Skip to main content
Norwegian fjord with offshore rig, hydropower, substation and process plant
Lumiar

Industry must keep running. Safely.

Independent advice at the intersection of OT security, engineering, and business governance.

Discuss an engagement See what we do

When the consequences are physical

In an industrial plant, a cyberattack can open a valve, stop a pump, or disable a safety system. That’s why we treat cybersecurity as part of process safety, using methods the industry already trusts, such as HAZOP, LOPA, and bow-tie. The question is which barriers still work if the attacker is inside the control system.

Power plant
RISIKO · CYBER OG FYSISK KONSEKVENS
Fra cyberhendelse til fysisk konsekvens

Konsekvensen avhenger av hva den digitale handlingen kan få den fysiske prosessen til å gjøre.

Digitalt domeneFysisk domeneCybersikkerheten fortsetter forbi PLS-enDigital hendelseeller angrepKompromittertfunksjonStyringshandlingFysisk prosessFarlig tilstandFysisk konsekvensellerforretningskonsekvensSafetyMiljøProduksjonUtstyrKvalitetKonsekvenstyper
Digitalt domeneDigital hendelse eller angrepKompromittert funksjonStyringshandlingFysisk domeneCybersikkerheten fortsetter forbi PLS-enFysisk prosessFarlig tilstandFysisk konsekvens ellerforretningskonsekvensKonsekvenstyperSafetyMiljøProduksjonUtstyrKvalitet

Lumiar-synteseLumiar
RISK · CYBER AND PHYSICAL CONSEQUENCE

From cyber event to physical consequence

The consequence depends on what the digital action can make the physical process do.

Digital domainPhysical domainCybersecurity extends beyond the PLCDigital event orattackCompromisedfunctionControl actionPhysical processHazardous statePhysical orbusinessconsequenceSafetyEnvironmentProductionEquipmentQualityTypes of consequence
Digital domainDigital event or attackCompromised functionControl actionPhysical domainCybersecurity extends beyond the PLCPhysical processHazardous statePhysical or business consequenceTypes of consequenceSafetyEnvironmentProductionEquipmentQuality

Lumiar synthesisLumiar

When the decision must withstand challenge

Complex decisions don’t always stall because knowledge is missing. Sometimes there are several strong expert communities, different interests, or different views of risk, requirements, and what is good enough.

Lumiar can step in as an independent expert party, challenge the premises, and establish a stronger basis for the decision. This can give specialists and leaders the backing they need, and also help resolve deadlocked discussions and create progress.

LUMIAR-MODELL · BESLUTNINGER
Fra friksjon til fremdrift

Virksomheten tar beslutningen. Lumiar styrker grunnlaget for den.

EngineeringCybersikkerhetDriftLedelseLeverandør og partnerKrav og myndighetUavhengigutfordringAvklartepremisserEvidensBeslutnings-grunnlagFremdrift
PerspektiverEngineeringCybersikkerhetDriftLedelseLeverandør og partnerKrav og myndighetUavhengig utfordringAvklarte premisserEvidensBeslutningsgrunnlagFremdrift

Lumiar-synteseLumiar
LUMIAR MODEL · DECISIONS

From friction to progress

The organization makes the decision. Lumiar strengthens the basis for it.

EngineeringCybersecurityOperationsManagementSupplier and partnerRequirements and regulatorsIndependentchallengeClarifiedpremisesEvidenceDecisionbasisProgress
PerspectivesEngineeringCybersecurityOperationsManagementSupplier and partnerRequirements and regulatorsIndependent challengeClarified premisesEvidenceDecision basisProgress

Lumiar synthesisLumiar

What we do

MAIN OFFERING
Strategy and technical leadership
Direction, prioritization, and technical leadership for OT security, for management teams, projects, and operating organizations.
Read more →
Independent review and assurance
Second opinions, reviews, and independent challenge of recommendations, designs, bids, and decision documents.
Read more →
Risk and barriers
Cyber risk analysed with barrier methods from industry, with measures prioritized by consequence.
Read more →
Architecture and engineering assurance
Zones, conduits and requirements under IEC 62443, and independent verification that the solution can be built and operated.
Read more →
Assurance, verification, and compliance
Independent assessment against IEC 62443, Offshore Norge 104, NIS2, CRA, and CER. Documented so it can be verified.
Read more →
Capability, training, and exercises
Training, building OT security teams and exercises for emergency management and top management.
Read more →
Industrial AI
Advice on adopting AI where it adds value, and on the limits where errors can have physical consequences.
Read more →

When the problem requires continuity

Some issues can’t be contained in a single analysis or a short project. Lumiar can contribute over time with strategic advice, technical leadership, and independent sparring, with clear roles, responsibilities, and agreed capacity.

