Why do identity-based attacks become more dangerous in hybrid IT and OT environments?

Identity-based attacks become more dangerous in hybrid environments because attackers can pivot from enterprise identity systems into systems that control physical or essential services. When IT and OT share trust assumptions, a compromise in one domain can affect uptime, safety, and recovery. Segmentation, tiering, and separate credentials reduce that blast radius.

Why This Matters for Security Teams

Hybrid IT and OT environments collapse the usual boundary between data access and operational impact. An identity compromise that starts with a VPN account, service principal, API key, or privileged admin session can become a path into historians, remote operations, safety systems, or engineering workstations. That is why identity-based attacks are more dangerous here than in a pure IT estate: the same credentials can unlock both business systems and physical processes.

This is not just a perimeter problem. Guidance in the Ultimate Guide to NHIs shows how often secrets and service accounts remain overprivileged or unrotated, and that gap becomes far more consequential when OT availability and safety are in scope. CISA also continues to warn that identity, remote access, and segmentation weaknesses are common entry points in critical environments, as reflected in its cyber threat advisories.

In practice, many security teams discover the problem only after an IT credential has already been used to reach systems that were never meant to be part of the same trust zone.

How It Works in Practice

In hybrid environments, attackers rarely need to “hack OT” first. They often begin by abusing identity in the IT side, then follow the trust relationships that already exist between directory services, jump hosts, historians, remote access gateways, engineering tools, and vendor support channels. Once a valid identity is accepted, lateral movement often looks legitimate because it uses approved channels, approved protocols, and approved accounts.

The main weakness is shared trust. If a domain admin, service account, or federated token can authenticate into both enterprise and plant-connected systems, then a single compromise can traverse layers that defenders assumed were isolated. This is why 52 NHI Breaches Analysis is useful reading for teams mapping real-world blast radius, while the MITRE ATT&CK Enterprise Matrix helps defenders model the identity-to-lateral-movement chain more concretely.

• Separate IT and OT identities wherever possible, rather than extending one directory trust into both domains.
• Use tiered administration so OT engineering workstations, jump servers, and remote access brokers do not share the same privilege model as corporate IT.
• Apply just-in-time access, short-lived credentials, and tight session logging for vendor and admin workflows.
• Prefer workload identities and certificate-based authentication over long-lived shared passwords or embedded secrets.
• Enforce segmentation at the control plane, not just the network diagram, so authentication cannot automatically imply reachability.

Current best practice is to combine Zero Trust concepts with OT-aware exception handling, because some industrial assets cannot tolerate frequent agent installs, aggressive scanning, or token churn. The NIST controls in NIST SP 800-53 Rev. 5 help structure access control and auditability, but the operational model still has to respect plant uptime. These controls tend to break down when legacy OT vendors require shared accounts and flat remote support paths because authentication and authorization are then decoupled from true device-level boundaries.

Common Variations and Edge Cases

Tighter identity controls often increase operational overhead, requiring organisations to balance safety, uptime, and vendor support against the reduction in blast radius. That tradeoff is real in plants that depend on seasonal maintenance windows, third-party integrators, or unsupported legacy controllers.

There is no universal standard for this yet, but current guidance suggests that the safest model is not identical controls everywhere. Some OT zones need compensating controls such as read-only access, dedicated bastions, and one-way data flows, while business systems can often adopt stronger conditional access and rapid revocation. In environments with high change velocity, long-lived credentials become especially risky because they survive longer than the workflow that justified them.

For broader NHI governance, NHIMG’s Key Challenges and Risks section is a useful reference point for credential hygiene, and the OWASP NHI Top 10 is helpful when identity exposure extends into automated workflows and agent-like tools. Where safety systems, remote operations, and shared credentials intersect, the compromise path is usually shorter than the asset inventory suggests.

Related resources from NHI Mgmt Group

• Why do identity-based attacks become more dangerous when organisations rely on static login trust?
• How should security teams investigate browser-based identity attacks without relying on proxy logs alone?
• Why do hybrid identity environments increase the blast radius of an identity attack?
• Why do GitHub-based supply chain attacks create identity risk for cloud environments?