IT/OT network segmentation is the ransomware containment line

At a glance

What this is: This is an analysis of IT/OT network segmentation as the control that lets manufacturers contain ransomware in corporate IT without stopping production.

Why it matters: It matters because IAM and security teams have to govern cross-boundary access, remote access, and identity-based policy so production systems are isolated without being operationally blinded.

By the numbers:

• Manufacturing ransomware has caused $17 billion in downtime across 858 incidents since 2018.
• Mature microsegmentation is associated with 71.4% faster mean time to contain breaches.
• Network segmentation is one of 12 key controls insurers evaluate during underwriting.

Context

IT/OT network segmentation is the separation of business IT from production OT so compromise in one zone does not automatically cascade into the other. In manufacturing, that boundary is a governance control as much as a technical one, because production availability, safety, and cyber containment all depend on who or what can cross it.

The article’s central point is that ransomware response should not force a choice between shutting down production and accepting lateral movement into controllers, SCADA, or plant systems. That makes identity-based policy, remote-access containment, and boundary enforcement directly relevant to both NHI governance and broader access control design.

Where segmentation is weak or undocumented, teams often discover the true architecture only during an incident. That is when operational assumptions become expensive, and the starting position described here is common rather than unusual in long-lived industrial environments.

Key questions

Q: What breaks when IT and OT share a flat network during ransomware incidents?

A: A flat IT/OT network breaks the containment model because defenders cannot prove that production systems are clean before they decide whether to shut them down. The result is either uncontrolled lateral movement or an expensive total shutdown. Segmentation changes the response from enterprise-wide outage to bounded isolation.

Q: Why do cross-boundary OT paths increase ransomware risk?

A: Cross-boundary OT paths increase risk because any trusted route can become a bridge for malware once an attacker reaches business IT. If those paths are broad, persistent, or poorly documented, the attacker inherits the organisation’s hidden trust assumptions. Narrow, identity-bound access reduces the chance that one compromise becomes plant-wide disruption.

Q: How do teams know whether IT/OT segmentation is actually working?

A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations. A valid test is whether cross-boundary access is limited to approved identities and whether blocked paths remain blocked during a live containment drill.

Q: Who should be accountable for production boundary decisions in manufacturing?

A: Accountability should sit jointly across security, OT operations, and business नेतृत्व, because the boundary is both a cyber control and an operational risk decision. IT can define enforceable policy, OT can validate production dependencies, and leadership must own the trade-off between containment and continuity.

Technical breakdown

Why flat IT/OT networks turn ransomware into a production decision

A flat network treats corporate systems and operational systems as if they share the same trust zone. Once ransomware reaches the business network, the attacker can probe for reachable assets, pivot through weak firewall rules, and force defenders to choose between containment and continuity. In manufacturing, that is especially dangerous because SCADA servers, historians, engineering workstations, and PLC-adjacent services often depend on predictable communications. If segmentation is missing, the incident response problem becomes an availability problem.

Practical implication: map every IT-to-OT route and remove any path that is not explicitly required for production.

How identity-based microsegmentation enforces the boundary

Identity-based microsegmentation applies policy to the device or workload identity rather than only to location or VLAN membership. That matters because production systems may move, scale, or connect through shared infrastructure while still needing different rules. The control plane can allow a PLC to talk only to its historian and approved engineering workstation, while denying all other cross-boundary traffic. This is a stronger model than relying on perimeter trust or broad subnet rules because policy follows the authorised relationship, not the network topology alone.

Practical implication: bind OT communication rules to verified device identity and minimum required destinations, not broad network ranges.

Why remote access and third-party paths need the narrowest possible scope

Vendor maintenance, emergency access, and supply-chain connectivity often become the hidden bridge between IT and OT. If those paths are too broad, a compromised credential or remote session can turn one device-level issue into a site-wide problem. Segmentation works only when exception paths are as constrained as the production rules they bypass. That means cross-boundary access should be time-bound, purpose-bound, and limited to the exact device or service being serviced, with no lateral movement into adjacent systems.

Practical implication: restrict remote vendor and maintenance access to a single asset and remove any ability to pivot to other OT or IT systems.

