TL;DR: Onboard OT cybersecurity must account for moving platforms, where compromise to navigation or communications can affect mission safety, according to Shift5, while its observability model uses passive, full-platform data and near real-time feedback to surface anomalies before operators are left guessing. The governing issue is not just detection speed, but whether operators can see system impact early enough to act on facts instead of assumptions.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Shift5's blog post: Onboard OT observability on moving platforms shifts cyber defence from reactive alerting to full-system situational awareness and operational impact assessment.
Why it matters: For IAM and security practitioners supporting operational technology, the key question is whether controls can detect and contain compromise fast enough to protect safety, readiness, and continuity in environments that move and change in real time.
Context
Onboard OT security is the problem of protecting operational systems that move, not just fixed infrastructure. The control challenge changes when navigation, communications, and safety functions sit on aircraft, vessels, trains, or vehicles that operate under motion, latency, and mission constraints.
Shift5's framing places observability ahead of traditional alert volume. That matters because the security objective is not only to identify a threat, but to understand what is affected, how it changes platform behaviour, and whether the operator can still trust the system enough to continue safely.
Key questions
Q: How should security teams govern cyber risk on moving OT platforms?
A: They should treat moving-platform OT as a safety and continuity issue, not a conventional alerting problem. The governance model needs passive visibility, system-state baselining, and response decisions tied to mission impact. If the control cannot tell operators what changed and what it affects, it is not enough for a mobile platform.
Q: Why do fixed-site OT controls fail on aircraft, vessels, and vehicles?
A: Fixed-site controls assume a stable environment, but mobile platforms change context continuously and can be affected before a standard monitoring stack understands the situation. That makes generic thresholds and delayed review weak fits. The failure is not only in coverage, but in the mismatch between static controls and dynamic operational conditions.
Q: What are the signs that onboard observability is not enough?
A: If operators can see an alert but cannot say which system changed, what mission function is affected, or whether the platform can continue safely, observability is incomplete. Another sign is delayed discovery, where the team learns about the event only after operational impact is already visible. Good visibility should collapse that uncertainty.
Q: What should teams do when spoofing or interference is detected before entry?
A: They should treat pre-entry detection as a decision point, not just a warning. The right response is to reassess route, posture, and operator readiness before the platform enters the contested environment. That keeps the incident from becoming an in-zone operational failure and gives the team time to verify onboard status.
Technical breakdown
Why moving-platform OT needs different visibility
Operational technology on moving assets behaves differently from stationary industrial systems because the environment is dynamic, distributed, and safety-critical. The article's core distinction is that a failure in OT is not a data exposure event alone, but a physical outcome that can interrupt navigation, communications, or mission execution. That means security telemetry must be tied to system state, not just event counts. Observability in this setting means capturing full platform traffic passively so operators can build a baseline of normal behaviour and spot deviations in context. Without that baseline, anomaly detection becomes guesswork and response quality drops sharply.
Practical implication: Treat mobile OT as a state-aware control problem, not a log-collection problem.
How passive serial bus and RF monitoring work together
The interview describes two complementary visibility layers. RF-based detection can identify GPS spoofing attempts before the platform enters the contested environment, while serial bus monitoring reveals whether navigation or other onboard systems are being affected once the platform is exposed. This matters because early warning and in-environment validation solve different problems: one prepares the operator, the other confirms impact. Passive collection also avoids interfering with the systems being observed, which is essential when the monitored asset is safety-critical. The architectural point is that observability must span both pre-incident warning and in-incident confirmation.
Practical implication: Combine pre-entry warning with onboard telemetry so operators can validate impact, not just suspect it.
Why real-time operational context beats after-the-fact review
The value of observability is not the data archive itself, but the ability to convert platform data into immediate operational understanding. In legacy models, teams often discover anomalies after the fact, when the platform has already been affected and the available evidence is incomplete. Here, the control objective shifts to surfacing the anomaly while it is still actionable. That creates a different response model, where operators can reroute, isolate, or adjust mission decisions based on evidence rather than assumptions. For mission systems, that is the difference between informed recovery and blind reaction.
Practical implication: Design detection so that operators can change mission decisions while the platform is still in motion.
Threat narrative
Attacker objective: The objective is to disrupt or misdirect a moving platform's operational decisions by manipulating the systems that keep it safe and on course.
- Entry occurs through a spoofing attempt or other onboard interference that reaches the platform before the operator has full situational awareness.
- Credential access is not the primary issue here; the relevant escalation is control or influence over navigation and communications behaviour.
- Impact follows when the affected system alters mission execution, safety margins, or platform availability before the operator can validate the change.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Onboard OT observability is really a safety governance problem, not just a detection problem. The article shows that on moving platforms, the key question is whether an operator can understand system impact quickly enough to preserve safe operation. That shifts the conversation from alert generation to operational decision quality. Practitioners should judge controls by how well they preserve trust in mission-critical systems under motion.
