Subscribe
Share
Share
Embed
Hector Perez, Head of Strategy for Black & Veatch’s Industrial Cybersecurity practice, talks to Elizabeth Corner about digital twins, predictive analytics, and emerging AI tools, highlighting how siloed data, legacy systems, and unmanaged digital risk can undermine operational gains if security is treated as an afterthought.
Sponsoring this episode of the World Pipelines Podcast is the World Pipelines CCS Forum 2026, taking place on 18 March, 2026 at the Park Plaza London Riverbank. This event will bring together pipeline experts and technology leaders to share their insights on the development of the UK’s CO2 pipeline infrastructure for carbon capture and storage initiatives.
Sponsoring this episode of the World Pipelines Podcast is the World Pipelines CCS Forum 2026, taking place on 18 March, 2026 at the Park Plaza London Riverbank. This event will bring together pipeline experts and technology leaders to share their insights on the development of the UK’s CO2 pipeline infrastructure for carbon capture and storage initiatives.
The CCS Forum offers an unmissable opportunity to join your peers and represent your organisation at the heart of the UK CCS discussion as we discuss the projects, technologies, and policies shaping this emerging sector. Find out more here: https://www.worldpipelines.com/ccsforum2026
Creators and Guests
What is World Pipelines Podcast?
The World Pipelines podcast, with Elizabeth Corner, is a podcast that connects and unites pipeline professionals to learn about issues affecting the midstream oil and gas industry.
Hello, and welcome to the World Pipelines podcast. I'm your host, Elizabeth Corner. Across the pipeline sector, we're seeing a shift. Operators want to move from reactive maintenance, responding to problems as and when they're detected, to predictive insight, getting ahead of the game. Operators are embracing tools such as digital twins, analytics, AI enabled asset strategies, and with all of that comes a new set of cyber challenges.
Elizabeth Corner:To help us understand what secure digital enablement looks like, I am joined by Hector Perez, head of strategy for Black and Reach's industrial cybersecurity practice. Hector arrives at the World Pipelines podcast mic with twenty years of experience at the intersection of OT cybersecurity, engineering, and digital transformation. Hello, Hector. Welcome to the podcast.
Hector Perez:Thank you, Elizabeth. Pleasure to be here.
Elizabeth Corner:In this episode, we're talking about some of the pipeline industry's pain points and how digital enablement and resilience strategies can help operators do their job. That's after a quick message from me. On the 03/18/2026, I'll be hosting the World Pipelines CCS Forum in London. It's a full day dedicated to The UK's c o two pipeline build out, connecting the dots between the scale of CCS network needed in The UK and how we'll make it a reality. We'll cover engineering challenges, integrity and maintenance opportunities, project progress and delivery insight, and regulatory support.
Elizabeth Corner:The speaker lineup includes National Gas, United Infrastructure, DNV, Baker Hughes, NE, SGN, Peritas International, and more to be announced. Go to www.worldpipelines.com/ccsforum2026 or search World Pipelines CCS Forum for more information. Thanks for listening. Let's get back to the episode. I'm so pleased to have you on the podcast, Hector, and I'll start by asking, from your vantage point in global industrial cybersecurity, what are the pain points for operators?
Elizabeth Corner:What are they dealing with or juggling as they manage their pipeline operations?
Hector Perez:Yes, one of the major pain points we are facing today is lack of integrated visibility into the assets. We typically see out there a lot of our pipeline customers, for example, different inventories. I have my maintenance inventory of assets and I have another inventory for my cybersecurity set of assets and then I have a different inventory for obsolescence planning. But yet, we are talking about the same asset. It's not three or five different assets, it's the same asset, but it appears in siloed inventories of data and that lack of visibility of integrated visibility so I can see that one asset from all angles and all perspectives.
Hector Perez:That lack of visibility creates the decision blind spots. When is it best to invest in this asset for maintenance purposes, or should I just replace it instead of appliance and maintenance practices? So this lack of integrated visibility creates those decision blind spots, and that's a major pain point for Dave.
