Continuous validation is redefining critical infrastructure resilience

At a glance

What this is: This analysis argues that critical infrastructure resilience now depends on continuous validation of controls across interconnected IT, OT and supplier environments, because static compliance does not prove performance under attack.

Why it matters: For IAM, PAM and broader security teams, the article highlights that identity, access and segmentation controls in critical infrastructure must be tested continuously against realistic adversary behaviour, not assumed effective from design or audit evidence.

By the numbers:

• Approximately 80% of critical infrastructure assets are privately owned and operated, according to SafeBreach.

Context

Critical infrastructure resilience is the ability to keep essential services functioning even when controls, dependencies or adversaries create pressure across multiple systems. In this article, the primary gap is the distance between compliance evidence and actual control efficacy, especially where IT and OT systems are tightly coupled.

That gap matters because critical infrastructure rarely behaves like an isolated enterprise network. Vendor access, service dependencies, legacy OT platforms and cross-sector interdependence mean that a weakness in one place can become a business, safety or regional continuity problem somewhere else.

Key questions

Q: How should security teams validate resilience in interconnected critical infrastructure?

A: They should validate resilience by testing whether controls stop realistic attacker behaviour across the full dependency chain, including vendor access, segmentation, and identity boundaries. The goal is not a pass or fail audit result. It is evidence that critical paths remain contained when adversary tactics are simulated safely inside production constraints.

Q: Why do interdependent IT, OT and supplier environments create so much resilience risk?

A: Because a compromise rarely stays inside one system. Shared access paths, remote maintenance links and software dependencies let a weakness in one place become an exposure point in many others, so resilience depends on testing the trust relationships that connect the environment.

Q: What breaks when OT systems are treated like ordinary enterprise IT?

A: Patching cadence, downtime assumptions and control validation all break down. OT often cannot be updated quickly, and outages can affect safety or production, so defenders must rely on compensating controls and continuous testing to prove containment before operational impact occurs.

Q: Why does continuous validation matter for critical infrastructure compliance?

A: Because compliance depends on resilience, not just documentation. If assessments, drills, and vulnerability management do not show that a control still limits real attack paths, the organisation has evidence of intent rather than evidence of effectiveness. Continuous validation gives regulators and operators a common basis for judging control performance.

Technical breakdown

Why static testing fails in critical infrastructure

Penetration tests, audits and tabletop exercises can show intent, but they do not prove how controls behave against live adversary techniques. In critical environments, destructive validation is often impossible, so the control question shifts from configuration correctness to observed efficacy under safe simulation. Adversary-informed validation models attacker behaviours such as privilege escalation, lateral movement and command and control without triggering real payloads. That gives operators empirical evidence about whether a firewall, EDR platform or segmentation rule actually blocks the paths it is supposed to block.

Practical implication: measure control performance with safe adversary simulation rather than relying on annual assurance artefacts.

How IT/OT convergence changes the attack surface

IT and OT no longer sit behind a clean boundary. Remote maintenance, cloud monitoring and vendor connectivity create an entry path where ordinary IT compromise can reach operational systems that were never designed for frequent change. OT environments often contain legacy software that cannot be patched quickly, so exposure persists far longer than it would in corporate IT. The practical issue is not only access, but whether segmentation, access control lists and compensating controls actually stop adversary movement before physical process impact becomes possible.

Practical implication: validate the IT to OT boundary as a live control surface, not as a diagram in a risk register.

Why dependency validation matters more than isolated hardening

Critical infrastructure risk increasingly travels through suppliers, managed service providers and shared software dependencies. A stolen vendor token, over-privileged service account or compromised third-party component can create exposure across multiple operators that never directly share infrastructure. That makes continuous validation useful not only for perimeter defence, but for testing how trust is extended through identity, access and supply-chain relationships. The real question is whether the environment still resists compromise when a trusted dependency is abused as the entry point.

Practical implication: validate third-party access paths and service-account trust as part of resilience testing, not just procurement review.

Threat narrative

Attacker objective: The attacker objective is to turn a trusted connection or shared dependency into a pathway that can disrupt essential services across IT and OT domains.

