OT security needs pre-execution control, not delayed detection

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Crytica Security's blog post: OT security fails when IT-designed controls collide with low-resource systems, no-downtime constraints and the need to stop malware before execution.

Why it matters: This matters because critical infrastructure teams have to govern OT protection without assuming they can patch, reboot or scan their way out of risk, and remote access, vendor links and IT-OT convergence now widen the attack surface.

Context

Operational technology is the hardware and software that runs industrial processes, from utilities to manufacturing lines, where availability and safety matter more than frequent change. In these environments, controls designed for office IT often fail because they assume patch windows, agent overhead and rapid rollback are acceptable.

The governance problem is not a lack of security ambition but a mismatch between security design and operational reality. Once OT networks connect to IT systems, remote access and third-party pathways also become critical infrastructure identity security issues, especially where legacy systems still depend on shared access patterns.

That mismatch is typical across connected OT environments, not an edge case, which is why security programmes need controls that fit industrial constraints rather than retrofitted enterprise assumptions.

Key questions

Q: How do I secure legacy OT systems without overloading them?

A: Use passive or low-overhead monitoring, network segmentation, and whitelisting controls instead of heavy host agents. Legacy OT devices often have limited CPU, memory, and patch tolerance, so security should rely on span ports, taps, asset baselining, allow-listing, and tightly scoped remote access rather than endpoint tools that can disrupt control processes.

Q: Why does post-execution malware detection fail in industrial environments?

A: Post-execution malware detection fails because industrial environments often prioritise availability, use older operating systems, and run specialised protocols and controllers that do not tolerate intrusive agents. Malware may also blend into maintenance traffic or execute briefly between process cycles, so detection needs network monitoring, application allow-listing, and process-aware telemetry rather than relying only on endpoint signatures.

Q: How does IT-OT convergence change attack paths in critical infrastructure?

A: IT-OT convergence expands attack paths by linking business identity, remote administration, and plant networks that were once more isolated. Shared authentication, poorly segmented flat networks, and weak access governance let a compromise move from email or VPN access into engineering workstations, historians, and control systems, so identity, segmentation and access governance become part of the attack surface.

Q: What should teams do first when OT systems cannot tolerate downtime?

A: Start by mapping critical assets, defining safety and availability constraints, and putting compensating controls around the highest-risk connections. For systems that cannot tolerate downtime, use passive monitoring, network segmentation, jump servers, restricted maintenance windows, and rollback plans so visibility and control improve without interrupting process operation.

Technical breakdown

Why heavy IT security tools fail on legacy OT systems

OT devices often run on constrained hardware, older operating systems and maintenance cycles measured in years, not weeks. Traditional endpoint agents, malware scanners and update-heavy platforms assume spare CPU, memory and reboot tolerance. In industrial settings, those assumptions break down quickly. A control that needs frequent patching or background processing can destabilise the very process it is meant to protect. The result is not just reduced security coverage but a deployment model that operators cannot sustain. See the OT and ICS Identity and Access Guide. See the OT and ICS Identity and Access Guide.

Practical implication: Size security controls to the device and process constraints first, then decide whether they can be deployed without affecting uptime.

Why post-execution detection is too late for OT risk

Conventional detection tools often trigger after code starts running, which is workable in many IT contexts but dangerous in OT. Industrial systems may execute a malicious payload before an analyst can isolate the event, and new or AI-generated malware can evade signature-based controls entirely. In that model, dwell time becomes the real loss driver because response starts after the attacker has already influenced the process. Detecting at or before injection changes the security objective from containment after execution to prevention at the point of entry.

Practical implication: Shift monitoring and containment logic toward pre-execution detection where process integrity cannot tolerate even brief compromise.

How IT-OT interconnectivity expands the attack surface

Air-gapped design once reduced exposure by limiting routes into industrial systems, but modern OT environments rarely stay isolated. Remote maintenance, vendor access and data exchange with IT systems create additional entry points that attackers can chain together. A weakness in one environment can now become a path into the other, so the boundary is no longer physical separation alone. That is why segmentation, remote access governance and trusted device handling matter as much as malware detection. The security model has to assume that connectivity is permanent, not exceptional. See the Critical Infrastructure Identity Security Guide.

Practical implication: Treat every IT-OT connection as a governed trust relationship, not as an operational convenience.

Threat narrative

Attacker objective: The attacker aims to reach and influence industrial operations before defenders can detect or contain the payload, creating operational disruption or safety impact.

