TL;DR: Boeing’s new agreement will use near-real-time onboard data to support predictive maintenance and cybersecurity threat detection on aircraft such as the C-17 and KC-46, so faults and intrusions can be identified at mission speed instead of hours or days later, according to Shift5. The bigger shift is that operational technology visibility becomes a shared resilience control, not a separate maintenance or security afterthought.
At a glance
What this is: Shift5 and Boeing are linking onboard operational data to both predictive maintenance and cyber threat detection, with the stated aim of finding faults and intrusions at mission speed.
Why it matters: For IAM and security teams in OT-adjacent environments, this shows how telemetry quality and monitoring speed shape whether resilience controls can detect issues before they become operational disruptions.
Context
Near-real-time telemetry is a control problem as much as an engineering one: if data arrives too late, both maintenance and security teams are forced into reactive decisions. In operational environments, the question is whether the same stream can support fault detection, intrusion monitoring, and operational decision-making without creating blind spots.
The Boeing and Shift5 collaboration frames that problem in aircraft terms, but the governance issue is broader across operational technology access and monitoring. When health and security depend on the same data path, the organisation has to treat telemetry integrity, availability, and timeliness as first-order controls rather than back-end analytics concerns.
Key questions
Q: How should OT teams govern shared telemetry for maintenance and security use?
A: They should define clear ownership, retention, escalation, and tuning rights before the same data stream becomes business-critical. Shared telemetry can improve both maintenance and cyber detection, but only if teams preserve evidence quality, avoid conflicting optimisations, and make one group accountable for the signal when it is ambiguous.
Q: Why does near-real-time data matter for fault and threat detection in OT environments?
A: Because slow data turns operational monitoring into after-the-fact reporting. When telemetry arrives late, teams lose the ability to correlate anomalies, confirm faults, and contain intrusions while the asset is still in service, which increases downtime and reduces confidence in response decisions.
A: The control boundary breaks first. Maintenance teams may optimise for availability while security teams need trustworthy anomaly evidence, and without agreed ownership the same stream can produce conflicting conclusions, unclear escalation, and poor accountability for false positives or missed events.
Q: What should practitioners do before relying on mission-speed detection in operational environments?
A: They should test the full telemetry path under realistic conditions, including timing, classification quality, and escalation handoff. If the system cannot support decisions while the asset is active, the programme should not treat it as a live operational control, only as an informational feed.
Technical breakdown
How near-real-time OT telemetry changes detection latency
Near-real-time telemetry shortens the time between an event occurring on the asset and the point at which security or maintenance teams can act on it. In OT environments, that matters because detection quality depends on both signal freshness and context. If the data stream only arrives after the operational window has closed, teams lose the chance to correlate fault patterns, anomalous behaviour, and maintenance indicators while the aircraft or asset is still in service. The architectural shift is not just faster logging. It is moving analysis closer to the edge so fault detection and intrusion detection can run against the same operational context. See the SIEM Guide.
Practical implication: Treat telemetry latency as a control metric, not an engineering detail, and measure whether detection still works at operational tempo.
Why shared maintenance and cyber visibility creates governance tension
When predictive maintenance and cyber monitoring use the same telemetry, the same data stream starts serving two different control objectives. Maintenance teams want diagnostic precision and availability optimisation, while security teams want anomaly detection and evidence preservation. Those goals align only if the data is trustworthy, retained appropriately, and segmented so one workflow does not distort the other. In OT settings, shared visibility can reduce duplication, but it can also blur accountability for who owns the signal when something goes wrong. The mechanism only works when the organisation can separate operational use from security use without separating the underlying truth source. See the OT and ICS Identity and Access Guide.
Practical implication: Define ownership, retention, and escalation paths for the shared telemetry stream before it becomes operationally critical.
How mission-speed analysis reduces the gap between fault and threat response
Mission-speed analysis pushes decisions closer to the moment of deviation. Instead of waiting for offline review, the organisation can see maintenance drift and potential cyber anomalies while the platform is still operating. That narrows the response gap between detection and containment, which is especially important in environments where downtime, safety, and security are tightly coupled. The trade-off is that faster analysis increases dependence on clean instrumentation, reliable classification logic, and disciplined triage. If those conditions are weak, the system can produce fast but low-confidence conclusions, which is operationally worse than slower but reliable insight.
Practical implication: Validate alert quality under realistic operating conditions before relying on mission-speed detection for maintenance or security decisions.
