TL;DR: Critical infrastructure identity security is harder because OT combines legacy assets, shared accounts, intermittent connectivity, and privileged access that must work without disrupting operations, making offline-capable IAM and PAM essential for accountability and least privilege, according to Xage Security. The real test is whether governance can preserve segmentation, attribution, and temporary access when the network or device cannot support modern identity controls.
At a glance
What this is: This is an analysis of OT identity security that finds critical infrastructure needs IAM and PAM patterns designed for legacy assets, intermittent connectivity, and shared privileged access.
Why it matters: It matters because IAM and PAM teams have to govern access for OT without breaking operations, and the control model must still deliver attribution, least privilege, and offline enforcement.
By the numbers:
- Credential-based attacks accounted for 80% of initial-access cases involving access brokers, according to Microsoft’s 2025 Digital Defense Report.
Context
Operational technology identity security is the discipline of controlling who and what can reach industrial systems, what they can do, and how those actions are recorded. In critical infrastructure, that problem is harder because the environment often includes legacy assets, remote sites, and connections that cannot depend on constant internet access.
The core governance gap is that standard IAM and PAM patterns assume reliable connectivity, modern authentication support, and clean identity boundaries. OT programmes have to preserve those controls while still keeping plants, pipelines, mines, and other physical operations available to technicians and vendors.
When those assumptions fail, teams either leave access too broad or make it too hard to use. That is why OT identity design has to balance segmentation, attribution, and temporary privilege with operational continuity.
Key questions
Q: What breaks when OT privileged access is left in shared accounts and exceptions?
A: What breaks is accountability. Shared accounts, standing remote access, and long-lived service credentials make it hard to prove who connected, what changed, or whether activity matched approved work. In OT, that also weakens incident investigation and audit readiness because the access path no longer produces a reliable record of responsibility.
Q: Why do legacy OT assets make modern IAM controls harder to apply?
A: Legacy OT assets often cannot support modern authentication methods, agents, or directory integration. That means IAM has to be enforced in front of the device rather than on it. If teams ignore that constraint, they either leave the asset exposed or create brittle workarounds that operators bypass.
Q: How should organisations prioritise JIT access over standing privileged access in OT?
A: Organisations should prioritise just-in-time access whenever elevation is tied to a specific task or maintenance window. Standing privilege should be the exception, not the default, because dormant access remains available long after operational need ends. The key decision is whether the access can expire automatically without slowing safe work.
Q: How do OT teams maintain secure access when remote sites lose connectivity?
A: OT teams need local policy enforcement, local authentication and authorisation data, and offline session recording so approved work continues during WAN outages. If controls depend entirely on central connectivity, operators will either lose access or weaken the rules to keep systems running. Resilience depends on preserving policy at the edge.
Technical breakdown
Why separate OT and IT identity domains matter
OT environments use separate identity domains to limit blast radius. If an IT credential is compromised, it should not automatically open operational systems, and a problem at one site should not expose every other site. The architecture usually combines multiple identity providers, local accounts, and site-specific policy. The trade-off is that users and administrators face more friction, which can encourage shortcuts unless orchestration simplifies the access path without merging the underlying domains.
Practical implication: Preserve domain separation while using a policy layer to unify how access is requested and approved.
Why legacy OT assets need compensating identity controls
Many OT assets were never built for Active Directory, single sign-on, or multifactor authentication. Installing an agent on the device may be unsafe or impossible, so identity enforcement has to sit in front of the asset. Access gateways and overlays can authenticate the user, enforce authorization, broker credentials, and log the session while leaving the device untouched. That approach modernises control without forcing firmware replacement or downtime.
Practical implication: Place identity-aware enforcement at the access boundary for devices that cannot natively support modern authentication.
How just-in-time privileged access changes OT risk
Standing privileged access is especially dangerous in OT because dormant vendor, contractor, and administrator accounts can persist across sites long after the task ends. Just-in-time access ties elevation to a ticket or approved task, then expires it automatically. Credential rotation and entitlement reviews reduce the chance that a forgotten account becomes a standing path into sensitive operational systems. The model works best when approval, scope, and expiry are all explicit.
Practical implication: Replace persistent elevation with task-scoped access that expires automatically and is reviewed against actual operational need.
Threat narrative
Attacker objective: The attacker’s objective is to turn weak privileged access governance into direct control over operational assets and the ability to disrupt or manipulate industrial processes.
- Entry begins when attackers target credential-based access paths, which are common in environments that still depend on shared accounts, remote support, or delayed offboarding.
- Credential access becomes easier when privileged accounts stay active too long or when legacy systems cannot enforce strong authentication directly.
- Escalation follows when the same account can reach multiple assets, commands, or sites without tight scoping, allowing broader operational access than intended.
- Impact is the ability to manipulate sensitive industrial systems, disrupt availability, or hide activity inside weakly attributed shared access paths.
Breaches seen in the wild
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
OT identity security is a governance problem before it is a technology problem. Critical infrastructure environments fail when teams assume modern IAM patterns can be dropped into legacy operations without adaptation. They cannot, because the access model has to respect site autonomy, safety constraints, and intermittent connectivity at the same time. Practitioners should treat OT identity as a distinct control plane with its own operating realities.
