Exposed OT assets and weak credentials expand the attack surface

At a glance

What this is: NHI Mgmt Group's analysis, drawing on runZero's blog post: IT and OT convergence is widening the attack surface, with exposed control systems, default credentials and edge devices creating reachable paths into critical infrastructure.

Why it matters: This matters because IAM, PAM and segmentation controls only work when operators know which assets are exposed, which credentials remain valid and how an intruder could pivot between IT and OT.

Context

Critical infrastructure security now depends on knowing where operational technology sits, how it is reachable and which trust assumptions still hold. In converged environments, visibility gaps become access gaps, especially when remote administration, supplier access and legacy edge devices are all part of the same operational fabric. critical infrastructure identity security matters because exposure is no longer just a network issue; it is an access governance problem.

OT and IT networks were designed for different priorities, so convergence often creates shared exposure without shared governance. That makes asset discovery, segmentation validation and credential control part of the same defensive problem. The article's starting position is typical for modern critical infrastructure, where unknown exposure is common and trust boundaries have already blurred.

Key questions

Q: How do exposed PLCs increase critical infrastructure risk?

A: Exposed PLCs increase risk because they move industrial control from a protected operational boundary into a reachable attack surface. Once a PLC is reachable from the internet or through a weak intermediary, an attacker can discover it, probe its services and use it as a foothold into processes that affect physical operations.

Q: Why do default credentials remain dangerous in operational technology?

A: Default credentials are dangerous because they often survive device deployment, are reused across fleets, and create a predictable foothold for attackers. In OT, that foothold can persist far longer than in IT because devices are harder to reimage, patch, or replace.

Q: How does IT/OT convergence create lateral movement paths?

A: IT/OT convergence creates lateral movement paths when connected business systems, plant systems, shared networks, and remote access channels let an attacker move from a less protected IT foothold into OT control assets. Shared networks, remote access channels, flat routing, and trusted jump hosts can turn one compromised account or endpoint into broader access unless segmentation, separate admin paths, and tight allowlisting limit reach.

Q: What is the best way to validate segmentation in OT environments?

A: The best way to validate segmentation in OT environments is to test from real source zones and confirm only intended reachable services and administrative routes are open. Use deny-by-default rules, packet and flow checks, route review, and controlled probe traffic to verify that engineering stations, HMIs, historians, and remote admin paths cannot reach unrelated zones.

Technical breakdown

Why exposed PLCs become reachable attack surface

Programmable logic controllers are industrial control devices that can receive commands affecting physical processes. Once a PLC is directly exposed, or reachable through too many hops, it is no longer protected only by plant logic or internal trust. Attackers do not need deep knowledge of every industrial protocol if they can locate the device, observe how it is addressed and identify a path to it through routing, VPNs or remote access layers. In converged environments, the security problem is not merely device presence but whether the device can be discovered from outside the operational boundary. See the OT Asset Visibility Guide.

Practical implication: Inventory PLC exposure continuously and reduce direct reachability before an external path becomes an operational incident.

Default credentials and the trust of valid access

Default credentials remain dangerous because they transform an exposed device into an authenticated one with almost no attacker effort. In OT, the problem is often not password complexity in the abstract but the existence of credentials that still work on equipment that was never fully onboarded into identity governance. When edge devices, routers or field systems retain vendor defaults, the attacker gains access that looks legitimate to the system, which weakens both prevention and detection. This is a credential governance failure as much as a device-hardening failure. Read Top 10 OT Security Risks.

Practical implication: Remove default and shared credentials from OT and edge devices, then treat any surviving default login as an active exposure.

Attack path mapping across IT and OT

Attack path mapping shows how an adversary could move from an initial foothold to a high-value system by following reachable services, weak trust relationships and segmentation breaks. In IT/OT convergence, that matters because the path is often not linear. A foothold in an internet-facing appliance, remote access channel or adjacent IT segment can become a bridge into OT if trust boundaries are porous. The value of mapping is not theoretical visibility; it is understanding where lateral movement would actually succeed under current configurations. See the Control Mapping Guide.

Practical implication: Use attack path analysis to test whether your segmentation stops real movement, not just expected movement.

