(CS)²AI Podcast Show: Control System Cyber Security

Carter Manucy, Senior Director, Cybersecurity for NRECA, joins Derek Harp to trace a career that started with a Commodore 64 and his dad's ham radio. Carter talks about typing in games from a magazine, building computers from scrounged parts, running a bulletin board, and landing at the Florida Municipal Power Agency, where he became the go-between for an engineering network on Novell NetWare and an accounting network on Unix, replacing SneakerNet with something better. He explains how NERC CIP changed the work, why breaking down silos mattered more than any one tool, and the story of the power plant HMI computer the manufacturer said couldn't be repaired. Carter also shares how his definition of success has changed, why he moved to NRECA, how the cybersecurity maturity model and "cyber champions" help more than 900 cooperative utilities, and what he is watching next, including AI. They close with a few questions from Derek's creative ending.
Guest: Carter Manucy, Senior Director, Cybersecurity, NRECA Guest LinkedIn: https://www.linkedin.com/in/cmanucy/ Host: Derek Harp, Founder and Chairman, (CS)²AI Episode: 140
Chapters:
00:42 Welcome and introducing Carter Manucy
01:59 From Havre de Grace to Orlando
03:43 Commodore 64s, bulletin boards and Frankenstein computers
06:59 First jobs and learning what he didn't like
08:04 UCF, Fortran and bouncing around
09:34 From odd jobs to the Florida Municipal Power Agency
11:42 Silos, SneakerNet and one network
16:10 From dial-up to firewalls
18:44 NERC CIP arrives
21:07 Distrust between departments and the HMI nobody could fix
24:42 Success, impact and leaving the world a little better
27:12 Helping people, soft skills and unsung heroes
29:13 From FMPA to NRECA
31:43 Co-ops versus municipals
35:03 NRECA's 900 co-ops and the cybersecurity maturity model
38:34 Cyber champions for resource-constrained utilities
40:35 Who does cybersecurity? Job titles and career paths
43:12 What's next: AI and staying one step out
46:12 The creative ending
49:04 Closing and where to find Carter
Join us at Level Zero 2027 in Atlanta, on the Georgia Tech campus, where Carter will be speaking again.
Produced by (CS)²AI (Control System Cyber Security Association International).

Billy Rios, (CS)²AI Fellow, Cybersecurity Researcher, Author, & Co-Founder of QED Secure Solutions, joins Derek Harp for the audience Q&A after presenting his team's research on a connected wheelchair that was later recalled. Billy explains why the FDA's power to keep a device off the US market is the biggest stick in any industry, what a recall means when the problem is software, and why a manufacturer can't simply switch off a core feature to fix a flaw. They get into legacy "big iron" devices (Billy has bought a CT scanner and a C-arm), why the FDA's guidance works even though it isn't prescriptive, and how manufacturers' behavior has changed in about ten years. Billy also gives advice to researchers: bug bounties, making a living as an independent, how the CFAA and DMCA good-faith exception affect legal risk, and a plain-English explanation of side-channel attacks.
Watch the wheelchair clip: https://youtu.be/6-iBC5ugiSo
More from (CS)²AI on YouTube: https://www.youtube.com/@cs2ai
Guest: Billy Rios, (CS)²AI Fellow, Cybersecurity Researcher, Author, and Co-Founder of QED Solutions
Host: Derek Harp, Founder and Chairman, (CS)²AI
Recorded live during a (CS)²AI Online webinar on October 21, 2026.
Chapters:
00:42 Welcome from Trisha Harp and the wheelchair research
02:01 Who decides whether a manufacturer reports to the FDA?
04:44 Are manufacturers getting better? Why the FDA matters
08:43 The FDA's biggest stick: keeping a device off the market
09:16 What a recall means when the problem is software
11:15 Guidance that isn't prescriptive
14:16 Controlled vs. uncontrolled vulnerabilities, and the wheelchair dilemma
17:30 How the FDA process changed manufacturers
20:11 Legacy "big iron": CT scanners, C-arms and VBScript
24:08 Standards, secure by design and the "soup" analogy
26:10 Connected devices multiplying inside and outside the hospital
28:24 Advice for researchers: the 300 backdoor passwords and the PATCH Act
30:58 Bug bounties and making a living as a researcher
34:55 Legal risk: the CFAA and the DMCA good-faith exception
37:11 Side-channel attacks explained
38:56 Why only the FDA can do this 41:13 Parting words
Legal topics in this episode are Billy's views, not legal advice.
Produced by (CS)²AI (Control System Cyber Security Association International).