1. Entry occurs through interconnected OT pathways such as remote access, third-party connections or bridged IT systems rather than through a purely isolated industrial network.
2. Credential or access weakness then gives the attacker a route into the industrial environment, where legacy systems and constrained controls limit defensive options.
3. Escalation happens when malware or a malicious payload executes before traditional detection can react, allowing the attack to affect operational processes.
4. Impact is delayed response, disrupted availability and increased safety risk in systems that cannot afford downtime or heavy remediation.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT security fails when the control model assumes IT-style flexibility. Industrial environments do not absorb scans, reboots, heavyweight agents or frequent updates the way enterprise endpoints do. That makes uptime a security constraint, not an operational preference. The practical conclusion is that control design has to start from process continuity and device limits, not from a generic endpoint architecture.

Pre-execution control is the named concept this market needs to sharpen. OT defence cannot rely on finding malware after it has started running because the process may already be compromised by then. The more accurate security objective is to reduce or eliminate dwell time at injection, which changes where detection logic must sit in the stack. Practitioners should judge tools by whether they can interrupt execution before process impact begins.

Connectivity, not isolation, now defines OT exposure. Remote access, vendor pathways and IT-to-OT links turn once-separated environments into shared trust surfaces. That makes critical infrastructure identity security part of OT security, because access pathways and privileged connections become the practical entry points attackers will test. The conclusion for practitioners is that segmentation and access governance have to be treated as core OT controls, not perimeter add-ons.

Lightweight telemetry only matters if it preserves operational control. A security system that is too heavy to deploy, or too dependent on cloud reachability, does not solve the OT problem. The right question is whether monitoring can persist inside constrained environments while staying resilient if a node is compromised. Practitioners should favour architectures that maintain security presence without creating new operational fragility.

What this signals

OT security architecture has to become constraint-aware. The decisive issue is no longer whether a control can detect threats in theory, but whether it can operate inside legacy systems, limited memory and uptime-sensitive processes. Practitioners should expect more designs that trade heavy endpoint logic for earlier, lower-footprint control points.

Identity now sits inside OT risk management. Remote access, vendor paths and bridged environments turn privileged access into the most practical route into industrial systems, so OT programmes will increasingly need access governance alongside segmentation. That means the security plan has to account for who can reach the process layer, not only what malware may arrive there.

Pre-execution defence will become the sharper operating model. In environments where response after launch is already too late, the security programme has to focus on stopping execution from becoming operational impact. Teams that keep using post-execution metrics alone will underestimate real risk and overestimate control coverage.

For practitioners

• Assess OT control fit against device constraints Inventory where agents, scanners and update-heavy tools would exceed available CPU, memory or maintenance windows, then exempt or redesign those deployments. See the OT Asset Visibility Guide.
• Prioritise pre-execution detection for critical processes Place detection logic as close as possible to process entry so malicious code is blocked before launch, not after visible execution begins.
• Govern every IT-OT connection as a privileged pathway Review remote access, vendor links and cross-zone integrations as high-risk access paths that require strict authentication, segmentation and monitoring.
• Test resilience against compromise of the monitoring layer Validate whether your OT security architecture still functions if a probe or sensor is disrupted, isolated or removed from the network.

Key takeaways

• OT security fails when tools assume spare compute, easy patching and tolerated downtime, because industrial operations do not work on IT’s maintenance model.
• Connectivity between IT and OT creates new entry paths, which means remote access and vendor links have to be treated as privileged trust relationships.
• The practical shift is from reactive detection to pre-execution defence, with controls sized to preserve uptime and still interrupt malicious code before it runs.

Related NHI Mgmt Group resources: Critical Infrastructure Identity Security Guide · OT and ICS Identity and Access Guide · OT Asset Visibility Guide · OT Security Guide

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Air-Gapped Network: An air-gapped network is a system isolated from external networks, especially the internet, to reduce exposure to remote attack. In security terms, it uses physical or administrative separation to limit data transfer, often relying on controlled removable media or manual processes, which still requires strong access, monitoring, and endpoint controls.
• Remote Access: Remote access is the ability for a user or system to reach applications, devices, or data from outside the local network. In identity security, it relies on strong authentication, least privilege, session control, and monitoring to reduce exposure from stolen credentials, unmanaged endpoints, and insecure network paths.
• Endpoint Detection and Response: Endpoint detection and response is security software that monitors individual devices for suspicious activity, investigates threats, and supports containment actions. It is designed for persistent hosts such as laptops and servers, where an agent can collect telemetry over time and give responders visibility into process, file, and network behaviour.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course when your programme needs a stronger foundation in identity-led security governance.