OT security vendors in 2026: why segmentation decides outcomes

At a glance

What this is: This is a 2026 comparison of OT security vendors that concludes identity-based segmentation matters more than detection alone when attackers try to move laterally into production systems.

Why it matters: For IAM, NHI, and OT teams, it shows why access policy on the network itself has to complement visibility and detection if the goal is to contain industrial intrusions before they affect operations.

By the numbers:

• 22% of organisations experienced a cybersecurity incident affecting their ICS or OT systems in the past year.
• 708 ransomware incidents hit industrial entities in Q1 2025 alone, according to Dragos.

Context

OT security in this article means the controls that protect industrial control systems, plant networks, and the devices that keep production running. The central governance gap is not lack of visibility. It is whether the environment can stop unnecessary east-west movement fast enough to keep an intrusion from reaching operational systems.

Elisity frames the market as two lanes. One lane finds assets and anomalies, while the other enforces communication policy and contains blast radius. That distinction matters for identity governance because OT segmentation increasingly depends on identity-based policy, not just IP-based monitoring or perimeter firewalls.

The article also grounds the risk in current operational reality: industrial environments carry long device lifecycles, unmanaged assets, and brownfield constraints that make re-architecture unrealistic. The practical question for practitioners is which controls can be enforced without disrupting production.

Key questions

Q: What fails when OT security relies on detection without enforcement?

A: Detection-only OT programmes can tell you that suspicious traffic exists, but they do not prevent that traffic from reaching production systems. Once an attacker is inside, weak internal trust lets lateral movement continue. Segmentation changes the outcome because it turns network policy into a hard control instead of a post-incident observation.

Q: Why does lateral movement matter so much in industrial environments?

A: Lateral movement is the stage that turns a foothold into operational impact. In OT, the target is often not data theft but access to systems that influence production, safety, or uptime. If internal trust is broad, a single compromise can spread across zones and reach assets that should never have been reachable.

Q: What are the signs that an OT segmentation model is too weak?

A: Common warning signs include flat network trust, unmanaged assets sharing the same communication paths as critical controllers, and remote access tools that can reach too many segments. If you can detect movement but cannot block it between zones, the segmentation model is not yet doing its job.

Q: What is the difference between OT monitoring and OT enforcement?

A: OT monitoring observes traffic and flags anomalies. OT enforcement decides what is allowed to communicate and blocks the rest. Monitoring is essential for visibility, but enforcement is what contains blast radius. Mature programmes need both, because one tells you what happened and the other stops it from spreading.

Technical breakdown

Identity-based microsegmentation in brownfield OT networks

Identity-based microsegmentation maps policy to the identity of a device, user, or workload rather than to a static network location. In OT, that matters because legacy controllers, unmanaged devices, and mixed IT/OT segments cannot always be readdressed, reimaged, or placed behind new inline appliances. The technical value is that policy enforcement can happen over existing switching infrastructure, which preserves production stability while creating zones and conduits around assets that previously shared too much trust.

Practical implication: enforce communication policy on the existing access layer instead of waiting for a redesign that production cannot absorb.

Detection versus enforcement in OT security architecture

Detection platforms observe traffic and raise alerts when something looks wrong. Enforcement platforms decide whether communication is permitted and block flows that violate policy. Those are different control jobs. In industrial environments, visibility tells you movement is happening, but enforcement determines whether that movement can reach controllers, historians, or other production assets. This is why mature OT programmes treat detection as situational awareness and segmentation as outcome control.

Practical implication: pair monitoring with policy enforcement so the environment can stop lateral movement, not merely report it.

Zones and conduits as the control model for industrial segmentation

The zones-and-conduits model from industrial security standards separates assets into trust zones and defines allowed conduits between them. Identity-based segmentation operationalises that idea by binding communication rights to what the asset is, not just where it sits on the network. That approach is especially relevant where OT and IT converge, because the attack surface expands when remote access tools, unmanaged endpoints, and shared infrastructure are all allowed to communicate too freely.

Practical implication: map OT communication paths to zones and conduits first, then enforce the minimum flows each zone actually needs.

