Air gaps fail when operational reality creates hidden OT paths

At a glance

What this is: This is an analysis of why “air-gapped” SCADA is often a control illusion, with the key finding that operational exceptions create the paths attackers use.

Why it matters: It matters because IAM, PAM and OT teams must govern the human and third-party access paths that erode isolation, even when the network design looks disconnected.

Context

An air gap is supposed to mean no practical route exists between an industrial control environment and external networks, but real OT operations rarely stay that clean. Maintenance, engineering support, updates and reporting create the very crossings that isolation is meant to prevent, so the governance problem is not the label of “air-gapped” but the unmanaged exceptions around it. OT security guide

In modern SCADA environments, the boundary failure is usually operational rather than purely technical. Human access, removable media, vendor devices and hidden network bridges all turn a presumed separation into a governed-access problem, which is why identity, privilege and segmentation have to be treated as one control plane rather than separate disciplines.

Key questions

Q: What breaks when an air-gapped SCADA environment relies on normal maintenance workflows?

A: The isolation claim breaks when routine maintenance depends on removable media, vendor laptops or bridged connections that are not governed as privileged access paths. The environment may still look segmented on paper, but operational exceptions reintroduce trust, and that trust is usually broader than the task requires. Once those exceptions are normalised, the air gap becomes a policy statement rather than a real control.

Q: Why do removable media and vendor devices create such a high-risk OT exposure?

A: They create high risk because they bring outside trust into a control environment that was designed to assume very limited change. A USB drive can carry logic or firmware changes, and a contractor laptop may already have broad software, credentials or network reach. In both cases, the attacker does not need to defeat perimeter defences if the path itself is treated as legitimate.

Q: What are the signs that an air gap is failing in practice?

A: Look for dual-homed workstations, unexplained modem links, ad hoc vendor access, inconsistent device baselines and traffic that does not match the approved protocol profile. These are symptoms that the control boundary is being bypassed or expanded informally. In OT, the most important warning sign is often not malware, but a legitimate workflow that has quietly become a shadow connection.

Q: How should industrial teams govern remote maintenance without weakening segmentation?

A: They should confine maintenance access to the exact devices, protocols and destinations required for the job, then verify that the access path ends when the task ends. That means device profiling, least-privilege network rules and explicit approval for every crossing point. The goal is not to ban maintenance, but to ensure it cannot silently become general-purpose connectivity.

Technical breakdown

Why removable media still breaks SCADA isolation

USBs and other removable media remain one of the most common ways malware crosses an otherwise isolated industrial environment. The mechanism is simple: a trusted workstation accepts externally prepared files, then executes logic, firmware updates or configuration changes that were never validated inside the OT trust boundary. In OT terms, the entry point is not remote exploitation but trusted physical handling. Once the file is introduced, the payload can alter PLC logic, HMI state or engineering tooling without needing internet connectivity. This is why air-gap claims fail when update workflows rely on uncontrolled transfer media. See the OT and ICS Identity and Access Guide.

Practical implication: Treat removable media as a privileged ingress path and validate every transferred configuration or firmware artifact before it reaches an OT asset.

How vendor laptops and shadow bridges create hidden trust paths

Third-party laptops and accidental bridges are governance failures disguised as convenience. A contractor device connected for maintenance may have broader local privileges, unknown software, cached credentials or unmanaged network routes. A dual-homed workstation or cellular modem can silently connect OT to corporate or external networks, defeating segmentation even when the core control network was designed to stay offline. The issue is not just presence on the network, but the trust the environment extends to devices and paths it does not own. That makes device discovery, protocol profiling and least-privilege network access part of the same control problem. See the Device and IoT Identity Guide.

Practical implication: Require explicit device trust and network scope validation for every third-party endpoint before it can touch an OT segment.

What supply chain contamination and side channels reveal about OT risk

Supply-chain contamination shows that some compromises exist before the asset ever reaches the plant, while side-channel abuse shows that isolation can still be undermined after infection through nearby signal leakage. In both cases, the weakness is the assumption that physical separation alone guarantees safety. The real control requirement is knowing whether a device is behaving like its approved baseline and whether the environment would allow a hidden payload to activate. That means topology-aware threat assessment, configuration baselines and exploitability analysis matter more than generic vulnerability scoring for OT environments. See the OT Security Guide.

Practical implication: Use baselining and exploitability analysis to decide which OT devices and configurations actually need intervention.

Threat narrative

Attacker objective: The attacker aims to cross the supposed air gap, maintain influence inside the OT environment and preserve access to industrial systems or data.

1. Entry occurs through trusted operational pathways such as USB media, vendor laptops or hidden bridges rather than through an exposed internet route.
2. Escalation follows when the introduced device, file or connection reaches PLCs, HMIs or engineering workstations with enough trust to alter configuration or logic.
3. Impact is the erosion of SCADA isolation, which can enable persistent control of industrial processes, unsafe changes or covert exfiltration paths.