Threat narrative

Attacker objective: The attacker wants to maximise operational disruption and leverage the lack of enforced separation to force defenders into a costly shutdown.

1. Entry begins in corporate IT, where ransomware can land through email, administrative systems, or other business-facing infrastructure.
2. Escalation occurs when the malware can move laterally because IT and OT share weak or undocumented boundaries.
3. Impact is the forced shutdown of production or the exposure of active lines, which turns a cyber incident into a manufacturing continuity event.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

IT/OT segmentation is now a continuity control, not just a security control. In manufacturing, the real governance question is whether the organisation can preserve production during an IT compromise. That shifts segmentation from an architecture preference to a business resilience decision, especially where downtime, safety, and batch integrity intersect. Practitioners should treat cross-boundary access as a production-critical risk domain.

Identity-based boundary enforcement is the right mental model for industrial access. Network location alone is too blunt for environments where devices, services, and vendors all need different levels of access. The important question is which identity is authorised to talk to which production asset, under what conditions, and with what blast radius. That is where IAM, NHI governance, and OT segmentation genuinely meet.

Standing trust across the IT/OT boundary is the named failure mode here. The article exposes a governance assumption that any cross-network path is acceptable until an incident proves otherwise. In practice, that creates a hidden dependency on the integrity of every connected business system. The stronger posture is to assume breach at the IT edge and make production continuity survive that assumption.

Segmentation policy design has to reflect operational criticality. A laboratory analyser, a plasma line, and an ERP server do not deserve equal trust just because they sit in the same enterprise. The security model has to encode business consequence, not only topology. That means the production boundary should be explicit, tested, and owned jointly by IT, OT, and leadership.

Microsegmentation creates an enforceable governance boundary that insurers and regulators can evaluate. When network paths are narrow and auditable, incident containment becomes measurable rather than aspirational. That matters because industrial resilience is increasingly being judged through architecture, not policy statements. Practitioners should expect segmentation evidence to influence insurance scrutiny, operational assurance, and recovery planning.

What this signals

Production boundary governance is becoming a core resilience discipline. The organisations that perform best will be the ones that can prove which identities may cross from IT into OT and why. That shifts the conversation from blanket shutdowns to controlled containment.

Identity-based segmentation is the meaningful control shift here. In industrial environments, policy has to follow the authorised device or service, not just the subnet. That is a direct governance intersection for IAM and NHI teams because cross-boundary access is only safe when identity, privilege, and destination are tightly coupled.

Boundary evidence matters more than boundary intent. Many manufacturers believe they are segmented until an incident map shows otherwise. The practical signal to watch is whether production traffic still depends on broad trust paths, shared administration, or undocumented remote access.

For practitioners

• Define the IT/OT trust boundary explicitly Document every approved cross-boundary communication path and remove any route that exists only because it was never challenged.
• Bind OT access to verified identity Use identity-based segmentation so only approved engineering workstations and designated services can reach production controllers.
• Constrain remote vendor access to one asset Limit maintenance sessions to the exact OT device being serviced and block any lateral movement into adjacent systems.
• Test containment without stopping production Validate that ransomware on corporate IT can be isolated while OT-to-OT traffic and line operations continue normally.
• Align segmentation policy with business criticality Give the highest isolation to the production processes whose failure would destroy material, delay patient supply, or halt shipments.

Key takeaways

• Flat IT and OT networks turn ransomware into a production shutdown decision because defenders cannot isolate one environment without gambling on the other.
• Identity-based segmentation changes the operating model by limiting which devices and services may cross the IT/OT boundary.
• Manufacturing leaders should treat production boundary design as a resilience control that affects downtime, insurance scrutiny, and batch continuity.

Key terms

• It/ot segmentation: IT/OT segmentation is the separation of business technology from operational technology so compromise in one environment does not automatically spread to the other. In manufacturing, it limits how ransomware, credentials, and remote sessions can cross into production control networks.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Identity-based Policy: An identity-based policy attaches to a user, group, or role and defines what that identity is allowed to do. It travels with the identity rather than the target resource, which makes it useful for central entitlement management. The main governance risk is allowing these policies to grow broader over time.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps practitioners connect identity control to the broader security decisions their programmes depend on.