How should manufacturers build trust across IoT, IIoT, and OT environments without slowing operations?

Manufacturers should treat trust as an operational control, not a one-time project. The practical foundation is strong PKI, automated certificate lifecycle management, and continuous visibility into every device, workload, and asset. That reduces manual errors, limits certificate sprawl, and helps security teams scale identity controls across plants, suppliers, and connected systems without weakening availability or production continuity.

Why This Matters for Security Teams

Manufacturers are trying to secure environments where IT, IIoT, and OT all depend on machine identities, certificates, and secrets, but each layer moves at a different pace. If trust is handled manually, teams create certificate sprawl, renewal outages, and blind spots that can interrupt production. NHI Mgmt Group notes that only 5.7% of organisations have full visibility into their service accounts, which is a warning sign for any plant that depends on connected devices and workloads at scale. Ultimate Guide to NHIs

The main failure is treating trust like a perimeter problem instead of an operational identity problem. In practice, a certificate lapse, a leaked API key, or an overprivileged device account can stop a line just as quickly as a mechanical fault. Standards like NIST SP 800-53 Rev 5 Security and Privacy Controls make the control objective clear, but manufacturers still need processes that fit uptime requirements and maintenance windows. In practice, many security teams encounter identity-related outages only after a renewal failure or supplier compromise has already disrupted operations, rather than through intentional testing.

How It Works in Practice

The strongest approach is to make machine trust continuous, automated, and tied to workload identity rather than static device records. That means issuing certificates through PKI, enforcing short-lived credentials, and rotating secrets automatically before expiration. It also means using inventory and telemetry to know exactly which PLCs, gateways, sensors, apps, and service accounts exist, where they communicate, and whether they still need access. When applied well, this reduces manual certificate handling while preserving uptime.

For manufacturers, the practical model usually includes:

• PKI-backed device identity for controllers, edge nodes, and connected equipment.
• Automated certificate enrollment, renewal, and revocation with clear ownership.
• Policy-based trust decisions for device-to-device and workload-to-workload access.
• Continuous discovery to catch shadow assets, stale accounts, and orphaned certificates.
• Segmentation and least privilege so a compromised asset cannot freely move across plants.

This is where identity discipline becomes an availability control. The NHI Mgmt Group guidance in the Ultimate Guide to NHIs aligns with what security teams see after incidents like the Schneider Electric credentials breach: once secrets are exposed, trust collapses unless certificates, tokens, and access paths are governed as part of the same lifecycle. Current guidance suggests using automation first, then layering policy and segmentation, because manual exception handling does not scale across plants, suppliers, and production systems. These controls tend to break down in brownfield OT environments where legacy devices cannot support modern certificate workflows and maintenance windows are tightly constrained.

Common Variations and Edge Cases

Tighter trust controls often increase operational overhead, so manufacturers have to balance security assurance against production constraints. In brownfield plants, some assets cannot run modern agents, support rapid rotation, or tolerate frequent re-enrollment. In those cases, the best practice is evolving toward compensating controls such as network isolation, gateway mediation, and carefully scoped certificate lifetimes instead of a pure zero-touch model.

There is also a real tradeoff between standardisation and resilience. Highly automated certificate lifecycle management works well for fleets of similar devices, but mixed vendor estates often require different onboarding paths, renewal timing, and revocation methods. The key is to avoid long-lived exceptions becoming permanent policy. If a supplier connection, remote maintenance account, or engineering workstation cannot be brought under the same trust model, it should be treated as higher risk and monitored accordingly.

Manufacturers that build trust well usually start with the systems that can be automated first, then expand coverage outward. A second useful reference point is the broader NHI lifecycle guidance in the Ultimate Guide to NHIs, which is especially relevant when certificate trust and application secrets overlap. The practical limit is legacy OT that cannot support cryptographic identity at the edge, because those environments force teams to rely on compensating controls rather than uniform identity enforcement.

Related resources from NHI Mgmt Group

• How should organisations secure machine access in OT environments without slowing operations?
• How should organisations govern cloud identities across Microsoft 365, Azure IaaS, and Teams without slowing remote work?
• How should financial institutions eliminate shadow communications without slowing business operations?
• How should security teams centralise certificate lifecycle management across TLS, enterprise PKI, and IoT environments?