NCSC OT security rules expose the breach-readiness gap in critical infrastructure

At a glance

What this is: ColorTokens says the NCSC’s new OT security rules expose a wider problem in critical infrastructure: too many environments are designed for prevention alone, not containment after compromise.

Why it matters: For IAM, PAM, NHI, and OT security teams, the practical issue is that remote access, supplier connectivity, and boundary controls have to be governed as breach containment surfaces, not just access convenience.

Context

Operational technology security fails when organisations assume they can keep attackers out indefinitely. In critical infrastructure, legacy systems, remote maintenance paths, and flat internal networks often create exposure that modern connectivity amplifies rather than fixes. The article frames the real problem as breach survivability, not simple compliance with a checklist.

That matters for identity and access governance because OT access is often shared, temporary, supplier-driven, and difficult to monitor at machine speed. Where remote access, break-glass use, and inherited trust are poorly governed, attackers can move from initial foothold to operational impact before conventional IT controls detect anything. This is common, not exceptional, in OT estates.

The NCSC guidance is being used here as a trigger for a larger governance argument: critical infrastructure should be measured by how well it isolates compromise, preserves essential functions, and limits blast radius when prevention fails.

Key questions

Q: What breaks when OT networks are not breach-ready?

A: Flat OT networks fail because one compromise can spread across engineering, safety, and production environments before operators can react. Without segmentation, dedicated access paths, and pre-planned isolation, a normal-looking foothold can become operational shutdown. The main failure is not initial intrusion but uncontrolled lateral movement into systems that should never have been reachable.

Q: Why do standing OT access paths increase operational risk?

A: Standing access turns remote maintenance and supplier convenience into persistent trust. If the same credentials, conduits, or VPN paths remain available all the time, attackers only need to compromise one of them to reach critical systems. Time-bound and segment-bound access reduces the window in which that trust can be abused.

Q: How do you know if OT containment controls are actually working?

A: They are working if a simulated compromise stays confined to its initial zone and does not reach critical controllers, safety systems, or shared services. Good signals include blocked lateral paths, fast isolation of affected segments, and unaffected production continuing during an incident exercise. If every alert still becomes a plant-wide event, containment is too weak.

Q: Who is accountable for breach readiness in critical infrastructure?

A: Accountability should sit jointly with OT operations, infrastructure security, and business leadership, because breach readiness is about preserving essential functions, not just protecting a network. The governing body must own acceptable impact thresholds, access decisions, and isolation authority. If responsibility is split but not explicit, response becomes too slow during an active incident.

Technical breakdown

Why legacy OT connectivity creates breach exposure

Operational technology was built for availability and long equipment lifecycles, not for hostile networks and frequent remote access. Once SCADA, PLCs, HMI layers, and vendor pathways are connected to broader enterprise networks, every trust relationship becomes part of the attack surface. Default credentials, cleartext protocols, and ad hoc remote access all weaken the control plane. The key issue is not whether an attacker can get in, but how far they can move once one path is exposed.

Practical implication: Map every remote and supplier path to the OT estate and remove any connection that does not have a clear business owner and containment boundary.

How microsegmentation changes the attack path in OT

Microsegmentation is a containment model, not just a network design choice. It breaks large flat networks into small zones with tightly controlled conduits, so compromise of one asset does not automatically expose adjacent systems. In OT, that matters because many environments still assume internal traffic is trusted. When those assumptions fail, segmentation slows lateral movement, increases detection opportunities, and protects safety-critical functions from non-critical compromise.

Practical implication: Use zone-based containment for OT and separate safety, engineering, and vendor-access paths so one infected system cannot reach the rest of the plant.

Why logging and isolation plans matter more after compromise

OT monitoring has to detect deviations from known process behaviour, not just suspicious logins. A valid maintenance session, an unusual Modbus command, or a break-glass account use may be the earliest sign of compromise. Isolation planning matters because critical systems cannot be protected by improvisation in the middle of an incident. If the organisation has not pre-tested how to disconnect segments without halting everything, containment will be too slow when it counts.

Practical implication: Build OT-aware detections and rehearse isolation procedures so operators know exactly which segments to disconnect when anomalies appear.

Threat narrative

Attacker objective: The attacker aims to turn a single foothold into operational disruption, service downtime, or safety-impacting control over critical infrastructure.

