A thing I do at Dragos (not a plug, just thought you might find interesting), is elaborate functional and crown jewel analysis of industrial facilities where I spend days interviewing staff to figure out all the horrible things that could happen and what device could cause them.

Like I literally spend days of my life figuring out what PLC on what shelf could cause places to explode under specific operational and security conditions

It's interesting. I found out how to spoil eggs en masse and also cause cataclysmic chemical chain reactions.

I'm involved in that process as an incident responder along with chemical / electrical engineering specialists and assessors, because it's a complex process. You see a lot of stuff that keeps you up at night, and most of it isn't what everyone else worries about.

Like, let me give you a very minor example - looking at an environment you think that the plethora of XP machines are the meaningful security issue, but really it ends up being the building automation power subnet that regulates power to HVAC that maintains operational temps.