We work with Dragos fairly regularly, they're solid. The main problem is that people who even consider the security or integrity of these systems are brought in

We work with Dragos fairly regularly, they're solid. The main problem is that people who even consider the security or integrity of these systems are brought in years after they were specced, built, and more or less abandoned as built. The contractor and integrators then move on to the next project and copy what they did last time. Rinse , repeat. We've been actively pressing for realistic security and access control planning in the contract stage, but that's slow going in and of itself and still only affects new or upgraded installations -- on facilities with an expected lifetime of 10-30 years.