Boards of directors are failing to adequately address operational technology (OT) cyber risk, often focusing solely on IT. This oversight leaves critical infrastructure vulnerable, as OT systems are increasingly targeted and disruptions can halt operations and impact safety.