1. Entry occurs through a trusted dependency, remote maintenance channel or vendor-managed access path rather than through a single isolated perimeter control.
2. Credential or access abuse then enables movement through interconnected IT environments, where over-privileged accounts or weak segmentation can expose OT-adjacent systems.
3. Escalation reaches the point where defenders must prove whether controls stop lateral movement before operational disruption or physical process impact occurs.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Continuous validation is the only defensible way to talk about resilience in critical infrastructure. Annual audits and point-in-time tests answer whether controls existed, but not whether they would still hold when an adversary is actively chaining access, segmentation and dependency abuse. For operators balancing uptime and safety, that distinction is decisive. Practitioners should treat resilience as an evidence problem, not a policy statement.

Control efficacy has become the new trust boundary: in converged environments, the question is no longer whether a firewall, EDR tool or access policy is deployed, but whether it blocks the exact techniques an attacker will use. That shifts governance away from static assurance and toward continuous measurement of defensive outcome. The practitioner conclusion is straightforward: prove controls under realistic pressure or assume they will fail when it matters.

Dependency risk is now a resilience issue, not just a supply-chain issue. The article correctly frames vendor access, service accounts and shared software components as pathways into otherwise well-defended environments. That means identity governance, third-party access review and segmentation testing must be assessed together. Practitioners should validate the trust they extend to suppliers as if it were part of the core operating model.

IT/OT convergence creates a control gap that traditional security programs often under-test. Legacy systems, immovable uptime requirements and remote connectivity mean the most important control is frequently the one least frequently exercised. In that setting, safe adversary simulation is not an add-on to resilience planning, it is how the organisation learns whether compensating controls really contain the blast radius. Practitioners should prioritise validation where replacement and patching are least feasible.

What this signals

Resilience programmes now need evidence loops, not annual assurance cycles. The strongest operational takeaway is that critical infrastructure teams must validate controls at the pace of dependency change, especially where remote access and legacy OT coexist. If the control only works in a lab or audit packet, it is not yet a resilience control.

Continuous validation becomes most valuable where patching is least realistic. That is the central operating lesson for converged environments: compensating controls, segmentation and identity boundaries have to be exercised continuously because replacement cycles are measured in years, not weeks. Practitioners should prioritise the junctions where an attacker can move from trusted connectivity to process impact.

For practitioners

• Validate controls with safe adversary simulation Use breach and attack simulation or continuous automated red teaming to test segmentation, identity paths and detection logic against realistic attacker behaviour without touching the production process.
• Map IT and OT trust boundaries Inventory where remote access, vendor support, monitoring and identity-based connections cross from IT into operational environments, then test the controls that should stop lateral movement at those junctions.
• Test third-party access as a live dependency Review service accounts, vendor tokens and managed-service access paths as operational dependencies, then validate what an attacker could reach if one trusted account were abused.
• Measure control efficacy, not just control presence Track how often key controls actually block adversary TTPs such as privilege escalation, command and control and lateral movement, and use those results in resilience reporting.

Key takeaways

• Critical infrastructure resilience now depends on proving that controls work under adversary conditions, not just showing that they exist in policy or audit evidence.
• Interconnected IT, OT and supplier dependencies can turn a single compromise into wider operational disruption, which makes trust paths a primary validation target.
• The practical response is continuous, safe testing of segmentation, identity paths and compensating controls where patching and shutdowns are not realistic.

Key terms

• Continuous validation: Continuous validation is the practice of re-checking user, device, or session risk after login instead of trusting access indefinitely. It recognizes that identity assurance can drift during a session, especially when endpoint state or user context changes after authentication.
• Adversary exposure validation: Adversary exposure validation measures how far a real attacker could move if a known entry point, dependency, or trusted access path were compromised. It turns attack simulation into a quantified view of reachable systems, helping teams prioritise remediation by likely impact rather than by theory.
• Continuous Automated Red Teaming: Continuous Automated Red Teaming is the ongoing use of automated attack simulations to test security controls, detection, and response. It repeatedly emulates adversary behavior across systems, identities, and workflows, then measures whether defenses detect, block, or contain the activity. The goal is to expose control gaps before real attackers do.
• IT/OT Convergence: The integration of enterprise information systems with industrial operations so data, users and workflows move across both environments. In manufacturing, convergence improves visibility and efficiency, but it also forces identity controls to work across systems that were historically governed very differently.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, machine identity security and secrets management within the industry's only accredited NHI security programme. It helps practitioners translate identity control theory into operational governance across complex environments.