1. Entry typically begins through exposed OT connectivity, such as remote access, supplier pathways, or insecure boundary systems that bridge enterprise and industrial networks.
2. Credential or access abuse follows when attackers use weak, standing, or shared credentials to reach engineering workstations, HMI systems, or other trusted OT management surfaces.
3. Escalation and lateral movement occur as the attacker pivots across flat OT networks, reaches more sensitive process controls, and disrupts availability or safety.
4. Impact is achieved when operations are halted, processes are manipulated, or the organisation is forced into broad isolation to preserve essential functions.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Breach readiness is now the real control objective for OT. The article is right to reject the idea that prevention alone defines maturity in critical infrastructure. OT environments are too connected, too legacy-heavy, and too operationally constrained for a pure deny model to hold. The governing question is how quickly essential functions can be isolated and preserved when attackers already have a foothold.

Standing trust is the breach-ready gap the NCSC guidance exposes. Flat OT networks, permanent vendor access, and insecure boundary paths all assume a level of trust that attackers routinely exploit. In identity terms, this is a governance failure over who can reach what, when, and through which conduit. The right framing is not broader access control, but stricter control over operational trust paths and their lifetime.

Blast radius has become the central design concept for industrial security. The article’s strongest contribution is that it treats segmentation, logging, and isolation as survivability controls rather than IT hygiene. That aligns with NIST CSF and MITRE ATT&CK for ICS thinking: limit how far compromise can spread, then make attack paths visible early. Practitioners should judge OT architectures by containment capacity, not by how many perimeter products are deployed.

OT breach readiness also changes how identity governance is measured. Supplier access, maintenance credentials, break-glass accounts, and engineer pathways are all non-human or high-risk access channels that must be time-bound and segment-bound. Where those access paths are permanent, shared, or poorly monitored, the organisation has already accepted latent compromise. Practitioners should treat OT identity governance as an availability and resilience control, not just an authentication problem.

The named concept here is breach-ready containment. This article describes a model in which systems are designed so compromise does not become enterprise-wide failure. That is more than segmentation in the abstract. It is a governance approach that assumes the attacker will get in, then focuses the programme on keeping the critical business function unaffected.

What this signals

Breach-ready OT changes the security question from prevention to survivability. Practitioners should now treat connectivity, supplier access, and boundary design as controls that determine whether an incident stays local or becomes operationally material. In practical terms, that means architecture reviews should focus on where compromise can be isolated, not only where it can be blocked.

Microsegmentation is emerging as a core industrial resilience pattern. In OT environments, the value lies in preventing one compromised workstation or vendor connection from becoming a plant-wide event. For security and infrastructure teams, the next step is to align network zoning, access governance, and monitoring so the architecture supports rapid containment, not just audit readiness.

For practitioners

• Inventory OT trust paths Catalogue every remote, supplier, and engineering access path into OT, including temporary and inherited connections, then assign ownership and removal criteria for each one.
• Replace standing access with segmented access Remove permanent OT remote access where possible and constrain remaining sessions to specific zones, devices, and approved maintenance windows.
• Test containment against lateral movement Validate that a compromised engineering laptop or vendor account cannot pivot from one zone into safety systems, production controls, or backup environments.
• Build OT-aware monitoring for maintenance anomalies Alert on unusual maintenance activity, break-glass account use, and process commands that deviate from the normal baseline rather than relying on generic IT detections.
• Exercise isolation playbooks with operations teams Rehearse how to disconnect specific conduits and segments while preserving critical services, and confirm the sequence with OT, IT, and leadership stakeholders.

Key takeaways

• The article argues that OT security has to be judged by how well critical functions survive compromise, not by how completely attacks are prevented.
• Its central concern is blast radius. Flat networks, standing access, and weak boundary controls let one foothold turn into operational disruption.
• Practitioners need to govern supplier access, maintenance paths, and isolation plans as resilience controls if they want breach-ready infrastructure.

Key terms

• Breach Containment: Breach containment is the act of stopping an attacker from expanding access after detection. It goes beyond alerting by blocking communication paths, isolating workloads, or limiting privilege so the incident remains smaller than it otherwise would have been.
• Disconnectable Conduit: A disconnectable conduit is a controlled communication path that can be deliberately shut down without collapsing the entire operational environment. In OT security, it limits how far a compromise can travel and gives responders a fast isolation option during an incident or maintenance event.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• OT-aware monitoring: OT-aware monitoring watches for deviations in industrial protocols, process behaviour, and maintenance activity rather than relying only on generic IT alerts. It helps teams spot misuse of legitimate access, abnormal command patterns, and other signs that a trusted operational path has been abused.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is suitable for practitioners who need to connect identity governance to real operational risk across modern programmes.