Read about ongoing advisory

How we work

1

Understand what is at stake

Don’t start with the technology. Understand the consequence, the decision, and why the issue has become difficult.
2

Challenge and clarify

Test premises, requirements, risk, and existing recommendations against engineering, experience, and relevant standards.
3

Make the decision workable

Translate the analysis into options and recommendations that both specialists and management can use.
4

Follow up until it works

Don’t stop at the report if the organization needs help with implementation, alignment, or further follow-up.
RISIKO · PRIORITERING
Konsekvens først

Start med det som ikke må skje. Finn deretter det som ikke må svikte.

VolumdrevetKonsekvensdrevet10 000 enheter3 000 sårbarheterPatch, herd og overvåk?Uakseptabel konsekvensEssensiell funksjonTroverdig scenarioAngrepsvei og avhengigheterBarriererSårbarheterMålrettet tiltak
Volumdrevet10 000 enheter3 000 sårbarheterPatch, herd og overvåk?KonsekvensdrevetUakseptabel konsekvensEssensiell funksjonTroverdig scenarioAngrepsvei og avhengigheterBarriererSårbarheterMålrettet tiltak

Basert på IEC 62443-3-2:2020 (ZCR 2.1 og 5.3) og Offshore Norge 104 rev. 7 (CSBR 2, krav 2-2, og anbefalt kritikalitetsvurdering).

Lumiar-synteseLumiar
RISK · PRIORITIZATION

Consequence first

Start with what must not happen. Then identify what must not fail.

Volume-drivenConsequence-driven10,000 assets3,000 vulnerabilitiesPatch, harden, and monitor?Unacceptable consequenceEssential functionCredible scenarioAttack path and dependenciesSafeguardsVulnerabilitiesTargeted action
Volume-driven10,000 assets3,000 vulnerabilitiesPatch, harden, and monitor?Consequence-drivenUnacceptable consequenceEssential functionCredible scenarioAttack path and dependenciesSafeguardsVulnerabilitiesTargeted action

Based on IEC 62443-3-2:2020 (ZCR 2.1 and 5.3) and Offshore Norge 104 rev. 7 (CSBR 2, requirement 2-2, and the recommended criticality assessment).

Lumiar synthesisLumiar

When Lumiar can make a difference

We have two expert teams that assess this differently.
The supplier says the solution is good enough. We’re not sure.
We need to stand behind this recommendation to management.
The project can’t move forward because no one wants to accept the risk.
We need an independent assessment before we choose a solution or supplier.
We need a technical basis that also holds up with clients or regulators.

We start with the issue and find the right way of working from there.

Discuss an engagement

The sectors we work in

05 SECTORS · SAME PRINCIPLE
OIL AND GAS Offshore and onshore Safety systems, process control, and telecoms, offshore and at onshore plants.
POWER AND GRID Generation and supply Hydropower, wind, and grid. Security of supply rests on the control systems.
MARITIME Vessels and ports
LAND-BASED PRODUCTION AND INFRASTRUCTURE Process, buildings, and critical services
FOOD PRODUCTION Lines and cold chains

Oil and gas, power, maritime operations, and food production share many of the same challenges, and much of the same solution.

Kenneth Titlestad, founder of Lumiar

Professional grounding

Lumiar was founded in 2026 by Kenneth Titlestad, who has worked with security in industrial control systems for more than 15 years.

Nine years at Statoil/Equinor, from IT infrastructure to OT and industrial cybersecurity
Built and led the OT security practice at Sopra Steria, and later served as CCO at Omny
Leads the working group in NEK NK 65 that works on IEC 62443 and handles it on behalf of Norway
International speaker, lecturer, and program lead
About Kenneth Titlestad →

Perspectives

PODCAST · THE INDUSTRIAL SECURITY PODCAST · 2025
Credibility, Not Likelihood (episode 140)
On credibility rather than likelihood in risk assessment of high-consequence attacks, with the Norwegian shelf as the backdrop. In English.
Open →
REPORT · HAVTIL (NORWEGIAN OCEAN INDUSTRY AUTHORITY) · 2022
Protection of data at rest and in transit
Project report for the Norwegian Ocean Industry Authority on protecting data at rest and in transit in the petroleum sector: complex supply chains, risk ownership, and governance. In Norwegian.
Open →
ARTICLE · TEKNISK UKEBLAD
Oil and gas: the pace of security work must pick up quickly
On the status and pace of security work on the Norwegian shelf. In Norwegian.
Open →
All perspectives →

We do not sell technology and have no product ties. Read how we handle collaboration and potential conflicts of interest.

Independence and collaboration →

Do you have a specific need, or just a question?

Tell us briefly about your needs, and we’ll take it from there.

Discuss an engagement