TL;DR: OT zero trust fails when programs stop at east-west segmentation and leave north-south access paths, such as VPNs, shared vendor accounts and exposed remote tools, insufficiently governed, according to Forescout. Identity-aware access and session-level control are the missing half because the deciding risk is who gets in and what they can reach, not only what can talk laterally.
At a glance
What this is: This analysis says OT zero trust cannot rely on micro-segmentation alone because remote access, vendor identity and session governance determine the real exposure path.
Why it matters: It matters because IAM, PAM and NHI practitioners in OT need to control both movement inside the network and the identities that enter it, especially across third-party access paths.
Context
OT zero trust is often treated as a network design problem, but that view misses the first control question: who should be allowed in at all. In industrial environments, especially where third-party support is normal, the access path is often the real weakness, not the zone map.
Zero Trust Identity Guide is useful here because the article is really about combining identity, session control and segmentation into one operating model. Segmentation can constrain east-west movement, but without north-south governance the front door remains open.
The article's core claim is that many plants have hardened internal traffic while leaving remote access paths, vendor accounts and unmanaged sessions outside governance. That is a typical brownfield reality, not an edge case.
Key questions
Q: What breaks when zero trust segmentation is applied without device context?
A: Security teams often block legitimate communications because they cannot see the dependencies behind a device’s normal operation. That creates downtime, workarounds, and pressure to reintroduce exceptions. The practical failure is not segmentation itself, but segmentation applied without a business-focused inventory of device behavior, critical services, and the communications required to keep operations running.
Q: Why do remote access paths create more risk than network zones in OT?
A: Remote access paths define who enters, what they can reach and how much accountability exists once the session starts. When those paths rely on shared accounts, persistent tunnels or exposed tools, the network zone is not the weak point. The weak point is the identity and session governance wrapped around the connection.
Q: What are the signs that remote access to OT controllers is being misapplied?
A: Look for management interfaces that are internet-facing, contractor connections that are not documented, sessions from sources outside the approved allowlist, bulk setpoint or defrost changes across many devices, and controllers still running plain HTTP management access. Those signals show that visibility exists, but access control is weak or missing where it matters most.
Q: Should OT teams replace VPNs or keep them alongside segmentation?
A: VPNs can remain part of a transition plan, but they should not be the governance model. If a VPN extends broad trust into the plant, it should be replaced or tightly constrained by identity-aware access, per-session authorization and segmentation that limits post-entry movement.
Technical breakdown
Why segmentation alone cannot secure OT entry points
Segmentation limits where traffic can go after a connection exists. It does not decide who may initiate the connection, whether the user is tied to a named identity, or whether the session should expire after the task is complete. In OT, that distinction matters because vendor support, remote operators and integrators often use persistent access paths that were created for uptime, not governance. Zero Trust in this setting has two control planes: east-west containment and north-south identity-aware access. If the second plane is missing, the environment may be well zoned but still widely reachable. See the Zero Trust Identity Guide.
Practical implication: Treat segmentation as a containment layer, not as a substitute for access governance.
Identity-aware remote access as the governance layer for OT sessions
Identity-aware access brokers a person into a specific application or asset instead of extending the network to the user. That changes the trust model from broad network membership to per-session authorization, with MFA, role-based access, time-bounded connectivity and full session logging. It also collapses scattered remote access tools into one governed path, which is important because unmanaged VPNs, ad hoc remote desktop tools and vendor-specific clients are where accountability usually disappears. The goal is not only reduced exposure. It is auditable attribution of every remote action to a named identity and a bounded session. See the Privileged Access Management Guide.
Practical implication: Replace broad remote connectivity with session-scoped access tied to named identities.
The operational control seam between identity and segmentation
The hardest part is not the individual tools. It is the hand-off between identity policy and network enforcement. Identity establishes who the user is, while segmentation decides which destinations or protocols the session may reach. That seam must also handle exceptions, emergency access and policy propagation without forcing operators to choose between safety and control. In practice, many failed OT programmes assume the broker and the segmentation layer will align automatically. They do not. The workflow between them has to be designed, tested and owned like any other critical control path. See the Network Segmentation Guide.
Practical implication: Design the identity-to-segmentation hand-off as a governed workflow, not an informal integration.
Threat narrative
Attacker objective: The objective is to gain authorized-looking entry into OT systems and use that access to control or disrupt industrial operations.
- Entry begins with exposed remote access paths such as flat VPNs, shared vendor accounts, unmanaged remote desktop tools or default credentials on internet-facing devices.
- Credential use or abuse follows when an attacker or unauthorized user authenticates through that path with too much reach and too little identity binding.
- Impact occurs when the session grants access to OT assets that can be observed, controlled or disrupted beyond the original task scope.
