A new OT security integration points to a familiar problem in critical infrastructure: finding the vulnerabilities that matter most before patching them becomes a safety decision.