How should security teams reduce blind spots in manufacturing environments with both IT and OT assets?

Security teams should build a continuous exposure process, not rely on periodic testing alone. In manufacturing, IT and OT changes can happen between assessments, so teams need asset context, change monitoring, and risk prioritization tied to production impact. The practical goal is to find the exposures that matter most, reduce false positives, and focus remediation on high consequence systems.

Manufacturing environments combine fast-changing IT with constrained OT, and that mix is exactly where visibility gaps appear. Periodic scans and point-in-time assessments miss the drift that happens between windows, especially when engineering workstations, historian links, remote support paths, and plant-floor controllers change outside the normal enterprise cadence. NIST SP 800-82 Rev 3, OT Security Guide is useful here because it frames OT security around segmented architectures, operational constraints, and the need to understand what is actually connected before trying to secure it.

The practical issue is not just finding devices, but understanding what each asset can influence, what production dependency it supports, and whether the exposure would interrupt safety or throughput. Teams often think they have coverage because a scanner ran successfully, yet the highest-risk blind spots are usually in unmanaged pathways, inherited trust, and assets that were added to keep production moving. In practice, teams discover their blind spots only after a maintenance exception, vendor connection, or emergency change has already expanded the attack surface.

How Continuous Exposure Management Works on the Plant Floor

Reducing blind spots means treating exposure as a continuous process rather than a quarterly event. Security teams need an asset picture that fuses passive discovery, authenticated IT telemetry, OT-safe monitoring, and change signals from engineering and operations. That combined view lets them see which systems are present, which ones are newly changed, and which exposures matter because they sit on production-critical paths. A useful reference point is the CISA Industrial Control Systems resources, which consistently emphasise operational context and segmented control in industrial environments.

Good practice is to prioritise by consequence, not by raw severity alone. A medium-severity issue on an internet-facing IT host may be urgent, but a similar issue on a controller-adjacent engineering asset may demand different handling because remediation windows are narrower and failure tolerance is lower. The workflow usually looks like this:

Build a unified inventory that distinguishes corporate IT, plant IT, and OT assets.
Track change events continuously so new services, ports, remote access paths, and firmware changes are visible quickly.
Enrich findings with owner, location, production role, and maintenance window context.
Filter noise by validating what is actually reachable and what is only theoretically exposed.
Route remediation based on production consequence, not just ticket age or CVSS.

For control validation, teams should also align with core access, audit, configuration, and integrity disciplines in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where the goal is to make exposure visible, attributable, and repeatable. These controls tend to break down when asset ownership is unclear and changes are made through emergency procedures that never flow back into inventory or monitoring.

Common Variations and Edge Cases

Tighter visibility often increases operational overhead, so teams have to balance fidelity against plant disruption. Not every environment can tolerate active scanning on OT segments, and not every exposure should be chased immediately if remediation would threaten uptime or safety. The right answer is often a differentiated monitoring model rather than one uniform policy across IT and OT.

One common edge case is third-party access. Vendors may connect through approved paths that are technically legitimate but still create blind spots if sessions, accounts, or temporary tools are not monitored as closely as in-house assets. Another is legacy OT equipment that cannot be instrumented well, where indirect evidence from switches, firewalls, historians, or engineering jump hosts may be the only reliable signal. Current guidance suggests treating these gaps as governance problems as much as technical ones: if you cannot observe the asset directly, you need compensating control and a clearly owned exception process.

Another useful data point is that only 5.7% of organisations report full visibility into their service accounts, which reinforces how often hidden dependencies undermine exposure management. That figure matters most when manufacturing teams rely on shared automation, vendor tools, or service credentials to bridge IT and OT. Blind spots are most stubborn where accountability is split between operations and security, because neither side owns the full change picture.

Risk and Threat Considerations

The main risk is that unknown or stale assets become ungoverned entry points into production environments. In manufacturing, the consequence is not only unauthorised access, but also process interruption, safety impact, lateral movement across IT and OT, and delayed recovery because the affected asset was never fully inventoried.

Failure mechanism: Attackers and opportunistic intruders exploit incomplete asset visibility, unmanaged remote access, and change drift. Once a hidden host, forgotten account, or vendor path is present, it can be used to establish footholds, move toward supervisory systems, or abuse trust relationships that normal monitoring never covered.

Impact: Exposure can remain undetected until production is already affected, which makes containment slower and increases the chance of broader operational disruption, unsafe state transitions, or expensive manual recovery.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.OC — Organizational Context	Manufacturing exposure prioritisation depends on production-critical context and ownership.
	ID.AM — Asset Management	Continuous exposure management starts with accurate, current IT and OT asset inventory.
	DE.CM — Continuous Monitoring	Blind spots shrink when asset and change monitoring run continuously between assessments.
Recommendation — Map assets to production impact so remediation decisions reflect operational consequence. Maintain a live asset inventory that includes IT, OT, and bridge systems. Implement continuous monitoring to detect new assets, changes, and exposure drift.
CIS Controls v8	1 — Inventory and Control of Enterprise Assets	A complete, current inventory is the foundation for finding blind spots in mixed environments.
	2 — Inventory and Control of Software Assets	Software drift and untracked tooling can create exposure on both IT and OT hosts.
	7 — Continuous Vulnerability Management	Continuous exposure reduction requires ongoing identification of exploitable conditions.
Recommendation — Inventory all enterprise and plant-connected assets, including bridge systems. Track software and tooling changes on systems that support production and operations. Continuously identify and prioritise vulnerabilities on high-consequence assets.

Practitioner Guidance

What to prioritise: Start with assets that combine production impact and poor observability, such as engineering workstations, remote access jump points, historian integrations, and any host that bridges business IT and plant OT. Those are the places where a missed change most often turns into an exposure with real consequence.

What to verify: Confirm that discovery is continuous enough to catch change between formal assessments, that every critical asset has an owner, and that exceptions are time-bound. If a system cannot be monitored directly, require a documented compensating-control path rather than accepting the gap informally.

Practitioner takeaway: The goal is not perfect visibility everywhere, but reliable visibility where production consequence and hidden trust intersect; that is where blind spots become incidents.