Do they? Ask literally any ICS security professional their main concern, it's "[organisation(s)] think a system is airgapped when it isn't". Whether a system

Do they? Ask literally any ICS security professional their main concern, it's "[organisation(s)] think a system is airgapped when it isn't". Whether a system is software-defined/hardware-defined, networked/standalone - these are not technically hard questions to answer, correctly. (No more so than, say, whether polymer O-rings will completely fail to do their job when cold.) That they're not answered correctly indicates a big communication issue, and whilst I'm sure management has much to answer for, I'm not sure engineers escape the blame for that either.