Living off the land attacks in OT expose the segmentation gap

At a glance

What this is: Elisity says living off the land attacks in OT succeed because native protocols and trusted admin paths outrun traditional detection, exposing a segmentation gap.

Why it matters: For IAM and OT security teams, the article reinforces that access scope and communication boundaries matter more than endpoint telemetry when attackers abuse legitimate tools and industrial protocols.

By the numbers:

• 56% of Dragos penetration tests in 2025 successfully abused living off the land tools without triggering a single alert.
• 81% of architecture assessments identified poor IT/OT segmentation.

Context

Living off the land in OT means adversaries use the protocols, admin paths, and trusted devices already present in industrial environments rather than relying on custom malware. That changes the defence problem from simple detection to control of who and what can talk across the OT fabric, especially where engineering workstations, jump hosts, and shared infrastructure bridge IT and control networks.

The article's core claim is that poor segmentation creates the real attack surface. In OT, native protocols such as Modbus, EtherNet/IP, OPC-UA, DNP3, and IEC 104 can make malicious activity look identical to routine operations, so identity-aware network boundaries and microsegmentation become central governance issues rather than optional hardening.

This is a familiar pattern in converged environments: once a trusted administrative path is compromised, the attacker often does not need to break protocol security to move laterally. The starting point described here is common in modern OT estates, which is why the gap is architectural rather than exceptional.

Key questions

Q: What breaks when manufacturing networks rely on VLANs for segmentation?

A: VLANs create broad trust zones, so once an attacker enters a segment, they can often move laterally to other reachable devices inside the same zone. In manufacturing, that is especially dangerous because OT assets often share infrastructure and cannot all be protected with agents or frequent redesign. The control fails when location is treated as trust.

Q: Why do trusted OT admin paths increase lateral movement risk?

A: Because authentication to a VPN, jump host, or shared service does not limit what the session can reach after login. Once attackers steal or abuse those credentials, they inherit the same broad reach as legitimate operators. The risk rises when those paths bridge multiple environments or process zones without separate policy.

Q: How do teams know whether IT/OT segmentation is actually working?

A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations. A valid test is whether cross-boundary access is limited to approved identities and whether blocked paths remain blocked during a live containment drill.

Q: When should OT teams prioritise segmentation over more detection tooling?

A: When the environment contains legacy controllers, unauthenticated protocols, or assets that cannot run endpoint agents, segmentation should come first. Detection still matters, but it cannot prevent movement once an attacker is already using trusted tools and native protocols. In those conditions, constraining reach is the stronger control.

Technical breakdown

Why native OT protocols make living off the land hard to detect

OT protocols were built for reliability and deterministic control, not strong authentication or content inspection. That means a valid command sent over Modbus, EtherNet/IP, OPC-UA, DNP3, or IEC 104 can look operationally normal even when issued by an attacker. Because many devices cannot host endpoint agents, defenders lose the telemetry that EDR depends on in IT. The result is that protocol fluency becomes an attacker advantage, and detection must be backed by network-level control that limits which devices can exchange commands at all.

Practical implication: treat protocol legitimacy as insufficient and enforce device-level communication policy around OT traffic.

Why segmentation failures create the lateral movement path

In flat or weakly segmented OT zones, a compromised engineering workstation can reach PLCs, HMIs, relays, and other field assets that do not need to communicate with each other. VLANs and broad Purdue boundaries reduce exposure only at a coarse layer, but they do not stop lateral movement within a zone. Microsegmentation changes the enforcement point from the subnet to the asset relationship, so the attacker's valid command still gets blocked if the destination is outside the device's authorised scope. This is especially important where shared VPNs, jump servers, or historian links bridge IT and OT.

Practical implication: map and restrict every unnecessary intra-zone path before an attacker uses it as a pivot.

Why monitoring alone cannot close the OT control gap

OT monitoring platforms can help you see what happened, but they do not stop an adversary from using standard administrative tools or native industrial commands. That distinction matters because many OT compromises start with legitimate credentials, then move through trusted infrastructure and protocol-consistent actions. The control problem is therefore one of blast-radius reduction and enforced segmentation, not just alert tuning. If a defender can only observe the attack after it has crossed the boundary, the architecture has already granted too much trust.

Practical implication: pair visibility tooling with enforcement controls that reduce what a compromised account or workstation can reach.

Threat narrative

Attacker objective: The attacker wants to move from initial compromise into OT control paths that allow reconnaissance, disruption, or long-term persistence across industrial systems.

