Real world incident response experience shows that many attacks against OT centric organizations unfold differently than expected. There are several key reasons why reality diverges from initial assumptions, and understanding these gaps offers critical lessons for strengthening operational resilience.