Breaches seen in the wild

• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Air-gap theory fails when operational convenience becomes a control path. The article is right to frame isolation as something that erodes through routine business and engineering decisions, not only through exotic exploits. In OT environments, the practical question is who can move data, devices or configuration changes across the boundary and under what approval model. That makes the problem a governance failure as much as a network design issue. Practitioners should treat every exception as part of the control surface, not as an operational footnote.

The real control gap is unmanaged trust in people, devices and transfer workflows. USB media, vendor laptops and bridging devices are not edge cases in industrial operations, they are recurring access paths. When those paths are not tied to identity, privilege and asset baselines, the environment grants trust without enough verification. That is exactly where OT identity and access becomes relevant: OT access governance has to extend to third-party devices, maintenance workflows and removable transfer channels. Practitioners should govern crossings, not just networks.

Shadow connection drift: is the named condition this article exposes. The danger is not a single misconfigured cable or one forgotten modem. It is the slow accumulation of unofficial connections that bypass the intended separation model until the “air gap” is only theoretical. This is why segmentation, device discovery and configuration control need to be continuous rather than point-in-time checks. Practitioners should assume any long-lived industrial estate will accumulate hidden paths unless those paths are actively inventoried and challenged.

OT security needs exploitability context, not just vulnerability counts. The article’s supply-chain and side-channel examples show that the question is not how many weaknesses exist, but which ones can actually be reached in the current topology. That is a materially different governance lens from generic IT vulnerability management. For industrial environments, teams should prioritise device behaviour, topology, and baseline deviation over raw CVSS scoring alone. Practitioners should align remediation to what is operationally reachable, not merely what is technically listed.

Air-gap governance is now a lifecycle discipline, not a perimeter claim. The article shows that SCADA isolation depends on ongoing device trust, change control and communication oversight across the full OT estate. Once maintenance, vendor access and supply-chain dependencies are involved, the problem resembles privileged access governance more than classic perimeter security. Practitioners should move from “is it isolated?” to “which identities, devices and processes can legitimately cross, and how is that crossing audited?”

Read next: OT Security Guide

What this signals

OT isolation is shifting from perimeter thinking to crossing-point governance. The practical failure mode is no longer whether a plant can be reached from the internet, but whether approved operational workflows quietly recreate that reachability inside the site. Programmes that still treat air gaps as a binary state will miss the slow accumulation of exceptions that turn into pathways. Practitioners should prepare for continuous verification of every transfer, device and link that can touch the control plane.

Named concept: air-gap drift. This is the gradual collapse of a presumed isolated architecture as maintenance, vendor access and convenience-driven exceptions add untracked pathways. The implication is that OT security teams need change control, segmentation and device trust to behave like living controls, not one-time design choices. Device identity guide

For practitioners

• Inventory every crossing point into the OT boundary Map USB handling, vendor laptops, remote maintenance links, dual-homed workstations and cellular modems as explicit ingress paths, then assign an owner to each one.
• Restrict removable media to approved transfer workflows Require scanning, validation and documented approval before any firmware, logic file or log export is introduced into a control environment.
• Baseline every device before trusting it on the segment Capture known-good device behavior, protocol use and configuration state so deviations from expected OT activity surface quickly during operations.
• Separate maintenance access from general network trust Limit third-party devices to the exact protocols and destinations needed for the task, and prevent broader lateral movement within the same segment.
• Use topology-aware prioritisation for OT remediation Focus patching and segmentation changes on assets that are both exposed and exploitable in the actual plant topology, not just high-scoring findings.

Key takeaways

• Air-gapped SCADA fails most often through routine operational exceptions, not through headline remote exploits.
• The article’s examples show that USB media, vendor laptops, hidden bridges and contaminated devices can all reintroduce access across a supposed boundary.
• The control answer is continuous visibility into devices, protocols and crossings, backed by enforced segmentation and configuration baselines.

Related NHI Mgmt Group resources: OT Security Guide · OT and ICS Identity and Access Guide · Device and IoT Identity Guide · Top 10 OT Security Risks

Key terms

• Air-Gap Drift: The gradual erosion of an isolated industrial network as maintenance, vendor support and convenience-driven exceptions create untracked pathways. It is a governance problem as much as a technical one, because the environment still looks separated while real trust and connectivity have quietly expanded.
• Shadow Connection: A shadow connection is an integration or credential linkage that exists outside normal governance or visibility. These connections often arise when teams create tokens, webhooks, or service accounts informally, then leave them active. They increase attack surface because security teams may not know what they can access or who owns them.
• Configuration Control: Configuration control is the practice of monitoring application settings that shape how a process behaves. In Oracle EBS, it helps teams compare environments, preserve process integrity, and detect when a configuration change would weaken controls such as matching rules, approvals, or workflow behaviour.
• Behavioural Baselining: Behavioural baselining is the process of learning how an identity normally behaves so deviations can be detected as risk signals. The baseline usually includes device, location, timing, and action patterns, and it becomes more valuable when used after authentication rather than as a replacement for it.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity governance to operational security and access control decisions.