OT telemetry enrichment is becoming a security control, not a cost line

At a glance

What this is: DataBahn argues that OT telemetry enrichment is now a security control because continuous operational signals must be classified and routed before SIEM ingestion.

Why it matters: For SOC, resilience, and OT security teams, the issue is no longer raw log collection but whether telemetry context arrives early enough to change detection, retention, and response decisions.

Context

OT telemetry is the continuous data produced by industrial and cyber-physical systems, such as pressure, vibration, flow, and temperature readings. The security problem is that legacy SIEM pipelines were built for discrete logs, not high-volume operational signals, so the context needed to judge risk often arrives too late.

As plants, utilities, and manufacturing environments connect more tightly to enterprise networks and cloud services, the line between operations data and security data keeps narrowing. That creates a governance gap: if telemetry is treated only as a cost line, teams end up with blind spots in detection, resilience, and incident triage.

Key questions

Q: How should SOC teams govern OT telemetry without overwhelming the SIEM?

A: Treat OT telemetry as a separate governed stream, not as ordinary log volume. Enrich and classify it before ingestion, then route high-value signals to the SIEM and lower-value data to cheaper storage. That preserves detection value while avoiding runaway ingestion costs and gives analysts the context they need at the moment of triage.

Q: Why does pre-ingestion enrichment matter for industrial telemetry?

A: Because the security value of OT data depends on context that must be present before retention decisions are made. If enrichment happens after ingestion, the SIEM has already billed the event and the analyst still has to reconstruct meaning later. In-stream enrichment changes the economics and the detection outcome at the same time.

Q: What breaks when OT telemetry is down-sampled too aggressively?

A: Teams lose the continuity needed to spot process drift, unsafe changes, and slow-moving intrusion patterns. Down-sampling may reduce storage pressure, but it can also remove the very signals that distinguish normal variation from malicious interference. The failure is not just less data. It is less operational truth for both security and engineering teams.

Q: Should organisations use AI to route telemetry before SIEM ingestion?

A: Yes, but only with auditable policy boundaries. AI can help detect new schemas, classify noise, and prioritise security-relevant signals, yet it must not become an unreviewed decision-maker. The right use is controlled automation that improves scale and consistency while keeping retention and routing accountable.

Technical breakdown

Why continuous OT telemetry breaks legacy SIEM assumptions

OT telemetry is not just “more logs”. It is a different data shape altogether: continuous, numeric, high-frequency, and often sampled many times per minute. Legacy SIEMs were optimised for discrete, text-based events that can be indexed and correlated cheaply. When teams push dense OT streams into those tools without redesigning the pipeline, they create schema mismatch, storage pressure, and poor analytical value. The result is not merely higher cost. It is a structural loss of context, because the data that describes physical process state is either down-sampled, discarded, or delayed until it no longer supports timely security decisions.

Practical implication: Treat OT telemetry as a distinct data class and design collection, parsing, and retention around it rather than forcing it into standard log assumptions.

Why enrichment timing changes the security outcome

Enrichment is the process of attaching context such as asset ownership, geolocation, identity resolution, and threat intelligence to raw telemetry. If that happens after ingestion, the SIEM has already paid full price for the event and the analyst still has to reconstruct meaning later. If it happens in stream, the pipeline can decide whether an event deserves expensive retention before the data is committed. That shift matters because the value of context is highest at the point of routing. Stream enrichment turns telemetry from a passive record into an active control point for detection, storage, and triage.

Practical implication: Move enrichment upstream so retention and routing decisions are based on context, not on raw event volume.

How AI changes OT telemetry governance

Agentic AI can help govern telemetry pipelines because it can recognise new formats, spot schema drift, filter noise, and route sensitive data in real time. That does not remove the need for human control. It changes the control point from downstream analysis to ingestion-time policy enforcement. In operational environments, the challenge is scale: hundreds of sources, variable bandwidth, and constantly changing log formats. AI becomes useful when it helps preserve fidelity without forcing every signal into the SIEM. The governance question is therefore not whether to use AI, but how to constrain it so routing decisions stay auditable and aligned to operational risk.

Practical implication: Use AI-assisted parsing and routing only with clear policy boundaries, auditable rules, and human oversight on what gets retained or dropped.

Threat narrative

Attacker objective: The attacker’s objective is to interfere with physical operations while staying hidden inside telemetry gaps long enough to cause operational impact.