Shared and lingering privileged accounts are the clearest accountability failure in OT. The issue is not only excess privilege, but the loss of attributable identity when multiple people use the same account or when offboarding lags behind the work. That breaks incident reconstruction and weakens deterrence. The practical conclusion is that accountability has to be designed into the access path, not reconstructed after the fact.
Offline-capable enforcement is now part of identity resilience for critical infrastructure. Centralised IAM architectures assume persistent reachability, yet mines, offshore platforms, and remote utilities often lose that assumption for hours or days. When that happens, access either fails or controls are relaxed. OT identity programmes should therefore be judged on whether policy, audit, and least privilege still hold when the network does not.
Just-in-time access is the right privilege model, but only when expiry is enforced at the operational edge. Temporary elevation reduces the window for misuse, yet it does not help if local systems keep old entitlements alive after the task ends. The field is moving toward access that is task-scoped, attributable, and removed automatically, which means entitlement governance has to extend beyond the central directory.
Automated machine-to-machine segmentation is becoming as important as human access governance. OT environments increasingly connect devices, services, and analytics platforms that were never meant to trust each other broadly. That expands the lateral movement problem. The identity programme therefore has to govern not just users, but the machine identities and communication paths that now carry operational risk.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: Just-in-Time Access and Zero Standing Privilege Guide
What this signals
Offline-capable access control is now part of OT resilience. Identity governance cannot assume a live enterprise connection when remote sites may be disconnected for hours or days. The programme has to preserve least privilege, logging, and local enforcement at the operational edge, or operators will pressure teams into unsafe exceptions.
Privileged access is the control plane most likely to collapse first in OT convergence. As remote support, cloud analytics, and vendor-managed equipment expand, the access path grows faster than the governance model. The practical signal is that PAM, session control, and entitlement review need to be designed for intermittent connectivity rather than retrofitted after deployment.
For practitioners
- Map OT access paths by identity domain Document which users, vendors, controllers, and services authenticate through each OT, IT, DMZ, and cloud path before rationalising controls.
- Broker access for legacy assets Place an identity-aware access layer in front of devices that cannot support modern authentication, then enforce MFA, command scoping, and session logging at the gateway.
- Convert standing elevation to JIT access Tie privileged OT access to approved tasks, set explicit expiry, and remove dormant vendor and contractor elevation automatically when work is complete.
- Preserve audit continuity during outages Keep local policy decisions and session logs available at remote sites so approved access continues during WAN loss without weakening controls.
- Attribute shared credential use to named users Broker any unavoidable shared local credential through individual user authentication so each session is recorded against a specific person.
Key takeaways
- OT identity security fails when legacy assets, shared credentials, and intermittent connectivity are treated as edge cases instead of design constraints.
- The article shows that credential-based attacks remain a dominant entry path, with 80% of initial-access cases involving access brokers tied to credentials.
- The most effective response is to combine domain separation, compensating controls for legacy devices, and just-in-time privileged access that still works offline.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excessive and lingering privileged access in OT environments. |
| NHI-01 — Improper Offboarding | The article highlights lingering vendor and contractor access after work is complete. | |
| Recommendation — Reduce standing elevation by enforcing task-scoped access and entitlement reviews for OT privileged accounts. Automate offboarding for OT privileged accounts as soon as approved work ends. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | OT access control depends on scoped permissions and explicit authorisation across sites and devices. |
| PR.DS-01 — Data-at-Rest Protection | The article stresses preserving audit records and local policy data during outages. | |
| Recommendation — Apply PR.AA-05 to keep OT entitlements narrowly scoped and continuously reviewed. Protect locally stored identity and audit data so disconnected sites remain governable. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Credential misuse and spread across OT assets are the core threat pattern described. |
| Recommendation — Map OT access controls to TA0006 and TA0008 to constrain credential abuse and cross-site movement. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on shared accounts, offboarding, and privileged account lifecycle. |
| Recommendation — Use CIS-5 to discover, govern, and retire OT accounts that outlive their operational need. | ||
Key terms
- Operational Technology Identity: An identity used in environments where digital access can affect physical processes, equipment, or uptime. These identities often carry higher operational risk because access mistakes can move beyond data exposure into safety, availability, and process integrity concerns.
- Offline-Capable Enforcement: An access model that continues to authenticate, authorise, and log activity when a site loses connection to central services. In OT, this is essential because availability cannot depend on uninterrupted network reachability, and policy decisions have to remain local until synchronisation is possible.
- Runtime Credential Brokering: The practice of issuing credentials only when a workload or agent actually needs them, then letting them expire or become unusable after the task is complete. This reduces standing access and creates a clearer audit trail than storing long-lived secrets in pipelines or agents.
- Just-in-time privilege: A privilege model that grants elevated access only when a specific task requires it and removes it as soon as the task ends. It reduces exposure time, limits lateral movement opportunities, and is especially useful for high-risk human and machine identities.
Deepen your knowledge
NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org