One of the problems is that SCADA has its own software culture <i>and</i> its own security culture. There are specialty SCADA security firms (for no good reason I can come up with) and it sometimes feels like software security research is progressing in parallel on two (or three, or four) separate tracks.<p>Industrial control software doesn&#x27;t get the attention that normal software does because it takes a specially-seasoned consulting sales person to get industrial software on the docket for a consultancy. The really good consultancies are overbooked anyways (the big 5 Internet firms buy consultant&#x2F;years the way smaller firms buy consultant&#x2F;hours), so there&#x27;s not much incentive for the best talent to get applied to these projects.<p>If Charlie Miller and Chris Valasek hadn&#x27;t gotten on stage in track suits to talk about car hacking, the same might be true of automotive, but now every consultancy wants a car-hacking practice.<p>I&#x27;ve managed a few energy-sector projects. The targets were really, really bad.