If you are attacked, some questions:
How much money will you lose if the production is standing still?
Do you have a plan if this happens?
Who will get blamed for it?
What if your control logic code or historian data is stolen?
Do you have a recovery plan?
Well implemented OT security is a way of reducing business risk but also a way of improving the daily production work
(backups, standardized remote access, upgrading old equipment, new routines etc)
Some consequences of a compromised OT system:
Impact of reputation
Loss of production
Loss of IPR
Loss of lives