Elizabeth Corner:And how do pipeline operators think about digital risk today, and has that changed recently?
Hector Perez:Yes, digital risk as customers are upgrading and modifying old infrastructure, they're adding a lot more digital technology that has a lot more connectivity than the old technology used to have. I make an analogy to a lot of my customers all the time, imagine your pipeline facility used to be 10 of the old flip phones. All you could do with those is call somebody and maybe text, that's it. You're replacing those 10 old flip phones with 10 new iPhones, each one with 100 apps that talks to 100 different things in your house. The level of connectivity has exponentially increased, and when you increase the level of connectivity, you're increasing the attack surface potentially for cyber threats.
Hector Perez:So digital technology is great to provide you a better return on your investments, but it also adds that risk layer of increasing your attack surface. So what you want to do is, you do want to do those upgrades, you do want that connectivity, but at the same time and in conjunction with those efforts, you have to be thinking how do I mitigate risk from the go, from the design phase. Don't wait until you finish your upgrade or your modification and increase your level of technology and digital technology to then try and go and retrofit and mitigate the risk. You need to jump on the risk at the beginning when you're thinking about design phase of the digital technologies so that by the time it's built and you're achieving all that return on investment that you were hoping to achieve, the risk has been mitigated as part of the process, not as an effort.
Elizabeth Corner:I love that cell phone analogy and that really helps me visualize how the risk has scaled and changed. So help us understand what predictive analytics and digital twin technology can do in the pipeline sector.
Hector Perez:So a little bit of history before we get to the predictive analytics. In the old days, we would get data ever so often because telemetry is expensive, so it takes a while for us to get the data, especially in the pipeline industry. As technology gets better, we get more and more real time data, and then we include some edge analytics so that we don't have to transfer all that data to a centralized location so that it helps us. Having all that historical data with real time data, we can then start feeding that information into artificial intelligence type of analytics, predictive analytics that the historian allows us to see what all has happened in the past. Real time data technology today allows us to see what is happening today.
Hector Perez:If we feed both sets of data to a predictive analytics engine, that engine can learn, here's all the history, here's what's happening today. Based on all that information, I can predict what is going to happen in the near future. In the next week or two weeks, I can tell you which assets are most likely to fail and therefore you can take the mitigating actions at the right time, in the right place, for the right reasons. And it helps you plan your capital spending a lot better. If you have a 100 different assets that need some level of maintenance, this technology allows you to see which ones are the higher risk ones in terms of risking margins.
Hector Perez:And then you can prioritize those assets first. So predictive analytics is literally changing the game in how the industry is approaching spending into maintenance and mitigating risks in those assets.
Elizabeth Corner:How then does cybersecurity intersect with predictive analytics? Are we securing the tools that we're using as much as we're securing the physical assets that they monitor?
Hector Perez:Yeah, cybersecurity is the safety net of all those digital technologies that our customers are deploying. First of all, you have to have normalized data for all this analytics that you're going to have. A small change in a set of data can truly change the outcome predicted by those analytics. So that data must be secured from the get go so that you have a normalized, reliable, trustworthy set of data that is used by this engines to go and then take some actions. Analytics engines are getting to the age of agentic AI, which is artificial intelligence that can go take actions on your site.
Hector Perez:So if you give it a goal, agentic AI, you can say, Hey, I want you to minimize my power consumption, yet maintain the same flow rate. How are you going to do that? AI will look at the goal, make an initial assessment of where we are today based on the goal, and then create an action plan. Then it's gonna go look at all the different tools it has available to go and execute those actions, execute the actions, and then go make another assessment to see did I achieve the goal or not. All of these items rely on both a set of normalized data that it can rely on and that is trustworthy.