Threat narrative

Attacker objective: The attacker aims to gain a reachable path into critical infrastructure that can be used for disruption, positioning or physical-world impact.

1. Entry occurs through exposed OT assets, default credentials or vulnerable edge devices that are reachable from the internet or adjacent IT networks.
2. Escalation follows when the attacker uses those reachable paths to move from a foothold into OT-connected systems or control surfaces.
3. Impact emerges when commands, availability or physical effects can be influenced through the compromised control path.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Critical infrastructure exposure is now an identity problem as much as a network problem. The central failure mode is not only that systems are online, but that operators often cannot tell which paths are authenticated, which are default, and which should no longer exist. In converged environments, that creates a governance gap between asset visibility and access assurance. Practitioners should treat exposed OT as governed access surface, not just unmanaged infrastructure.

Default credentials create a standing privilege problem in environments that were never fully onboarded into IAM. When devices and edge systems still accept factory or weak credentials, the environment preserves access that looks legitimate to the target. That makes discovery, credential hygiene and offboarding inseparable from OT hardening. Top 10 OT security risks is useful here because the issue is not just exposure, but access that remains silently valid.

IT/OT convergence widens attack paths faster than segmentation reviews usually catch them. The article's core warning is that trust assumptions built for isolated OT no longer survive hybrid deployment patterns. Once remote access, VPNs and shared administrative planes are in play, attackers only need one weak hop to reach systems that were meant to stay separate. Practitioners should validate segmentation against real attacker movement, not diagrammed intent.

Exposure management for critical infrastructure has become an asset-identity discipline. Visibility into hosts is no longer enough if defenders cannot also answer who can authenticate, from where, and with what scope. That is why inventory, credential control and route analysis now belong in the same programme. Security teams should govern OT reachability as a lifecycle issue, not a point-in-time audit.

What this signals

Reachability now defines much of critical infrastructure risk. Defenders need to assume that any internet-facing control system, gateway or maintenance channel can become the first step in a broader compromise. The practical question is no longer whether the asset exists, but whether its path to operation is still defensible.

OT visibility must include trust paths, not just devices. A live inventory that does not show remote access, default authentication and pivot routes will miss the control failures that matter most. Programmes that join asset discovery to identity governance will be better placed to limit exposure before attackers do.

For practitioners

• Audit external reachability for PLCs and edge devices Identify every PLC, router, VPN endpoint and remote access path that can be reached from the internet or from adjacent IT segments, then remove or constrain anything unnecessary.
• Eliminate default and shared credentials on OT assets Search for factory passwords, reused administrator accounts and weak local logins on industrial assets and edge appliances, then rotate or remove them before they are exposed to attackers.
• Validate segmentation with attack path analysis Model how a foothold in IT or an exposed appliance could pivot into OT, and test whether current segmentation actually blocks those movements.
• Review remote access trust relationships Examine vendor access, admin jump paths and maintenance channels to confirm that every remote route is justified, monitored and limited to the smallest practical scope.

Key takeaways

• Critical infrastructure exposure is increasingly created by the combination of reachable assets, weak credentials and blurred IT/OT boundaries.
• The article points to a measurable increase in exposed OT gear and exploited edge technology, which makes simple perimeter assumptions unreliable.
• Operators need to connect asset visibility, segmentation validation and credential control if they want to reduce real-world attack paths.

Related NHI Mgmt Group resources: OT Asset Visibility Guide · Top 10 OT Security Risks · Control Mapping Guide · Critical Infrastructure Identity Security Guide

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Programmable Logic Controller: A Programmable Logic Controller is an industrial device that executes control logic for machinery and processes. PLCs are often trusted to run continuously, so unauthorized access can alter physical behaviour quickly. In modern SCADA governance, PLC access must be tightly scoped and traceable.
• IT/OT Convergence: The integration of enterprise information systems with industrial operations so data, users and workflows move across both environments. In manufacturing, convergence improves visibility and efficiency, but it also forces identity controls to work across systems that were historically governed very differently.
• Default Credential: A default credential is a factory-set or preset username, password, or secret that remains unchanged after deployment. In NHI environments, it is a high-risk failure because it creates predictable access to privileged systems and often survives into production unless ownership and hardening are explicitly enforced.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader security programmes that depend on them.