State of Threat Intelligence (TI) in the IT domain has evolved significantly in the past decade, with the emergence of frameworks like STIX (Structured Threat Information eXpression), TAXII (Trusted Automated eXchange of Indicator Information), and MRTI (Managed Threat Response and Intelligence). These frameworks have helped standardize the format, sharing, and automation of TI in the IT industry.

However, the OT-specific Threat Intelligence space is indeed still in its early stages and lags behind IT. There are several reasons for this:

1. Complexity of OT Systems: Operational Technology (OT) systems are highly specialized, utilizing legacy technologies, proprietary protocols, and unique configurations. These systems often lack standardized communication and information sharing mechanisms, making it challenging to capture and share OT-specific threat intelligence effectively.

2. Limited Information Sharing Culture: The OT community has traditionally been more closed and siloed in terms of sharing information about cyber threats and vulnerabilities. There are concerns about the potential impact on production, equipment safety, and potential legal ramifications, which may hinder the open sharing of threat intelligence.

3. Regulation and Compliance Challenges: OT systems, especially those in critical infrastructure sectors, are subject to stringent regulations and compliance requirements. This can create additional barriers to sharing sensitive threat intelligence due to concerns around confidentiality, legal obligations, and compliance with privacy laws.

4. Lack of Standardization: Unlike the IT sector, where standards and frameworks for threat intelligence sharing have been well-defined, the OT domain lacks similar standards and frameworks tailored specifically for OT/ICS environments. This hampers the interoperability and seamless exchange of TI between OT stakeholders.

5. Focus on Availability and Safety: Historically, the primary focus of OT systems has been on availability, safety, and reliability rather than cybersecurity. This mindset has led to a slower adoption of threat intelligence practices and technologies in the OT industry.

Despite these challenges, efforts are underway to bridge the gap between IT and OT threat intelligence. Organizations, industry consortia, and government entities are working to establish frameworks and standards tailored for OT environments. Initiatives such as the Industrial Internet Consortium (IIC), the ISA/IEC 62443 standards, and sector-specific Information Sharing and Analysis Centers (ISACs) are actively promoting threat intelligence sharing in the OT community.

It is crucial for the industry to continue investing in research, collaboration, and awareness to accelerate the maturity of OT-specific threat intelligence and address the unique challenges posed by OT/ICS environments.