From Army Engineer to Critical Infrastructure Security with Marcus Sachs
Marcus Sachs, SVP and Chief Engineer at the Center for Internet Security, joins Derek Harp for a long-overdue conversation about how a civil engineer in the Army ended up securing critical infrastructure. Marcus traces his path from an unusual start across Alabama, Pakistan and Germany, through ROTC and the Army Engineers, to the events of the mid-1990s that gave rise to the formal term "critical infrastructure." He explains what Y2K taught the military about inventory and interdependencies, how far OT security has come since SCADA was the term of art, and the advice he would give people entering the field today. They close with the Enigma machines he brings to Level Zero and why technology alone never covers all the bases.
Guest: Marcus Sachs, SVP and Chief Engineer, Center for Internet Security Host: Derek Harp, Founder and Chairman, (CS)²AI
Chapters: 00:42 Welcome and introducing Marcus Sachs 02:24 An unusual starting point: Alabama, Pakistan and Germany 05:53 ROTC, the Cold War and early hacking in Germany 09:30 Choosing engineering and the Army Engineers 14:59 Fort Belvoir: staying behind to fix things 20:00 Physics, culture and new technology in OT 22:48 From civil engineering to cyberspace 27:31 Oklahoma City, PDD 63 and critical infrastructure 31:00 The 1998 intrusion, Y2K and the great inventory 35:48 How far OT security has come 40:51 Crossing paths: a Navy flagship and Haiti 42:34 Advice for people entering the field 51:20 Enigma machines and mechanical encryption 54:39 People, process and technology: the work never ends 56:36 Closing thoughts and thanks
Produced by (CS)²AI (Control System Cyber Security Association International).

From Conference to Change: Asset Owners on What They Actually Did After Level Zero
Asset owners from UPS, Southern California Edison and ExxonMobil get specific about what changed after Level Zero: a talk that became a deployed AI harness, a team member who went on to NIMS certification after the tabletop, and ideas borrowed across sectors. Christian Harter, Blake Gilson, and Brian Foster debate who should attend (almost everyone), how to prepare (don't just show up), why the hallway track matters most, and why more asset owners should take the stage. They close on AI: powerful, but it needs an operator.
Guests: Blake Gilson (IT Planning & Strategy Manager, ExxonMobil); Brian Foster (Grid Security – Enterprise Sr Advisor, Southern California Edison) Host/Moderator: Christian Harter (BISO OT & Director of OT Security and Engineering, UPS)
Chapters: 00:41 Panel introductions 02:02 What stuck from Level Zero 04:48 Bringing a team (UPS brought 16) 09:12 What actually changed afterwards 14:49 Send a group or one person? Budgets and training 19:28 Who should attend 23:12 How to prepare 24:38 The hallway track 30:11 What to preserve and grow: asset owner stories 43:19 Where AI ends and humans begin 49:40 A new class of worker
Recorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections."
Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back.
Questions: info@levelzeroconference.com · Sponsorship: sponsor@levelzeroconference.com Produced by CS²AI (Control System Cyber Security Association International).

Inside the Tabletop: What an Airport OT Incident Taught Us About Command, Cost, and Chaos
The team behind and inside Level Zero 2026's tabletop exercise breaks down what happened when an airport OT incident played out in real time. Derrik Oates and panelists from UPS, the Department of War, and the finance table walk through the ICS4ICS incident command framework, what it's like to be a first-timer when the pressure hits, why "keep your receipts" is real advice, and how to make sure exercise lessons actually change an organization. They also explain why the 2027 exercise becomes a dedicated full day.
Guests: Christian Harter (UPS); Donovan Tindill (DeNexus); Brad Willet (UPS); Daryl Haegley (United States Department of the Air Force) Host / moderator: Derrik Oates (UTSI)
Chapters: 00:00 Panel introductions 04:50 Why run tabletop exercises at all 08:48 The finance table: 'keep your receipts' 13:02 ICS4ICS sections and logistics 14:43 Decisions under fire 18:59 One voice: incident communications 20:46 Using the ICS4ICS framework anywhere 23:04 First-timer experience 27:45 Understand the problem before you fix it 30:30 Lessons learned and changes for 2027 35:20 Making lessons stick: ownership and after-action 40:56 Why practice matters: downtime and safety
Recorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections."
Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back.
Questions: info@levelzeroconference.com
Sponsorship: sponsor@levelzeroconference.com
Produced by CS²AI (Control System Cyber Security Association International).