strong business case for adoption is the most important motivation.

The report and "Secure by Design" guide are available on Black & Veatch's website.

### About Black & Veatch

Black & Veatch is an employee-owned global engineering, procurement, consulting, and construction company with more than 100 years of experience, aiming to improve the quality of life worldwide by enhancing the reliability and resilience of critical infrastructure and energy assets.