IT/OT convergence expands attack surface across industrial operations

At a glance

What this is: This guide explains how IT/OT convergence changes industrial architecture, and its key finding is that added connectivity increases security exposure while the operational constraints of OT make standard IT controls hard to apply.

Why it matters: It matters because IAM, network segmentation, and access governance now sit at the boundary between enterprise systems and production environments, where a compromise can move from data loss to downtime or safety impact.

By the numbers:

• 96% of OT security incidents originate from IT-level compromises, according to TXOne Networks' 2026 Annual OT/ICS Cybersecurity Report.

Context

IT/OT convergence connects business systems to industrial control environments, which means the security boundary is no longer a simple network edge. The central governance problem is that IT controls are designed for data confidentiality and rapid change, while OT controls are designed for safety, uptime, and deterministic behaviour.

In industrial environments, that mismatch becomes an access and change-control issue as much as a networking issue. When engineers, vendors, remote access tools, and cloud analytics all cross the same boundary, identity, segmentation, and operational discipline become part of production risk management rather than separate security concerns.

Key questions

Q: What breaks when IT and OT networks are not segmented?

A: When IT and OT are not segmented, ransomware can move from business systems into production systems, and defenders often cannot prove where compromise stops. That uncertainty turns a containment problem into an outage decision. In manufacturing, the result can be a full shutdown, lost material, delayed shipments, and higher recovery cost than the initial intrusion.

Q: Why do IT-side compromises so often become OT incidents?

A: Because the initial foothold often lands in identity, remote access, or enterprise infrastructure, and those paths are already trusted by default in too many plants. Once an attacker has valid access or a compromised gateway, weak segmentation and shared administration practices can carry the compromise into production systems.

Q: What are the signs that IT/OT convergence is being governed poorly?

A: Common warning signs are flat connectivity between enterprise and plant systems, long-lived vendor access, unclear ownership of boundary systems, and reliance on manual exceptions instead of documented policy. Another signal is when security changes are treated as production disruptions rather than expected governance work.

Q: Who should own risk decisions at the IT/OT boundary?

A: Risk ownership has to be shared, but it cannot be vague. OT operations, engineering, and security need explicit roles for approving connectivity, approving exceptions, and deciding when a path is isolated or removed. If no one owns the boundary, the boundary controls will erode through convenience and urgency.

Technical breakdown

How IT/OT convergence changes trust boundaries

Convergence collapses the separation that once kept enterprise systems away from controllers, HMIs, historians, and engineering workstations. In OT, many protocols were built for closed networks and do not assume strong authentication or encryption, so the trust boundary has to be recreated with brokered access, inspection, and strict directionality. The issue is not only connectivity. It is that every new path into the plant becomes a potential control-plane path if it is not explicitly governed. That makes identity, network policy, and protocol mediation part of the industrial security architecture.

Practical implication: Treat every new IT-to-OT connection as a governed trust path, not a convenience link.

Why legacy OT assets complicate security controls

OT environments often contain long-lived systems that cannot be patched, rebooted, or replaced on IT timelines. Many assets run unsupported operating systems or depend on vendor-qualified maintenance windows, which means conventional endpoint hardening and rapid remediation are unrealistic. The result is a compensating-control model: segmentation, virtual patching, access restriction, and tight change management do more of the security work than software updates do. This is why the OT security problem is fundamentally operational, not just technical.

Practical implication: Build compensating controls around assets that cannot absorb normal IT patch and reboot cycles.

Why IT-level compromise so often reaches OT

Attackers commonly enter through phishing, stolen credentials, VPN abuse, or compromised remote-access gateways, then move laterally through flat or weakly controlled connections. Once inside the IT side, they look for paths into engineering workstations, remote maintenance interfaces, and supervisory systems. That movement is easier when identity, network, and vendor-access controls are fragmented across teams. The control failure is usually not a single exploit but a chain of permissive connectivity and weak boundary governance.

Practical implication: Hunt for paths from enterprise identity and remote access into OT before they become lateral-movement routes.

Threat narrative

Attacker objective: The attacker aims to turn IT compromise into operational disruption or unsafe production impact inside the OT environment.

