IT/OT convergence exposes identity governance gaps in industrial firms

At a glance

What this is: This analysis says IT/OT convergence is creating identity governance gaps because industrial firms are managing access across separate physical and digital environments with disconnected identity data and inconsistent controls.

Why it matters: It matters because IAM, IGA, and OT security teams need one governance model for access visibility, role design, and recertification when industrial operations and enterprise systems now overlap.

Context

Industrial IT/OT convergence is the blending of operational technology that runs physical processes with information technology that manages digital systems and data. In practice, that means identity governance has to span environments that were built with different assumptions about access, safety, and change control.

The governance gap appears when organisations try to manage user access through separate teams, separate data sources, and separate operational priorities. In industrial settings, that split can leave CISOs and CIOs without a complete view of who can access critical systems, which weakens both security oversight and compliance assurance.

Gathid's analysis frames digital twins and knowledge graphs as the mechanisms for unifying access visibility across these domains. The broader point is that convergence exposes an identity model problem before it becomes a tooling problem.

Key questions

Q: How should industrial firms govern access across IT and OT systems?

A: They should govern effective access across both environments as one model, even if the systems stay separate operationally. That means correlating identities, roles, inherited permissions, and third-party paths so plant safety, operational reliability, and enterprise IAM decisions are not made in isolation. A single governance view is the starting point for control.

Q: Why do toxic role combinations matter in converged environments?

A: They matter because access that is safe in one domain can become dangerous when combined with another domain’s privileges. In industrial settings, a user may have acceptable OT access and still create a material risk when that access is paired with IT administration, cloud control, or vendor-connected entitlements.

Q: What are the signs that cross-domain identity governance is failing in industrial firms?

A: The warning signs are fragmented identity records, inconsistent role definitions, and review processes that never evaluate OT and IT access together. If different teams can each approve access without seeing the full entitlement picture, governance is already incomplete.

Q: What is the difference between a knowledge graph and a digital twin in identity governance for AI?

A: A knowledge graph provides the connected view of identities, roles, systems, and permissions, so teams can see where access risk exists. A digital twin simulates those policies and access paths in a safe environment before changes go live. Used together, they support both visibility and testing, which is essential when AI needs access across multiple business functions.

Technical breakdown

Why air-gapped OT and IT identity data breaks governance

Air-gapped or semi-separated industrial environments often keep identity data in different systems, under different owners, and with different records of roles and entitlements. That fragmentation makes it difficult to reconcile who has access across the full environment, especially when industrial operations rely on physical infrastructure, third-party systems, and enterprise applications at the same time. Identity governance depends on a consistent source of truth for access decisions, but siloed records create mismatched role definitions and stale approvals. The result is not just administrative complexity but governance drift, where access remains technically valid in one domain while operationally inappropriate in another.

Practical implication: unify identity data across OT and IT before recertification or role cleanup can be trusted.

How toxic role combinations emerge in converged industrial environments

A toxic role combination is a set of entitlements that looks acceptable in isolation but becomes risky when combined across systems. In industrial firms, this can happen when a user inherits access from both OT operations and IT administration, or when separate approval chains fail to evaluate the combined blast radius. The article points to excessive or inappropriate access as a direct consequence of inconsistent governance. The technical issue is that role models built for one domain do not always translate cleanly into the other, so the same identity can accumulate permissions that were never intended to coexist.

Practical implication: analyse composite roles across domains, not just individual entitlements inside one platform.

Why digital twins and knowledge graphs matter for access visibility

Digital twins and knowledge graphs are both about modelling relationships, but they do it in different ways. A digital twin mirrors a physical or logical environment so changes can be observed in context, while a knowledge graph links identities, roles, permissions, and assets as connected entities. For convergence use cases, that relationship model matters because governance questions are relational: who can reach which system, through what chain of roles, and under what operational constraints. Without that relationship layer, industrial teams see records rather than access patterns, which limits their ability to spot overexposure early.

Practical implication: use relationship-based modelling to surface access paths that flat lists and spreadsheets cannot show.

Threat narrative

Attacker objective: The end state is broader and less visible access to critical industrial systems across domains that were never governed as a single identity estate.