1. Entry begins with compromise of an IT foothold, often through phishing, exploited remote access, or stolen third-party credentials that already bridge into OT-adjacent infrastructure.
2. Credential access and pivoting follow as attackers harvest administrative credentials, then use shared VPNs, jump hosts, or domain-linked infrastructure to reach the OT environment.
3. Escalation occurs when the adversary uses native industrial protocols and trusted engineering tools to enumerate assets and issue valid commands without needing custom malware.
4. Impact is achieved when process visibility, disruption, or persistence is gained across control assets that were insufficiently segmented from one another.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT living off the land is fundamentally a segmentation failure, not a detection failure. The article's evidence shows that legitimate industrial commands can blend into normal traffic because the protocols themselves were not designed to prove intent. In that environment, alerts are always downstream of the real problem. Practitioners should therefore judge control quality by how tightly the architecture constrains lateral movement, not by how much telemetry it collects.

Identity-aware segmentation is the missing control plane for converged OT estates. Once engineering workstations, jump hosts, and shared remote access channels become trusted bridges, attackers inherit that trust and use it operationally. That makes device identity, communication role, and conduit policy central to OT governance, especially where the same administrative path can touch multiple process zones. Practitioners should align OT architecture to enforced trust boundaries, not inherited network adjacency.

Microsegmentation is the practical expression of IEC 62443 zones and conduits. The standard calls for communication to be limited by function and security requirement, but many implementations stop at coarse subnet separation. The named concept here is the OT segmentation gap: broad zones that still allow unrestricted east-west movement inside them. Practitioners should close that gap with asset-level policy that survives compromised credentials and protocol-native abuse.

Endpoint-centric thinking is structurally misaligned with OT risk. EDR can help on Windows-based engineering assets, but it cannot protect the PLCs, relays, and legacy controllers that define the process layer. That leaves a large portion of the attack surface outside agent-based visibility and makes architecture the decisive control. Practitioners should design for enforcement where agents cannot exist, then use monitoring to validate rather than substitute for that control.

Attackers are exploiting trusted pathways, so trust must become conditional. The article shows that shared VPNs, jump hosts, and multi-environment access are recurrent pivot points, which means the core governance assumption has failed: that trusted admin paths remain benign once authenticated. Practitioners should reframe OT access governance around least-reach and device-scoped communication, because authentication alone does not stop lateral use of legitimate paths.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

OT segmentation now sits at the centre of access governance. The key lesson is that attacker success depends less on novel payloads and more on whether trusted paths still span too many assets. In converged environments, the control question is not whether a tool can detect misuse after the fact, but whether a compromised session can still traverse the OT estate at all.

The OT segmentation gap is a governance issue as much as a network issue. If engineering workstations, jump hosts, and shared remote access links are treated as generic infrastructure, defenders inherit the same broad trust model as the attacker. Practitioners should watch for policy drift where exceptions, maintenance access, and shared services quietly recreate flat-network behaviour.

Microsegmentation gives OT teams a more durable boundary than subnetting. The article's practical signal is that the next control conversation should be about communication rights, not just connectivity. That shift aligns with modern zero trust thinking and makes blast-radius reduction the metric that matters most.

For practitioners

• Define device-level communication policy Inventory which OT assets actually need to communicate, then block every non-essential path between PLCs, HMIs, engineering workstations, historians, and remote access infrastructure.
• Segment trusted admin bridges Isolate VPNs, jump hosts, and shared services that bridge IT and OT, and apply separate policy to each bridge so compromise of one path does not expose the control network.
• Replace coarse VLAN trust with microsegmentation Use asset identity, function, and protocol context to enforce communications at the device level rather than assuming a subnet boundary is enough.
• Validate OT policy in monitor mode before enforcement Test policy changes against live plant traffic with operations participation so that enforcement rules do not break legitimate maintenance, safety, or production workflows.
• Keep monitoring and enforcement separate Use OT visibility tooling to detect anomalies, but treat segmentation policy as the primary control that constrains attacker movement and blast radius.

Key takeaways

• Living off the land in OT is dangerous because native industrial protocols can make attacker traffic look routine while bypassing agent-based detection.
• Dragos data cited in the article shows 56% of penetration tests abused LOTL tools undetected and 81% of assessments found poor IT/OT segmentation.
• The practical response is to limit device-to-device reach with microsegmentation so a compromised admin path cannot traverse the control environment freely.

Key terms

• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Zones And Conduits: An industrial security model that groups assets into zones with shared security requirements and defines controlled conduits between them. It is most effective when the conduits are enforced at a granular level, because coarse segmentation often leaves too much trust inside each zone.
• Engineering Workstation: A workstation used to configure, monitor, or maintain industrial systems such as PLCs, HMIs, and control logic. Because these systems often have privileged access to plant devices, compromise of an engineering workstation can become a direct route into operational control if segmentation is weak.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security practitioners connect identity controls to the broader access boundaries that modern programmes depend on.