Operational technology security remains as difficult as ever, with even the best practice recommendation falling short.