OT identity governance is still stuck in local access silos

At a glance

What this is: This analysis argues that OT identity governance is still trapped in local access silos, leaving access decisions disconnected from corporate identity and HR lifecycle events.

Why it matters: It matters because IAM, IGA and PAM teams cannot govern what they cannot reliably see, and OT visibility must improve without disrupting safety or uptime.

Context

OT identity governance is the practice of understanding who has access to operational systems, where that access lives, and how it changes over time without disturbing plant operations. The core problem here is that local directories and site-specific accounts often sit outside corporate identity control, so termination and role change events do not reliably propagate into OT.

That gap matters because OT environments are designed to avoid the kind of live integration that standard IAM programmes depend on. The result is not just technical fragmentation, but a persistent governance blind spot where access can remain active after the business relationship has changed.

Key questions

Q: What breaks when OT identities are managed only inside local plant silos?

A: Access and accountability drift apart. Local accounts can remain valid after a worker leaves or changes role because the OT directory is not aligned to corporate joiner-mover-leaver events. That leaves teams unable to prove who still has access, and it weakens both audit evidence and operational trust in the access record.

Q: Why does OT identity governance create risk even when safety teams resist integration?

A: Because the resistance is usually rooted in legitimate operational safety concerns, not stubbornness. OT systems often cannot absorb live IAM syncs without introducing downtime or control instability, so the risk is stale access rather than over-centralisation. The challenge is to gain visibility and lifecycle control without violating the plant's safety model.

Q: How do digital twins help with OT access reviews?

A: They let teams analyse access relationships outside the live OT environment. By loading snapshots into a model, practitioners can find redundant, orphaned and mismatched access paths while leaving the control system untouched. That makes access review possible in environments where direct integration would be too risky.

Q: Who should own OT identity lifecycle decisions across plants and corporate IAM?

A: Ownership should be shared, but accountability must be explicit. Corporate IAM, OT engineering, HR and security all influence the access record, yet no one should be able to defer revocation because another team owns part of the process. The fix is a named lifecycle owner with authority across the full chain.

Technical breakdown

Why local OT directories break central identity governance

Local OT directories create identity islands. Users authenticate inside a plant or facility boundary, often through standalone Active Directory instances or local account stores that are not connected to corporate joiner-mover-leaver processes. That means the identity source of truth for OT access is effectively separate from HR and enterprise IAM. The technical issue is not just duplication, but drift: an account can remain valid in OT even after it no longer exists in the corporate environment. In practice, that makes access reviews incomplete unless they include the local directory itself.

Practical implication: inventory every OT-local directory and account store before you attempt central governance or certification.

Why federated IAM models do not simply drop into OT

Federated IAM, SSO and conditional access assume live connectivity, policy enforcement points and timely synchronisation. OT often rejects those assumptions because the environment is segmented, safety-sensitive and frequently isolated from inbound change. Even where data can be exported, direct integration may be operationally unacceptable. That is why the article frames the problem as visibility without disruption rather than full convergence. The mechanism matters: OT identity control usually has to be modelled externally, then reconciled against the live estate, instead of managed in-line like a cloud service.

Practical implication: separate identity visibility from identity enforcement when OT safety constraints make live integration unrealistic.

How digital twins and knowledge graphs model OT access safely

A digital twin in this context is a read-only model of the OT identity environment, built from snapshots rather than live writes. A knowledge graph then relates users, systems, roles and policies so hidden access paths, orphaned accounts and redundant entitlements become visible. The strength of this approach is that it exposes relationships without changing the underlying control system. For OT governance, that lets teams evaluate accountability and privilege scope in a safe analytical layer before deciding what, if anything, should change in the plant.

Practical implication: build an external identity model first, then use it to prioritise remediation where access is stale or unjustified.

Threat narrative

Attacker objective: The objective is to preserve unauthorised access to OT systems after the legitimate need for that access has ended.