Breaches seen in the wild
- CitrixBleed exploitation 2023: CitrixBleed leaked NetScaler session cookies, letting attackers skip passwords and MFA at Boeing, ICBC, Xfinity and others.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Near-real-time visibility is now a resilience control, not just a monitoring feature. In OT-heavy environments, the ability to see faults and threats while an asset is still operating determines whether teams can act before the issue becomes operationally expensive. That shifts telemetry from a reporting function to a governance object. Practitioners should treat data freshness, integrity, and ownership as part of the control plane, not an afterthought.
Shared maintenance and security analytics create a new governance boundary around the same data stream. Predictive maintenance and cyber detection often want the same asset data, but they do not want the same operational outcome. That means the programme has to define who owns the telemetry, who can tune the logic, and who is accountable when the signal is ambiguous. Without those boundaries, combined monitoring can create false confidence rather than better assurance.
Operational technology programmes are moving toward continuous condition awareness. The article points to a broader pattern where fleet readiness, threat detection, and response speed converge on the same stream of machine data. That convergence makes monitoring architecture part of mission assurance. Practitioners should design for OT identity and access governance, telemetry trust, and evidence quality together rather than as separate workstreams.
The named concept here is mission-speed detection. This is the point at which fault recognition and intrusion recognition must occur fast enough to influence an active operation, not merely report on it later. That standard raises the bar for instrumentation, escalation, and operational ownership. Teams that cannot meet it should not assume their current monitoring stack is adequate for contested environments.
Read next: SIEM Guide
What this signals
Mission-speed detection: as OT programmes move toward faster fault and threat recognition, the real question becomes whether alerting can still support live operational decisions rather than retrospective review.
The next governance step is to align telemetry trust with operational decision rights. If the same stream drives both maintenance and cyber response, teams need a model for who can rely on it, override it, and prove its integrity when decisions are contested.
For practitioners
- Map telemetry ownership and decision rights Document which team owns aircraft or asset telemetry, who can adjust alerting logic, and who escalates when maintenance and security signals conflict.
- Measure detection latency against operational tempo Test whether the monitoring pipeline still identifies faults and anomalies early enough to change maintenance or security decisions during live operations.
- Separate operational use from security use Define how the same data stream supports predictive maintenance without weakening evidentiary quality, triage consistency, or incident review.
- Validate instrumentation under realistic field conditions Run integration checks on the specific platforms named in the programme so analysts can trust the sensor quality, timing, and coverage in service.
Key takeaways
- Shared telemetry can improve both maintenance and cyber detection, but only if ownership and escalation are clearly defined.
- The operational risk is not just late alerting, but late alerting on a data stream that multiple teams depend on for different decisions.
- Practitioners should test whether their monitoring architecture can still influence live operations, not just produce after-action insight.
Related NHI Mgmt Group resources: OT and ICS Identity and Access Guide · SIEM Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | The article centres on continuous monitoring of operational systems for faults and threats. |
| Recommendation — Monitor OT telemetry for anomalies that indicate faults, intrusions, or degraded platform condition. | ||
| MITRE ATT&CK | TA0007;TA0009 — Discovery; Collection | The detection model depends on collecting and interpreting operational data before attackers can hide activity. |
| Recommendation — Map telemetry collection gaps to ATT&CK discovery and collection techniques in your detection engineering. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article depends on trustworthy, timely data streams that can support both maintenance and security review. |
| Recommendation — Centralise and protect audit and telemetry data so operational and security teams can act on the same evidence. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Shared OT data only helps if teams review and analyse it fast enough to change decisions. |
| Recommendation — Review telemetry and audit records promptly enough to support operational and security decisions. | ||
| ISO/IEC 27001:2022 | A.8.16 — Monitoring activities | The topic is fundamentally about continuous monitoring of assets and events across an operational environment. |
| Recommendation — Define monitoring coverage and review expectations for OT assets that support both maintenance and security. | ||
Key terms
- Operational Telemetry: Operational telemetry is the current data generated by systems about their active state, usage, and condition. For identity programmes, it is valuable because it turns abstract records into evidence that can support entitlement reviews, offboarding, and spend decisions with less manual reconciliation.
- Mission-Speed Detection: Mission-speed detection is the ability to identify faults or threats quickly enough to change what happens while an asset is still operating. It depends on low-latency data, reliable analytics, and an escalation path that can act before the window for intervention closes.
- Shared Monitoring Stream: A shared monitoring stream is one data path used by more than one team or control objective, such as predictive maintenance and cyber detection. The governance challenge is not the sharing itself, but preserving signal quality, accountability, and evidence value across different operational uses.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org