Continuous visibility is the control concept this topic sharpens. Fixed-site OT security assumes a comparatively stable asset boundary, but moving platforms erase that assumption by changing context continuously. Full-spectrum, passive data collection creates a live baseline that can distinguish normal platform behaviour from disruption. The practitioner lesson is to treat state visibility as part of resilience engineering, not as an optional monitoring layer.
The trust gap in mobile OT is that operators often know an anomaly exists before they know what it affects. Shift5's model closes that gap by linking anomaly detection to system impact, which is the only way to move from suspicion to informed action. That matters because mission systems cannot wait for post-incident analysis before deciding whether to continue, reroute, or stand down. Practitioners should prioritise control designs that answer impact questions in real time.
Mobile OT pushes cybersecurity toward operational continuity as the primary metric. In these environments, the relevant success measure is not only whether a threat was detected, but whether the platform remained safe and mission-capable long enough for a response to matter. That aligns security governance with readiness, sustainment, and safety engineering. Practitioners should align their control objectives with continuity outcomes instead of conventional IT response metrics.
Read next: NIST CSF 2.0 Guide
What this signals
Mobile OT will increasingly be governed as a continuity discipline. As fleets, vessels, aircraft, and trains become more connected, the practical test for security programmes will be whether they can preserve safe operation under active interference. That means teams should expect observability requirements to shift closer to operational assurance, with stronger demand for evidence that controls can distinguish noise from mission-impacting change.
Full-spectrum visibility becomes the differentiator when motion changes the threat model. In a moving environment, waiting for post-incident analysis leaves too much uncertainty about whether the platform is still trustworthy. The next programme step is to align detection, operator decisioning, and resilience planning so the security stack can support action before the platform is forced into recovery mode.
For practitioners
- Define platform-specific normal behaviour Establish baselines for each moving asset so anomalies are measured against its own operational pattern rather than a generic fleet template.
- Correlate anomaly alerts to mission impact Require every high-confidence detection to state which onboard systems are affected and what operational decision it should trigger.
- Use passive monitoring on safety-critical buses Collect telemetry without interfering with control systems so visibility does not introduce instability into the platform you are trying to protect.
- Prepare pre-entry response playbooks Build response steps for threats detected before the platform enters a compromised environment, including reroute, hold, or increased operator scrutiny.
Key takeaways
- Onboard OT security is different because moving platforms turn cyber events into potential mission and safety failures, not just information exposure.
- The article's central control idea is full-spectrum observability, which combines passive data collection with near real-time operator insight.
- Practitioners should measure success by whether controls preserve safe operation and decision quality while the platform is still in motion.
Related NHI Mgmt Group resources: NIST CSF 2.0 Guide · EPA Water Sector Cybersecurity Requirements Guide · IEC 62443-3-2 OT Risk Assessment Guide · SOC Analyst Career Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Continuous onboard observability is fundamentally an anomaly-monitoring problem. |
| Recommendation — Instrument moving assets so anomaly monitoring can surface platform changes in time to act. | ||
| MITRE ATT&CK | TA0007; TA0040 — Discovery; Impact | The article centres on detecting interference before it affects mission outcomes. |
| Recommendation — Map spoofing and interference scenarios to discovery and impact tactics in your detection model. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Passive collection and operator-ready telemetry depend on usable event data. |
| Recommendation — Centralise operational telemetry so analysts can correlate anomalies across onboard systems. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | The article emphasises turning captured platform data into actionable intelligence. |
| SI-4 — System Monitoring | Onboard observability is a specialised form of continuous system monitoring for OT assets. | |
| Recommendation — Review onboard telemetry quickly enough to support mission decisions before impact escalates. Apply system monitoring controls to detect state changes on moving operational platforms. | ||
Key terms
- Onboard OT: Operational technology deployed on moving assets such as aircraft, vessels, trains, or vehicles. Unlike stationary industrial systems, onboard OT must be secured under motion, changing conditions, and mission constraints, which makes visibility, resilience, and safe response materially harder than in fixed environments.
- Observability: Observability is the ability to understand the internal state of a system from the data it produces. In security and operations, that means combining logs, metrics, and traces so teams can explain why something happened, not just confirm that something changed.
- Passive Telemetry: Data collected without injecting traffic or altering the system being monitored. In safety-critical environments, passive telemetry is important because it preserves system behaviour while still giving defenders the evidence needed to spot anomalies, compare against baselines, and support timely response.
- Operational Baseline: A starting measurement used to compare performance before and after a change. In resilience and identity programmes, baselines are essential because they let teams prove whether a platform, control, or process change actually improved outcomes.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the wider security and operational programmes they support.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org