Hector Perez:But also imagine deploying this agentic AI technology in operations and somebody changes the goal. I want you to not just reduce my energy consumption and maintain the same flow rate. Imagine somebody changed a couple of lines of code and says, I want you to operate at the highest pressure possible. That literally puts the entire set of assets at risk just by changing a couple of lines of code. So these new technologies, it will provide you lots of benefits to the pipeline industry, but it has to be done with cybersecurity.
Hector Perez:Cybersecurity is at the intersection of doing it safely. Ultimately these assets are, you know, I'll take you through a little bit of history. In the beginning there was nothing. Somebody said, I want to build this asset because I want some return on my investment. That was the original purpose of that investment.
Hector Perez:So when you build this asset, you're expecting a return on investment, but at the same time you have to mitigate the risks that these assets bring to life just for the fact of being there. So as you're maximizing your return on investment, you have to be mitigating those risks. And this is where a lot of customers focus too much on the return on investment and they almost forget about mitigating the risks in conjunction and in parallel, not after the fact, but as you are deploying these technologies, cybersecurity has to be embedded within those technologies so that you are mitigating the risk at the same time that you are increasing your return on your investment.
Elizabeth Corner:So it's the counterbalance to everything that you're doing on the predictive maintenance side. You have to make sure that you're protecting the AI bit of the equation.
Hector Perez:Correct. You have to predict the AI because AI can make or break the plan that you have in place. Making or breaking that plan is as simple as taking the right steps to protect all the information and data and connectivity to those assets. But it has to be intentional, it has to be deliberate, it has to be part of the plan from the design phase. That's the only way you can do this properly and not having to retrofit later on what other technology is deployed.
Elizabeth Corner:And given all of that, when you talk about AgenTik AI, is that still where we're seeing the most transformation in the industry?
Hector Perez:I would say that is where the most future transformation will happen. It is not happening today. What I am seeing and talking to a lot of our contacts within customers within the pipeline industry is people and a lot of the executives are stuck in purgatory pilots. They are piloting these technologies and they're excited about the benefits that they can get out of it. And everybody in the teams are excited about, Oh, we can do this and we can do that and we can improve this and we can improve that.
Hector Perez:And they design and test this AI agent technologies to the point where they say, Yes, this is it. This is what is going to change the game for us. Now let's roll it out across the corporation and into operations. And this is where everybody reaches for the parking brake, emergency parking brake and say, Nope, we're not doing that. But why?
Hector Perez:What happened? Why are we not rolling out and getting all those benefits? A big reason for that is risk management. Everybody's afraid that this, you roll out an agentic AI that says, Hey, I want to maximize my energy efficiency. And to do that, the agentic AI, for whatever reason, thinks it's a great idea to bypass your safety system so it can achieve its goal.
Hector Perez:That is not a good thing. Everybody knows it's not a good thing, but it's a risk that could be there if the risk is not mitigated as part of the design process. Where I see your customers where they can get the most benefit of this type of AI is design it, but think about the risk in conjunction of the design, be mitigating those risks. And this is where the biggest change and shift in industry will happen here in the near future, deploying agentic AI. We're not there yet, but there's plenty of pilots happening where I know it will happen, it's just a matter of managing the risk.
Hector Perez:Not just cybersecurity, but operational risk and all this other risk that could be potentially embedded within those designs.
Elizabeth Corner:No, I can see why operators might feel more comfortable in a pilot situation because it's, you know, it's something that they're trialing, it's something that they're testing, but then you're right, if you've worked out that that is in fact going to be useful to you, then it's something that you must then go on to use. I want to talk a little bit about digital twin technology. Those are becoming quite central to things like asset life cycle planning. And I'm wondering how we go about protecting the fidelity of those models. What happens if a digital twin is wrong?
Hector Perez:Before I dig into that, digital twins, we have to be careful in how we go about digital twins. What I mean by that is a digital twin is a solution, but it could be the wrong solution depending on the problem that you're trying to solve. If I tell you today, Hey, have the greatest medicine here. You should buy all my medicine. You would say, What problem or what condition does it fix?
