Armexa is heading to The Woodlands, Texas, for the 21st Annual API Cybersecurity Conference for the Oil and Natural Gas Industry, November 10 to 11, 2026, at the Woodlands Waterway Marriott. The conference brings together IT security, OT/ICS, and compliance professionals from across oil and gas to compare notes on what is actually working to protect operations.
This year our team is presenting four sessions across both days, and we will be on the show floor at Booth 406 during both days of exhibit hours. If you are attending, we would like to meet you.
Catch Armexa on the Agenda
All times are Central.
Tuesday, November 10
Packaged Control Systems: Why Commissioning Is Too Late for Cybersecurity
John Cusimano, Chief Strategy Officer, Armexa | 10:40 AM to 12:00 PM CT | ICS Cyber Security Track #1 (Technical)
Compressor skids, burner management systems, loading racks, and other packaged control systems arrive from OEMs and system integrators with their own controllers, HMIs, and network connections. They rarely get the scrutiny the core DCS or SCADA system does: they are seldom patched, often connect to the control network over insecure protocols with no boundary firewall, and may carry vendor remote access the site does not know about. John, who chairs the ISA/IEC 62443-3-2 standard, will explain how to assess and secure the packaged systems already in your facilities using a consequence-based risk assessment, and how to build security into new ones through procurement requirements, cyber factory and site acceptance testing, and operating procedures developed with the supplier.
Wednesday, November 11
How Much Segmentation Is Too Much Segmentation?
Jacob Marzloff, CEO and Co-Founder, Armexa | 2:20 PM to 3:40 PM CT | Cybersecurity Architecture Track
Most segmentation debates start with the wrong question. Jacob will make the case for a consequence-driven approach that asks how much segmentation a facility needs, and for which consequence. Drawing on what Armexa finds in the field, from dual-homed engineering laptops to permit-any rules left in place after a turnaround, he will show why an enforcement point that can shut in the plant when it fails is in the wrong place, and why boundaries operations cannot maintain erode over time. Attendees will leave with three questions to ask of every networked component (its function, its dependencies, and who needs to access it), a practical six-zone baseline for oil and gas sites, and a phased path from separation to segmentation to segregation where none of the steps requires a prolonged outage.
Cyber Risk Quantification for OT: A Practical How-To for Oil and Gas
John Cusimano, Chief Strategy Officer, Armexa | 4:10 PM to 5:30 PM CT | Cyber Risk Management Track
Most OT risk assessments end with a heat map, but budget decisions are made in dollars. John will walk through a practical method for quantifying OT cyber risk in oil and gas, starting from the consequence scenarios a facility already understands and translating them into financial terms leadership can compare against the cost of mitigation. Attendees will see how to build credible estimates without perfect data and how to use the results to prioritize investment.
Out of Control II: Practical MQTT Abuse Techniques in IIoT and Industrial Environments
Eric Forner, Co-Founder and CTO, Armexa, and Marco (Marc) Ayala | 4:10 PM to 5:30 PM CT | Identity and Access Management Track
MQTT and Sparkplug B are increasingly used to move data from field devices and edge gateways into IIoT platforms, historians, and the cloud. Eric and Marc will share their latest research on these protocols with the oil and gas community. They will show how misconfigured or abused MQTT deployments let an attacker inject false data and impersonate trusted devices, and how those actions can disrupt industrial processes or compromise safety when the right safeguards are missing.
.
Visit Us at Booth 406
Stop by Booth 406 to talk with Jacob Marzloff, John Cusimano, and Eric Forner about the challenges in your own environment. Armexa provides practical, scalable OT and industrial cybersecurity services aligned with ISA/IEC 62443, including cybersecurity risk assessments, maturity and compliance gap assessments, system design reviews, and network segmentation, for refineries, pipelines, chemical plants, offshore facilities, and other critical operations. We have helped secure more than 100 industrial facilities across four continents.
Exhibit hours:
- Tuesday, November 10: 7:00 AM to 6:00 PM CT
- Wednesday, November 11: 7:30 AM to 2:30 PM CT
.
Schedule Time With Our Team
Want to set up a dedicated conversation at the conference? Contact us and we will arrange a time that works around your agenda.
We look forward to seeing you in The Woodlands.