Threat narrative

Attacker objective: The attacker’s objective is to reach and affect production systems by moving laterally through industrial trust relationships.

1. Entry occurs through the wider industrial attack surface, where exposed OT or IT touchpoints allow the intrusion to reach the environment.
2. Credential or access abuse then enables the attacker to move beyond the first point of contact into trusted segments.
3. Lateral movement follows when weak internal segmentation lets the activity spread toward production systems.
4. Impact occurs when the intrusion reaches assets that influence operations, making containment the decisive control variable.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Detection is not the same as containment: OT security programmes still too often treat visibility as if it were a control outcome. That works for triage, but not for stopping east-west movement once an intrusion is inside an industrial network. The governance implication is simple: if the programme cannot constrain communication paths, it cannot claim blast-radius control.

Identity-based segmentation is the more durable enforcement model for OT: OT environments are defined by long asset lifecycles, unmanaged endpoints, and production constraints that make agent-based or forklift-style redesigns unrealistic. Binding access policy to identity and network role, rather than to IP sprawl, is what makes segmentation usable in brownfield plants. Practitioners should treat that as an architectural requirement, not a feature choice.

Zones and conduits now need identity semantics: The classic OT model assumes the network boundary itself is meaningful. In converged environments, that assumption weakens because shared infrastructure, remote access tools, and mixed IT/OT paths blur location-based trust. Identity-based microsegmentation restores a governable trust boundary by deciding which assets may speak, not by assuming the network already knows.

OT segmentation is becoming the control that decides outcome, not just posture: The field is moving from “can we see the asset?” to “can we stop the wrong conversation?” That shift matters because operational disruption is the consequence practitioners are trying to avoid, and segmentation is the control that changes whether lateral movement becomes a plant issue.

Named concept, lateral movement containment gap: The article exposes a recurring failure mode where industrial programmes can detect movement but still allow it to reach production. That gap is not solved by more telemetry alone. Practitioners need to treat containment as the primary design objective when evaluating OT security architectures.

What this signals

Identity-based enforcement is becoming the practical centre of OT segmentation strategy: In brownfield plants, the network cannot be rebuilt around every asset lifecycle, so policy has to move to the layer that can still be governed. That pushes practitioners toward access-layer enforcement and away from architectures that depend on perfect replatforming.

Lateral movement containment gap: OT programmes now need to distinguish between seeing an intrusion and stopping it. The first is necessary for response, but the second is what prevents operational disruption when an attacker reaches internal trust paths. If policy cannot narrow those paths, the environment remains too permissive.

What changes for practitioners is the decision point: segmentation is no longer just a network design topic. It is an identity governance problem because the thing being controlled is who or what may communicate with what, under which conditions, across IT, OT, and IoT.

For practitioners

• Map OT trust zones to actual communication paths Inventory which users, workloads, and devices genuinely need to talk to each other, then translate those flows into enforceable zone and conduit rules across IT and OT.
• Prioritise east-west containment over alert volume Use segmentation to stop lateral movement between plant segments, while keeping detection focused on correlation, investigation, and response rather than containment claims.
• Test enforcement on existing switching infrastructure Validate that segmentation policy can be applied without new inline hardware, agents, or a production shutdown, because brownfield OT cannot tolerate heavy redesign.
• Define the minimum allowed flows for each industrial asset class Separate controllers, HMIs, historians, remote access tools, and unmanaged devices into policy groups so the default is deny unless a flow is explicitly required.

Key takeaways

• OT environments remain exposed because internal trust often allows attackers to move laterally after the first foothold.
• The article’s core evidence is that industrial incidents are frequent enough and disruptive enough to make containment a board-level concern.
• Identity-based segmentation is the control that changes the outcome because it constrains communication before an intrusion reaches production systems.

Key terms

• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Zones And Conduits: An industrial security model that groups assets into zones with shared security requirements and defines controlled conduits between them. It is most effective when the conduits are enforced at a granular level, because coarse segmentation often leaves too much trust inside each zone.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.