Hector Perez:I don't have an ear problem or an eye problem or a nose problem or whatever skin problem. What is this for? So digital twins can take different shapes and forms to solve different challenges or achieve different goals for different customers. So a digital twin, we have to be careful when we say digital twin because it's not a one shape and form for everybody, one size fits all. A digital twin, we have to be careful in how we go about that.
Hector Perez:Now digital twins, it's by definition a data mesh or merger of data about this one asset. We spoke at the beginning about having one asset, one identity when we have different inventories for maintenance, for cyber, for obsolescence planning and all of that is not different assets, yet we treat them as say there were different assets in different databases. So the digital twin is this one place where you can bring all this data for this one asset. If I'm looking at a pump, what is the rating specifications for that pump? What is the maximum temperature, maximum pressure that it can operate?
Hector Perez:How is this pump configured to run? What are the tuning parameters that may be involved within that pump? What is the maintenance schedule and maintenance records for that pump? Do I have a simulator to see how this pump is gonna function in different scenarios? And then all of this information can be fed into a predictive analytics engine which can tell me in the future how this pump will behave.
Hector Perez:That is the value that a digital twin brings to the customers in having all that information. If I'm an operator, I'm sitting in front of my screens monitoring and controlling this pipeline and I wanna know everything there is to know about this one asset because it's not functioning properly. I just click on it and all this data is readily available to me. Whereas today, without the digital twin, our data is in different databases. Anything maintenance related, it's a database in the maintenance department.
Hector Perez:Anything safety related, it's a different department with a different database. Digital twin aggregates all that information. The key to having a great set of data that is protected is you have to normalize all that data. It has to be the right asset with the right timestamps in normalization so that this data can be aggregated seamlessly for consumption of the operator that needs to see that data whenever it's needed in the operational sense. So all the data, you rely on it to make real time decisions.
Hector Perez:An operator sitting in front of it is going to change how that pump is operating to optimize the process, to troubleshoot an upset, whatever the case may be. They're making real time decisions based on this data. So it's critical that this data is trustworthy, is reliable, is protected so that this data is one source of the truth for this person making real time decisions about how safe this process is operating.
Elizabeth Corner:What advice would you give to operators trying to move from reactive integrity management to what we've been talking about a predictive digitally enabled one?
Hector Perez:I would say the biggest challenge that I see operators have is trying to do too much all at once. You cannot boil the ocean and expect to have good results. So pick one case scenario, one solid case scenario that adds a lot of value to you. Start with that one. Do it well with all the risk management embedded into it.
Hector Perez:Prove to management that this can add value and the value is easy to see once you have the model built and you can prove it in financial terms. This is how much this is worth And here's what we're doing to mitigate all the risks that are involved with rolling this out. Do one, do it well, and then scale fast. Once you prove that this is the right way to go about it, scale fast. So the biggest challenge is not doing and implementing those predictive analytics and moving into the future.
Hector Perez:The biggest challenge I see is trying to do too much all at once, and that doesn't go well typically. If you pick one, focus, scale fast, that is the customers that I have seen and operators that I have seen have the most success when they go about it in that methodology.
Elizabeth Corner:Okay, now my next question was going to be which practices or architectures do you consider essential for this kind of integrated digital environment? But perhaps what you're saying to me is it's not one size fits all, and that you should pick one, try that and then move on and scale from that.
Hector Perez:Yes, absolutely. If you go talk to an operator today, you talk to five different people and say, what is the most valuable thing you could potentially do with this technology? Three out of the five are going to agree on one thing. I don't know what that is for them, for their context and their scenarios, focus on that one. Let's do that one, do it well.
Hector Perez:Hunter with somebody that understands the engineering of assets and understands the operations of assets. This is important to know both sides. How are these things built? How are they constructed? And then operationally, how do they behave?
