Back to case studiesBuilding OT & IT capability, from classroom to control room
Five years of practical IT training: curricula built from real infrastructure, delivered in three languages, certification juries that measured capability — from classroom to the factory floor.
5
years of training programs + exam jury work
3
languages: English · French · Arabic
Context
Before the factory floor came the classroom. For five years I built and delivered IT training programs — practical courses designed around real systems rather than slides — and sat on certification exam juries. The audience was broad: students entering the field, and working professionals doing in-service training. The goal was never knowledge transfer for its own sake; it was whether the person could configure, troubleshoot, and secure real infrastructure on day one of a real job.
The problem it fixes
Most IT training in the region was slide-heavy and lab-light. Students passed exams but couldn't configure a switch from scratch. Professionals knew theory but froze when a production network behaved unexpectedly. The gap between certification and capability was wide enough to drive a security incident through — and in factories, that gap becomes a production risk. The training market rewarded pass rates; the job market needed people who could actually build and run infrastructure.
The idea: train on what you will operate
Courses built backwards from day-one job tasks. Teaching sequences designed as activities, not lectures: network configuration on real Cisco hardware, systems administration on live machines, troubleshooting scenarios that fail the way production environments actually fail. Each module ended with a practical assessment — not a multiple-choice exam, but a configured, tested, working system. The standard was simple: if the learner can't operate it afterward, the training didn't work.
Curriculum design
Three tracks: networking (Cisco CCNA/CCNP aligned but built around real topologies), systems administration (Windows Server and Linux on live machines), and security (firewall configuration, access control, monitoring on actual appliances). Each track had prerequisite chains — you couldn't tackle security before you could build the network it protects. Lab environments were sized for individual work, not shared demos: every learner touched real hardware, broke it, fixed it, and documented what they did. The lab was the classroom.
Delivery in three languages
English, French, and Arabic — which matters more than it sounds when the factory floor speaks a different language than the security policy. Technical accuracy had to survive translation: French for the Moroccan professional market, Arabic for teams who needed to understand procedures in their operational language, English for the certification track and international vendor documentation. The same concept taught three ways, each adapted to how the audience actually works.
Certification juries and quality
Sitting on exam juries meant evaluating not just whether a candidate passed, but whether the exam measured what the job needed. The jury work reinforced the training philosophy: certifications should prove capability, not just attendance. The feedback loop was tight — exam results highlighted where curricula needed adjustment, and real-world performance of graduates validated whether the training actually transferred to the workplace.
How it transfers to OT
The same principle carries into industrial security work: no operator learns a secure habit from a poster. Instruction only sticks when it happens on the real equipment, in the routine the person actually lives. That is the foundation of the awareness tracks INOPSIO runs inside plants — walk the floor, watch how work happens, then train against that reality. The classroom-to-floor pipeline I built for IT training became the model for OT capability building: real equipment, real scenarios, measured by whether the person can perform afterward.
Results
Generations of engineers who could configure, diagnose and secure real infrastructure on their own — measured not in pass rates but in whether they delivered on a live network afterward. The training practice produced professionals who could join a team and contribute immediately, without a shadowing period. And a standard for myself: anything I recommend, I first prove I can teach someone to operate. That standard carried directly into the OT security work that followed.
Next steps
If your plant has no dedicated OT team — which most mid-size plants don't — capability building is a security control in itself. The gap between 'we have policies' and 'our people can execute them' is where incidents live. That gap is where the assessment call should start.
Similar case studies
IT/OT foundations across 100+ food plants worldwide
