CISA is right to sound the alarm over Internet-exposed operational technology. But must every unwanted connection be answered with more authentication, stronger cryptography, and more processing power? There are remarkably lightweight ways to make malicious automation work harder while allowing OT controllers to concentrate on the job they were installed to do.