1. Entry begins when industrial firms connect previously separate OT and IT environments, creating new paths between identity domains that were not governed as one system.
2. Privilege escalates when separate teams and siloed records allow a user to accumulate unrelated entitlements across physical and digital infrastructure.
3. Impact follows when toxic role combinations and poor visibility leave critical systems overexposed, increasing both security risk and compliance exposure.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

IT/OT convergence creates an identity governance problem before it creates a technology integration problem. The article shows that industrial firms are not only linking systems, they are merging control domains that were previously governed differently. That changes the unit of analysis from a single application or plant network to a shared access estate. Practitioners should treat convergence as an identity architecture issue, not a reporting issue.

Toxic role combinations are the governance failure pattern that convergence makes visible. When OT and IT entitlements are reviewed in isolation, excessive access can remain hidden until the combined permissions are examined. This is why recertification, role mining, and entitlement reviews need to work across both environments at once. The practitioner conclusion is simple: review the aggregate access path, not the local one.

Digital twin identity models can improve industrial access governance only if the underlying identity data is reconciled first. A twin or graph can expose relationships, but it cannot correct contradictory role data, missing ownership, or inconsistent lifecycle records. That means visibility tooling is downstream of identity data quality. Industrial programmes should fix the source records that feed the model before expecting the model to drive governance.

Cross-domain access visibility is now a safety and compliance issue, not just an IAM reporting gap. In industrial environments, the consequence of not knowing who can access what is not limited to audit findings. It can affect operational reliability, physical process integrity, and the ability to demonstrate control over critical systems. The field implication is that industrial identity governance must be managed as part of operational resilience.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide

What this signals

Cross-domain identity visibility is becoming a core industrial control. As OT and IT converge, access decisions can no longer be assessed inside one team, one system, or one approval chain. Industrial programmes need a shared governance layer that exposes who can reach critical systems across both operating contexts.

Relationship-based identity models will matter more than static entitlement lists. Digital twins and knowledge graphs are useful because industrial access risk is relational, not just numerical. They help teams see how users, roles, and systems combine into a real exposure path, which is where toxic role combinations are most likely to hide.

For practitioners

• Map OT and IT identity sources into one governance view Inventory the identity repositories, approval paths, and role models that exist separately in industrial and enterprise environments, then reconcile them into one access catalogue for review.
• Identify toxic role combinations across domains Review users who hold both operational and administrative access and test whether the combined permissions create an unacceptable path to critical systems.
• Align recertification to cross-domain access paths Run access reviews on the full access chain, including physical security, OT engineering, and IT entitlements, so domain-specific approvals do not hide aggregate risk.
• Use relationship modelling for industrial access analysis Apply digital twin or knowledge graph techniques to connect identities, roles, permissions, and assets so the organisation can see exposure patterns instead of isolated records.

Key takeaways

• Industrial convergence turns identity governance into a cross-domain problem because OT and IT controls were never designed to share the same access model.
• The main risk is not just extra access, but hidden combinations of entitlements that become unsafe when they span operational and enterprise systems.
• The practical response is to build one reconciled view of identities, roles, and permissions before relying on reviews, twins, or graph models.

Key terms

• Toxic Role Combination: A set of permissions that should not exist together in one identity because they create conflict, excessive access, or separation-of-duties risk. Graph analysis is useful here because it can trace how multiple roles intersect across systems and reveal hidden combinations that standard reports miss.
• Digital Twin: A digital twin is a high-fidelity virtual representation of a physical system, environment, or process. In security and identity work, it becomes sensitive when it is used to generate data, validate models, or control real-world decisions, because access to the twin can expose operational knowledge and deployment paths.
• Knowledge Graph: A knowledge graph is a data model that stores entities and the relationships between them instead of treating records as isolated rows. In security, it helps teams explain how identities, permissions, tokens, and resources connect, which is essential for understanding access paths and risk propagation across SaaS and NHI environments.
• Cross-Application Access Governance: Cross-application access governance is the practice of managing entitlements across multiple systems from a unified control view. It helps teams see how access accumulates across applications, identify excessive permissions, and apply policies consistently when identities, roles, and business processes span a large enterprise environment.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.