They often sit in trusted operational paths and must keep speaking to adjacent systems, historians, or vendor services. If an attacker reaches one of those devices, the authorised flows can become a bridge into broader operational or clinical networks unless segmentation narrows the path first.
Why unpatchable devices become a movement bridge
Unpatchable industrial devices are dangerous not just because they are old, but because they often remain operational inside trust-rich paths. They still have to talk to historians, controllers, vendor services, jump hosts, or management tools, which means an attacker who lands on the device can often ride legitimate communication routes instead of forcing a noisy exploit chain. That makes the device a pivot point, not just an endpoint.
In practice, “unpatchable” usually means the risk cannot be removed at the device itself, only reduced around it. If the asset cannot be fixed, the security question shifts to whether its network placement, protocol exposure, and adjacent trust relationships are narrow enough to stop a compromise from spreading.
Industrial environments are especially prone to this pattern because availability pressure keeps legacy equipment in service long after secure design assumptions have expired. The longer a device remains in production, the more likely it is to accumulate adjacent integrations, shared accounts, and exceptions that make lateral movement easier than initial compromise.
Where the lateral movement path actually comes from
The movement risk comes from the combination of reachable services and trusted peers. A device that can still authenticate to adjacent systems, exchange telemetry, accept remote maintenance, or forward data into operational networks gives an attacker an authenticated path that can be reused after compromise. That is why NIST SP 800-82 Rev 3, OT Security Guide emphasizes architecture and segmentation as much as endpoint hardening.
Once an attacker controls one exposed industrial node, the next step is often to look for trust transitivity, shared credentials, or management channels that reach better-connected assets. The device may not be the final target, but it can be the easiest place to start traversing toward engineering workstations, historians, domain services, or safety-adjacent networks.
That is why lateral movement risk increases when the device sits in a flat or weakly segmented segment. A single trust break then becomes a route into a larger environment rather than a contained local event, especially when the device is allowed to initiate outbound connections that bypass normal operator scrutiny.
Why segmentation matters more than patch status alone
Segmentation is the control that limits the blast radius when patching is no longer possible. The goal is not to make an unpatchable device “safe” in the abstract, but to ensure it can only reach the minimum set of systems required for operations. CISA Industrial Control Systems guidance consistently frames industrial defense around zone separation, monitored conduits, and careful control of remote access paths.
The strongest boundary is usually not a single firewall rule, but a combination of network zoning, protocol allowlisting, restricted management planes, and strict control over vendor maintenance routes. If the device must retain connectivity, the security team has to decide which paths are essential and which ones exist only because legacy operations were never redesigned.
That distinction matters because many industrial compromises spread through legitimate protocols rather than malware that immediately trips endpoint defenses. When the device is unpatchable, every unnecessary adjacency becomes part of the attack surface, and every broad trust relationship becomes a potential hop.
Risk and Threat Considerations
Unpatchable industrial devices create higher lateral movement risk because compromise is more likely to be contained by architecture than by remediation. If those devices sit in shared networks or preserve broad trust with adjacent systems, an attacker can use normal operational flows to expand access without needing a new exploit at every step.
Failure mechanism: The device cannot be fixed in place, so defenders rely on network placement, access control, and trust boundaries. If those controls are loose, the attacker can pivot from the compromised device into historians, controllers, remote support paths, or management systems that were never meant to be openly reachable.
Impact: A single foothold can turn into wider operational disruption, unauthorized command paths, credential exposure, or deeper compromise of business and clinical systems connected to the same environment. The longer the device remains unpatchable, the more important it becomes to prove that its communication routes are genuinely constrained.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-4 — Access Control Policy and Procedures | Unpatchable devices need enforced flow restrictions to limit pivot paths. |
| SC-7 — Boundary Protection | Segmentation is the main control that contains compromise of legacy devices. | |
| IA-9 — Identification and Authentication (Service Accounts and Devices) | Trusted device and service connections can be reused for pivoting after compromise. | |
| Recommendation — Restrict device communications to approved conduits and deny unnecessary lateral paths. Segment industrial zones so a compromised device cannot traverse into higher-value networks. Constrain device-to-device and device-to-service authentication to tightly scoped, monitored paths. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Industrial devices often retain more reach than they need, enlarging pivot opportunities. |
| Recommendation — Reduce device privilege and reachable systems to the minimum required for operation. | ||
| MITRE ATT&CK | T1021 — Remote Services | Attackers often pivot through legitimate remote management and support channels. |
| Recommendation — Monitor and limit remote service use so attackers cannot reuse operational access for movement. | ||
| NIST Zero Trust (SP 800-207) | SC-7 — Network Segmentation | Zero trust limits implicit trust between device and adjacent systems. |
| Recommendation — Apply segmentation and explicit verification before allowing any cross-zone device access. | ||
Practitioner Guidance
What to prioritise: Treat the adjacency map as the control object. The first question is not whether the device is vulnerable, but which systems it can still reach, which systems can still reach it, and whether any of those paths are broader than the process truly needs.
What to verify: Confirm that the device has no direct route to higher-value enclaves, that vendor access is time-bound and monitored, and that maintenance accounts or service channels cannot be reused as general-purpose movement paths. In industrial networks, the security boundary is only real if the allowed flows are few, known, and operationally justified.
Practitioner takeaway: With unpatchable devices, lateral movement risk is controlled far more by reducing trust and reach than by waiting for a patch that may never arrive.
Related resources from NHI Mgmt Group
- Why do centralized segmentation designs create higher lateral movement risk?
- Why do unsecured IoT devices create such a high risk of lateral movement and botnet abuse?
- Why do non-human identities create more risk than many human accounts?
- Why do non-human identities create more remediation risk than many human accounts?