Hector Perez:Somebody that works on both sides of the house. You may have the resources internally, that's great, and if you don't, partner with somebody that can help you with the engineering and the operations side, and then do one and do it well.
Elizabeth Corner:That's great. My next question is: are operators too confident in their legacy systems? I'm wondering if nothing bad has happened yet is still one of the biggest barriers to investing in cybersecurity and so on.
Hector Perez:Yes, we are too comfortable with legacy systems. We have the mentality if it's not broken, don't fix it. But what we have to remember is when these assets were first built twenty, thirty years ago, cybersecurity was not a concern. So we built these systems with cyber risk, residual cyber risk embedded in them, and we have yet to address that risk. Just because we decide not to look for it, it does not mean it's not there.
Hector Perez:A cyber risk that we've built into this asset without the cybersecurity mindset is still there to this date. Now we have to make decisions as to what is the best way to address those residual risks. Do we want to rip and replace things? Do we want to patch things? Do we want to put some compensating controls to protect the perimeter around these assets and implement mitigating items that way.
Hector Perez:So that is the decisions that operators have to make today on their agent infrastructure. And the best way to do that is not by gut feeling. There are ways to go about making those decisions and the best way to do that is to implement factor analysis of information risk, the fear based analysis in which you quantify risk in financial terms. Say this risk is worth a million dollars of exposure per year versus this other risk is worth a $100,000 of exposure per year. If you have a finite amount of dollars available to make investments, you have to invest where you're going to get the biggest return.
Hector Perez:Now in this case is return on mitigation. You're not going to make more money, but you're going to mitigate risk. That is the return that you get by investing those dollars. But the only way you can make that decision is translate risk conversations into financial conversations by applying the right methodologies in making those translations of risk into dollars. Everybody in the board and executives understand dollars.
Hector Perez:I would argue that not all of us understand risk. Like how much risk is there? A lot. If you ask the different department, how much risk is it if they're trying to get their project funded? They're gonna say, Oh, my risk is bigger.
Hector Perez:How much bigger? Nobody understands that, but everybody understands that a million dollars is more than a 100,000. So to level the playing field and make sure you are investing in the right places, do this fair based analysis, translate risk into dollars, and then you can make decisions based on dollars and cents that will allow you to make better planning and better decisions as to where you invest that finite amount of dollars. I would say that is probably one of the reasons why we don't work on this aging infrastructure and we're so comfortable with our old technology and not upgrading and if it's not broken, don't fix it. But one, residual risk is there.
Hector Perez:Just because we don't decide not to look at it doesn't mean it's not there. It can come and bite you anytime today, especially with the threats going up. But if you're going to invest and fix it, invest in the right places. And the only way you can do that is translating risk into financial dollars.
Elizabeth Corner:Thank you so much for taking some time to talk to us.
Hector Perez:My pleasure. Thank you so much.
Elizabeth Corner:That was Hector Perez, Head of Strategy for Black and Veatch's industrial cybersecurity practice, talking about how pipeline operators need to quantify and assess risk within their systems, and how the integration and digital transformation of assets must be balanced with secure cyber practices. Thanks for listening to the World Pipelines podcast. Subscribe for free wherever you get your podcasts. If you have enjoyed this episode, please rate and review and forward to a colleague or friends. On the 03/18/2026, I'll be hosting the World Pipelines CCS Forum in London.
Elizabeth Corner:It's a full day dedicated to The UK's CO2 pipeline build out, connecting the dots between the scale of CCS network needed in The UK and how we'll make it a reality. We'll cover engineering challenges, integrity and maintenance opportunities, project progress and delivery insight, and regulatory support. The speaker lineup includes National Gas, United Infrastructure, DNV, Baker Hughes, NE, SGN, Peritas International, and more to be announced. Go to www.worldpipelines.com/ccsforum2026 or search World Pipelines CCS Forum for more information. Thanks for listening.