1. Entry typically begins in IT through phishing, stolen credentials, compromised VPNs, or a vulnerable remote-access gateway.
2. The attacker then abuses permissive connectivity or weak segmentation to move toward engineering workstations, HMIs, or other OT-adjacent systems.
3. If the boundary is not controlled, the impact can be production shutdown, equipment damage, or safety-relevant disruption rather than only data theft.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

IT/OT convergence is now an identity and boundary-governance problem, not just a network design problem. The article makes clear that the security challenge begins when enterprise access, remote administration, and vendor connectivity cross into environments that were never built for broad trust. For IAM and PAM teams, the implication is that identity governance must extend to industrial zones, not stop at the office network.

Standing access assumptions break down faster in OT than in most enterprise environments. OT systems often cannot accept the same pace of patching, rebooting, or agent deployment that IT teams expect, so access paths tend to outlive the controls built around them. That creates a governance gap where connectivity persists longer than the operational need. Practitioners should treat persistent remote access as an exposure condition, not a convenience.

IT/OT convergence creates a controllability gap that conventional IT metrics can miss. The article shows that security success in OT is not measured by how aggressively systems are updated, but by whether production remains safe and stable under constrained change. That shifts the question from volume of controls to fit-for-purpose controls, including segmentation, brokered access, and change approval discipline.

Zero-trust ideas only translate into OT when they respect industrial determinism. Reauthentication, segmentation, and least privilege are still relevant, but they must be implemented in a way that does not break timing, safety, or vendor support constraints. The practical conclusion is that OT zero trust has to be engineered around process continuity, not imported wholesale from enterprise IT.

Industrial cybersecurity maturity depends on shared ownership across IT, OT, and engineering. The article repeatedly points to the human and governance split between teams with different priorities and vocabularies. That makes cross-functional access policy, exception handling, and incident response a first-order control problem. Organisations that do not assign clear ownership at the boundary will keep inheriting risk across teams.

What this signals

IT/OT convergence is forcing security programmes to govern production connectivity as a boundary problem. The practical shift is from protecting separate environments to controlling the handoff between them. Teams that still manage OT as an isolated niche will miss the access paths, vendor workflows, and remote links that now define real exposure.

Access governance must extend into operational change control. In converged environments, the question is not simply who can log in, but who can reach a control path, when, and under what operational constraints. That makes task-scoped access, brokered sessions, and documented exceptions more important than broad network trust.

Industrial resilience depends on preserving safety while reducing trust. Security controls that are normal in IT can be disruptive in OT, so the programme challenge is to reduce exposure without breaking production timing or maintenance windows. That calls for a boundary-first operating model rather than a patch-first reflex.

For practitioners

• Map every IT-to-OT connection Inventory remote access, historian feeds, vendor paths, cloud links, and any brokered service that crosses the industrial boundary. Classify each path by business purpose, required direction of flow, and the systems it can reach.
• Enforce segmented industrial zones Place the OT boundary behind an industrial DMZ and separate critical assets into zones and conduits so compromise cannot spread laterally through the plant.
• Apply compensating controls to legacy assets Use virtual patching, protocol-aware inspection, and tightly controlled maintenance windows where OT endpoints cannot be patched or rebooted safely.
• Tighten privileged remote access Restrict engineering and vendor access to task-scoped approvals, monitored sessions, and explicit revocation when work is complete.
• Test OT-inclusive incident response Run scenarios that assume the incident crosses from IT into OT, and verify that plant operations, engineering, and security teams know who can isolate systems without stopping production unnecessarily.

Key takeaways

• IT/OT convergence expands the attack surface by bringing enterprise connectivity, remote access, and cloud analytics into environments built around safety and uptime.
• The biggest failure mode is boundary leakage, where IT compromise moves into OT through permissive access paths, weak segmentation, or unmanaged vendor connections.
• Practical defence depends on industrial DMZs, brokered access, compensating controls for legacy systems, and shared ownership between IT, OT, and engineering.

Key terms

• IT/OT Convergence: The integration of enterprise information systems with industrial operations so data, users and workflows move across both environments. In manufacturing, convergence improves visibility and efficiency, but it also forces identity controls to work across systems that were historically governed very differently.
• Industrial DMZ: An Industrial DMZ is a segmented network zone placed between business IT and operational technology networks to control and inspect traffic. It reduces direct trust between environments, but only if routing, remote access, and data transfers are tightly limited and monitored, since attackers often use weakly protected jump paths and shared services to cross it.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.
• Deterministic operation: Deterministic operation means a system is expected to respond within predictable timing constraints. In OT, that requirement is central because delays can affect process stability, safety, or product quality, making many standard IT security actions too disruptive if applied without adaptation.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, and secrets management. It helps practitioners connect identity controls to the operational risks that arise when access crosses complex boundaries.