1. Entry occurs through locally created OT credentials that exist outside the corporate identity lifecycle, so terminated or moved users can still authenticate inside a plant environment.
2. Privilege persists because site-specific directories and manually maintained access policies are not automatically reconciled with HR or central IAM changes.
3. Impact is hidden accountability failure, where access remains active after the business relationship has changed and the organisation cannot confidently answer who still has authority.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Local OT access outliving corporate lifecycle events is the real governance failure. This article shows that the central risk is not just fragmented infrastructure, but identity records that no longer reflect employment reality. When HR changes do not reach the OT domain, access review loses meaning because the authoritative record and the operational record diverge. Practitioners should treat that mismatch as a governance defect, not an administrative inconvenience.

Visibility without disruption is the correct OT identity control objective. OT environments are not simply behind the curve on IAM. They operate under safety constraints that make direct integration risky or impossible, so the control problem becomes one of accurate observation and safe reconciliation. That shifts the programme question from centralising everything to proving what access exists and why it exists. Practitioners should measure control effectiveness by the quality of identity visibility, not by the amount of integration imposed on the plant.

Digital twins create an identity blast-radius map for OT. The article's strongest insight is that modelling can reveal redundant, orphaned and conflicting access without changing the live environment. That matters because OT remediation has to respect operational boundaries while still narrowing excess privilege. Practitioners should use external identity modelling to separate what is technically present from what is actually justified.

Shared accountability across IT, OT and HR is now the minimum viable governance model. OT access silos persist because no single team owns the full lifecycle from hire to offboard to plant-level revocation. That is why the problem is organisational as much as technical. Practitioners should assign explicit ownership for OT identity reconciliation across the corporate and facility layers.

OT identity governance is a lifecycle problem, not a centralisation project. The article makes clear that the goal is not to force convergence for its own sake. The practical objective is to prevent access from outliving the conditions that justified it, while preserving the operational model that keeps plants safe. Practitioners should frame OT governance around accountability and lifecycle freshness, not platform consolidation.

What this signals

Identity blast radius is the right mental model for OT. When access is distributed across local directories, the practical question is not whether a single control plane exists, but how far a stale account can reach before anyone notices. Security leaders should model OT access as a bounded blast radius, then use that model to prioritise which sites need the fastest reconciliation.

OT programmes should separate identity observability from identity enforcement. The article's core lesson is that safe modelling can produce the visibility needed for governance even where live synchronisation would be operationally unacceptable. That distinction is what lets teams improve accountability without destabilising the plant.

For practitioners

• Map OT-local identity domains Build an inventory of every plant, facility and segment that maintains its own directory, local accounts or site-specific access policy. Include the people who administer those stores and the business process that changes access when staff move or leave.
• Reconcile OT access to HR status Compare active OT accounts against employment status, contractor end dates and role changes, then flag identities that still authenticate inside a site after the business relationship has ended.
• Model access in a read-only twin Create an external identity twin from snapshots so teams can analyse OT entitlements, conflicting roles and orphaned accounts without writing back into control systems.
• Assign cross-domain ownership Name one accountable owner for the lifecycle path that spans HR, enterprise IAM, local plant administration and OT remediation so no silo can defer revocation indefinitely.

Key takeaways

• OT identity risk is being created by local access records that outlive the business events meant to close them.
• The article's practical insight is that governance has to work in environments where live IAM integration may be unsafe or impossible.
• External modelling of OT access can surface stale entitlements, orphaned accounts and ownership gaps without touching control systems.

Key terms

• Operational Technology Identity: An identity used in environments where digital access can affect physical processes, equipment, or uptime. These identities often carry higher operational risk because access mistakes can move beyond data exposure into safety, availability, and process integrity concerns.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Digital Twin: A digital twin is a high-fidelity virtual representation of a physical system, environment, or process. In security and identity work, it becomes sensitive when it is used to generate data, validate models, or control real-world decisions, because access to the twin can expose operational knowledge and deployment paths.
• Knowledge Graph: A knowledge graph is a data model that stores entities and the relationships between them instead of treating records as isolated rows. In security, it helps teams explain how identities, permissions, tokens, and resources connect, which is essential for understanding access paths and risk propagation across SaaS and NHI environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.