Stop fixing OT security with IT thinking