The Importance of Early and Strategic Design in Cyber-Resilient Infrastructure

[Erkan Teskancan]

According to a new report by Black & Veatch and Takepoint Research, Industrial Operational Technology (OT) cybersecurity is still being implemented too late in most capital projects. This situation increases risks and costs in the long run.

## Early Cybersecurity Strategy is Critical

The report, published on April 14, 2026, in Overland Park, Kansas, indicates an increase in attacks on OT and industrial control systems, which are critical for the continuity of power systems, water networks, and industrial processes. Nevertheless, 72% of participants state that cybersecurity is often integrated either late or not at all in project development.

Charlie Sanchez, President of Black & Veatch Infrastructure Consulting, says, "Cybersecurity should not be an afterthought; it should be integrated into the project from the beginning." He emphasizes that if cybersecurity is not included in the project scope, the project will be incomplete upon delivery.

## "Secure by Design" Approach

The report highlights the "secure by design" approach. It states that the most critical cybersecurity decisions should be made at the beginning of the project, when OT systems and control architecture are being shaped. As the design and construction process progresses, making effective changes to security becomes more difficult and leads to costly rework.

Ian Bramson, Vice President of Global Industrial Cybersecurity at Black & Veatch, says, "Security needs to be validated at every stage throughout the process. Regulatory compliance is no longer enough. Leaders must go beyond minimum standards for robust and long-term resilience."

## Other Highlights from the Report

• 78% of participants state that early cybersecurity implementation reduces outages and operational disruptions in connected OT systems.
• 43% see a lack of expertise as an obstacle, while 77% emphasize the advantage of starting early with external support throughout the process.
• Only 24% state that cybersecurity is often planned at the beginning of projects.
• Three-quarters of participants believe that the business case is the strongest motivator for adoption.

For detailed reports and resources, visit the Black & Veatch resources page.

## About Black & Veatch

A 100% employee-owned global company that has been providing innovative engineering, procurement, consulting, and construction services for critical infrastructure and energy projects to improve human lives since 1915.