1. Entry occurs when a misconfigured VPN or middleware bridge exposes OT systems that were previously isolated from enterprise networks.
2. Credential or access abuse then lets the attacker reach telemetry-linked control paths and observe or alter operational data streams.
3. Escalation happens when the lack of unified telemetry hides silent anomalies, allowing malicious changes to blend into normal process noise.
4. Impact is physical or operational disruption, including production stoppage, equipment damage, or safety risk before the SOC can correlate the event.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• Sumo Logic breach 2023: A compromised credential opened a Sumo Logic AWS account; customers were told to rotate API keys and stored credentials. No data impact was found.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT telemetry has become a security control surface, not a logging problem: once operational signals determine whether a pipeline retains, routes, or suppresses data, they are part of the security architecture. The old view treated telemetry as a cost to absorb after collection. That model fails when the value of the signal depends on context at ingestion time. Practitioners should treat telemetry governance as control design, not storage optimisation.

Pre-SIEM enrichment is the decisive control shift: enrichment after ingestion is forensics, not defence, because the cost and the delay have already been incurred. Stream enrichment changes the question from “what did this event mean?” to “should this event be retained at full fidelity at all?” That distinction is especially important in OT environments where volume, latency, and continuity constraints are inseparable. The practitioner implication is clear: retention strategy and detection strategy now have to be designed together.

Telemetry pipeline design is now part of resilience engineering: connected OT environments do not just need more data, they need governed data movement across edge, stream, and central analytics layers. This is where identity and access governance also re-enters the picture, because the systems that collect, enrich, and route telemetry are themselves high-trust integrations. If those integrations are not controlled, the SOC inherits blind spots that no amount of downstream correlation can fix. Practitioners should govern telemetry as infrastructure with security authority, not as a passive transport layer.

Agentic AI can reduce telemetry friction, but only if its decisions are bounded: the promise is not autonomous security, it is faster parsing, better filtering, and policy-aware routing at scale. That matters because OT data diversity makes manual pipeline engineering unsustainable. But AI-driven pipeline control becomes another governance layer that must be monitored for drift, exception handling, and auditability. Practitioners should use AI to scale telemetry control, not to replace control ownership.

What this signals

OT telemetry is becoming a security governance issue, not just an observability issue: when the same data determines both operational continuity and detection fidelity, the pipeline itself becomes part of the control environment. Practitioners should expect more scrutiny on where telemetry is collected, how it is enriched, and who can change routing policy.

Telemetry enrichment is moving closer to the edge: organisations with distributed industrial sites will increasingly need local collection, compression, and policy-aware forwarding to preserve visibility without saturating central security platforms. That shift changes resilience planning because collection failure now becomes a security risk, not only an operations nuisance.

AI-assisted telemetry control will need tighter governance than classic log pipelines: once machine-assisted parsing influences what the SOC sees, teams need explicit review of drift, exception handling, and retention logic. The practical signal is simple: if enrichment decisions cannot be explained, they cannot be treated as a control.

For practitioners

• Define OT telemetry as a governed security data class Classify OT signals separately from standard IT logs so ingestion, retention, and cost rules reflect continuous operational data rather than discrete event assumptions.
• Shift enrichment upstream into the collection pipeline Attach asset identity, geolocation, threat intelligence, and ownership context before SIEM ingestion so routing decisions can be made on enriched value.
• Build edge filtering for constrained OT sites Use local collectors to compress, prioritise, and forward security-relevant telemetry when bandwidth and site connectivity vary across plants and utilities.
• Apply policy controls to AI-assisted parsing Constrain schema detection, noise reduction, and routing automation with audit logs and human review so AI does not become an opaque control plane.
• Align telemetry retention to operational risk Keep high-fidelity records for signals that affect safety, uptime, or incident triage, and tier down lower-value data only after context has been attached.

Key takeaways

• OT telemetry is no longer just an operations feed because its context now determines whether security teams can detect interference before it reaches physical impact.
• The main constraint is architectural, not analytical: legacy SIEM pipelines were built for discrete logs, while OT environments generate continuous high-volume signals.
• Teams that move enrichment and routing upstream can improve visibility, reduce ingestion pressure, and preserve the data needed for both resilience and incident response.

Key terms

• Operational Telemetry: Operational telemetry is the current data generated by systems about their active state, usage, and condition. For identity programmes, it is valuable because it turns abstract records into evidence that can support entitlement reviews, offboarding, and spend decisions with less manual reconciliation.
• Pre-SIEM Enrichment: Pre-SIEM enrichment is the process of attaching security context to telemetry before it reaches the SIEM. That context can include identity data, asset ownership, geolocation, or threat intelligence, allowing teams to make a routing decision before they pay indexed-storage costs.
• Telemetry routing: The process of directing logs and events to different destinations based on value, urgency, and investigative need. In mature SOC designs, routing is a security control because it determines which events remain searchable in the SIEM and which are archived more cheaply.
• Agentic AI Pipeline Control: Agentic AI pipeline control is the use of AI systems to manage parts of the data collection and enrichment workflow, such as schema detection, noise reduction, and policy-based forwarding. The governance requirement is that these decisions remain constrained, observable, and subject to human accountability.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for security practitioners who need to connect identity governance to adjacent control problems like telemetry, access, and automation.