Lateral movement tabletop exercises expose IoT and OT resilience gaps

At a glance

What this is: This is an Elisity analysis of how tabletop exercises can test lateral movement prevention in IoT and OT environments, with the key finding that many organisations still do not know whether their segmentation and response processes would hold under attack.

Why it matters: It matters because IoT and OT estates often include systems that cannot run standard endpoint tools, so IAM, PAM, and network segmentation decisions have to work together before an attacker can pivot across critical operations.

By the numbers:

• The global average cost of a data breach reached $4.88 million, according to IBM's 2024 Cost of a Data Breach Report cited by Elisity.
• Research from Elisity's Microsegmentation Buyer's Guide 2025 indicates that 60% of successful breaches now involve lateral movement.
• Elisity says attackers dwell in networks for an average of 280 days before detection.

Context

Lateral movement is the stage where an attacker, after gaining an initial foothold, pivots from one system to another to expand reach and hunt for valuable targets. In IoT and OT environments, that problem is harder because many devices do not support standard endpoint controls and often sit on networks that were never designed for fine-grained identity governance.

Elisity frames tabletop exercises as a way to test whether segmentation, least privilege, and response coordination actually constrain movement across mixed IT, IoT, and OT estates. That matters most where operational uptime, safety, and regulated systems make manual containment decisions slower and more consequential.

The article is strongest when it treats resilience as an operating test, not a policy claim. A control that exists on paper but fails under an exercise is not yet a control in practice.

Key questions

Q: What breaks when IoT devices are not segmented from core systems?

A: When IoT devices are not segmented, compromise of one weak endpoint can become a bridge into business systems, identity services, or sensitive data stores. Segmentation limits lateral movement, contains malware, and reduces the blast radius when a device is exposed through default credentials, weak firmware, or a remote-execution flaw.

Q: Why does lateral movement create such a high risk for manufacturing and healthcare networks?

A: Lateral movement is dangerous because a single foothold can turn into broad access across connected systems, including OT controllers and medical devices that are hard to patch or monitor. In manufacturing, that can interrupt production. In healthcare, it can affect patient care and sensitive data. The mix of legacy systems, trust relationships, and limited visibility gives attackers room to expand quietly.

Q: What are the signs that lateral movement controls are not working well enough?

A: Weak lateral movement controls usually show up as unusual authentication patterns, unexpected process creation, and network traffic between systems that rarely communicate. Another warning sign is slow detection, because attackers can remain hidden for long periods if monitoring is not baseline-driven. If teams cannot see user, device, and workload activity across segments, their containment model is probably too porous.

Q: Should organisations use tabletop exercises or live red team testing for IoT and OT resilience?

A: They should use both, but for different purposes. Red and purple team testing validates adversary technique and control gaps in depth, while tabletops validate whether people, process, and authority can coordinate containment safely across IT and OT. The better programme combines both, because technical blocking without response coordination still leaves a large blast radius.

Technical breakdown

Why lateral movement is harder to contain in IoT and OT networks

Lateral movement in IoT and OT is not just a detection problem. It is an environment problem, because many connected devices cannot run agents, use legacy protocols, or communicate through paths that bypass conventional monitoring. Once an attacker lands on a dual-homed workstation, vendor remote access path, or weakly segmented controller network, the next pivot often depends more on topology and trust relationships than on malware sophistication. That is why tabletop design has to model the real paths attackers take through industrial and medical environments, not only the initial compromise.

Practical implication: test whether segmentation and access boundaries stop a pivot even when the first device is already compromised.

How tabletop exercises validate segmentation and least privilege access

A useful tabletop does not ask whether a policy exists. It asks whether the policy can stop a specific move from IT to OT, from a vendor connection to a production system, or from a low-value device to a controller or payment network. That makes the exercise a governance test for identity-based access, network isolation, and operational decision rights. If the team cannot explain who can isolate a segment, how exceptions are approved, and what telemetry proves containment, then least privilege is not yet operationalized across the environment.

Practical implication: turn segmentation and least privilege into scenario-specific decisions, not abstract design principles.

What realistic response coordination looks like during a lateral movement exercise

The most revealing tabletop output is often not a technical gap but a coordination gap. In IoT and OT settings, IT security, plant operations, clinical engineering, and leadership may all have different thresholds for shutting down a segment or disconnecting a system. Exercises expose whether those thresholds are documented, whether escalation paths are clear, and whether the organisation can act before lateral movement becomes impact. The result is a clearer view of whether cyber resilience exists across domains or only inside one team’s workflow.