Breaches seen in the wild
- Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
OT zero trust is an identity problem before it is a segmentation problem. Segmentation matters, but it only contains movement after access already exists. In industrial environments, the higher-order control is deciding who may enter, by what path, and under what session terms. Practitioners should stop treating network zoning as the primary trust boundary and start treating remote access governance as the first control surface.
North-south access is where OT governance most often breaks down. Brownfield environments accumulate flat VPNs, shared accounts, always-on tunnels and unmanaged vendor tools because those paths were built for uptime, not accountability. That is why the question is not whether segmentation works, but whether the identities crossing the boundary are governed at all. The implication is that remote access cannot remain a side channel to the security model.
Identity-aware access changes accountability more than it changes connectivity. One named identity, one session, one authorized destination is a stronger governance model than broad network reach wrapped in perimeter controls. This also creates a cleaner evidence trail for operations, incident response and compliance. The practical conclusion is that session-level attribution should be treated as a core OT control, not an optional visibility feature.
Zero Trust for AI Agents is a useful contrast even though this article is about OT: the same governance principle applies, but the actor is human or third-party rather than autonomous. In both cases, the weak point is standing reach that outlives the task. The difference is that OT access is usually constrained by operational uptime rather than runtime autonomy, so the control model must emphasise brokered entry, session scope and revocation discipline.
From our research library:
- 74% of organizations report identity-related breaches, and privileged access is a leading cause of lateral movement.
- Read next: Privileged Access Management Guide
What this signals
Zero Trust in OT only becomes workable when access is treated as an identity workflow, not a network extension problem. The programme question changes from how to segment the plant to how to broker, log and retire access without leaving standing reach behind.
Identity blast radius: the real risk is not only that an attacker reaches one zone, but that a remote session grants more operational reach than the task requires. In OT, reducing blast radius means controlling both entry and downstream reach, not just drawing better boundaries.
The governance pattern here is broader than OT. Any environment that mixes third-party support, legacy connectivity and critical operations will fail if it assumes the network boundary is the trust boundary. Practitioners should expect more pressure to consolidate remote access into a single governed path because unmanaged shadow access is harder to defend than visible segmentation.
For practitioners
- Map every remote access path Inventory VPNs, remote desktop tools, vendor portals, jump hosts, modem links and embedded vendor accounts before trying to tighten policy. See the NHI Lifecycle Management Guide.
- Bind OT access to named identities Require per-user authentication, role-based authorization and session-scoped connectivity for any person or third party reaching critical assets.
- Separate entry control from movement control Use identity-aware access to manage who enters and segmentation to constrain what they can reach after entry.
- Phase enforcement behind discovery Baseline actual OT traffic, simulate policy, then enforce at trust boundaries before expanding inward so changes do not break operations.
Key takeaways
- OT segmentation reduces lateral movement, but it does not solve the identity and access problem at the plant boundary.
- The article points to remote access, shared credentials and unmanaged vendor sessions as the real weak spots in many industrial environments.
- Practitioners need both identity-aware entry controls and segmentation to reduce exposure without losing operational control.
Related NHI Mgmt Group resources: Privileged Access Management Guide · NHI Lifecycle Management Guide · Network Segmentation Guide · Zero Trust Identity Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on who may enter OT systems and under what access conditions. |
| Recommendation — Apply PR.AA-05 to govern OT remote access by identity, session scope and authorized destination. | ||
| NIST Zero Trust (SP 800-207) | Zero trust architecture — Zero trust architecture | The piece explicitly frames OT as a zero trust architecture problem across entry and lateral movement. |
| Recommendation — Design OT access around continuous verification and deny broad trust extensions across the plant boundary. | ||
| CIS Controls v8 | CIS-5 — Account Management | Shared vendor accounts and unmanaged remote access paths are core failure modes here. |
| Recommendation — Use CIS-5 to inventory, govern and remove shared and stale OT access accounts. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article highlights credentialed remote entry followed by movement inside industrial networks. |
| Recommendation — Map remote access exposure to TA0006 and TA0008, then hunt for exposed or overbroad entry paths. | ||
Key terms
- North-south access: North-south access is the path used to enter an environment from outside, such as remote users, vendors or external tools connecting into OT systems. In this article, it is the governance problem that determines who gets in, by what method and under what session controls.
- East-West Segmentation: Network policy that controls traffic between internal systems rather than only at the perimeter. In identity-heavy environments, it limits how far a compromised account or workload can move after initial access by denying unnecessary peer-to-peer connectivity.
- Identity-Aware Access: Identity-aware access is an authorization model that evaluates who or what is making a request, what it is trying to reach, and under what context. It replaces broad, persistent trust with request-level decisions. In agentic environments, it is the control that can contain a deceived agent before it reaches enterprise systems.
- Session-scoped connectivity: Session-scoped connectivity means remote access exists only for the duration and scope of the task being performed. In this context, it is the opposite of persistent tunnels or standing vendor reach, and it is central to reducing unmanaged exposure in OT.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org