Practical implication: define who can contain cross-domain movement before the exercise, not during the incident.

Threat narrative

Attacker objective: The attacker wants to expand from a single compromised system into operationally critical assets that can be used for disruption, theft, or coercion.

1. Entry commonly begins through phishing, stolen vendor access, or a compromised dual-homed device that connects business IT to plant or operational systems.
2. Once inside, the attacker uses weak segmentation, trusted remote access, or overbroad contractor permissions to move laterally from the first foothold into higher-value zones.
3. The objective is to reach controllers, medical devices, or payment and production systems where disruption, data theft, or operational shutdown creates the greatest leverage.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lateral movement is a governance failure before it is a detection failure: In IoT and OT environments, the decisive question is whether network and identity boundaries still hold after the first foothold. If a contractor login, dual-homed workstation, or exposed device can pivot into production systems, the programme has treated segmentation as architecture rather than as enforceable access governance. The practitioner conclusion is simple: containment has to be proven under realistic movement paths, not assumed from the diagram.

Tabletop exercises expose whether least privilege exists outside IT assumptions: Traditional access models often assume that users, devices, and systems can be certified against stable roles and clear ownership. In mixed IoT and OT estates, those assumptions break down because devices are unmanaged, identities are shared, and operational exceptions are common. The implication is not just stronger controls, but a different governance model for environments where privilege is distributed across technology and operations teams.

Identity-based microsegmentation is really identity blast-radius control: The article makes clear that the point of segmentation is not only to block traffic, but to prevent one compromised identity or device from becoming a path to wider compromise. That is especially relevant in environments with thousands of connected assets, where flat trust becomes operational debt. The practitioner conclusion is to measure how far one compromise can travel, not just whether the first compromise is detected.

OT resilience has to include human decision latency: A tabletop is valuable only if it reveals how long it takes the right people to agree on isolation, exception handling, and recovery. In industrial and healthcare environments, the cost of delay can be physical as well as financial. The field lesson is that resilience maturity is defined by coordination speed under pressure, not by the existence of a response plan.

Cross-domain resilience requires one control story across IT, IoT, and OT: The article shows that attackers do not respect the organisational split between business systems and operational systems. That means identity, segmentation, and monitoring must be governed as one containment problem even when different teams own the assets. The practitioner conclusion is to align control ownership before an exercise reveals that no one can actually stop the move.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Identity blast-radius control: In IoT and OT, segmentation only matters if it limits how far a single compromised login, device, or vendor path can travel. The programme question is not whether controls exist, but whether they still hold when the attack crosses operational boundaries.

Tabletop exercises are most valuable when they test the exact handoffs that usually fail in real incidents: who isolates, who approves, and who owns recovery. If those decisions are unclear, the response plan will slow down at the point where attackers are trying to speed up.

For practitioners

• Define realistic pivot paths Build tabletop scenarios around the exact paths attackers would use in your environment, such as IT-to-OT pivots, vendor remote access, and compromised IoT devices.
• Test containment authority Document who can isolate an engineering workstation, vendor connection, or production segment, and make that authority part of the exercise decisions.
• Validate segmentation under pressure Use the exercise to confirm that identity-based microsegmentation and least privilege access actually block movement between mixed IT and OT zones.
• Measure response latency Track time to detect, time to isolate, and time to coordinate across SOC, OT operations, and leadership when a lateral movement scenario unfolds.

Key takeaways

• IoT and OT resilience depends on whether segmentation and access controls can stop an attacker after the first foothold, not just whether the initial alert fires.
• Elisity links lateral movement to 60% of successful breaches and cites an average dwell time of 280 days, which shows how long weak containment can remain invisible.
• Tabletop exercises are most useful when they prove who can isolate affected systems, how quickly teams can coordinate, and whether the containment model works across IT and OT.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Cybersecurity Tabletop Exercise: A cybersecurity tabletop exercise is a structured discussion that walks a team through a simulated incident to test how they would respond. It validates decision making, communication, and coordination against the incident response plan without touching production systems or creating real disruption.
• Dual-Homed System: A dual-homed system connects to two network domains at the same time, such as corporate IT and a plant or clinical network. That design can create a high-risk bridge for lateral movement unless access boundaries, monitoring, and isolation authority are explicitly governed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.