OT telemetry enrichment is becoming a security control, not a cost line

At a glance

What this is: This is an independent analysis of why OT telemetry is hard to secure at scale and how pre-ingestion enrichment changes the security model.

Why it matters: It matters because SOC, IAM, and resilience teams need to decide which telemetry becomes security evidence, which becomes operational context, and where identity and access signals belong in the pipeline.

By the numbers:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.

👉 Read DataBahn's analysis of OT telemetry enrichment and SIEM blind spots

Context

OT telemetry is continuous operational data from physical systems such as turbines, pumps, valves, sensors, and industrial controllers. It creates a governance problem because the tools built for security logs were designed around discrete events, not high-volume signals that describe changing physical conditions in real time. When that data is not integrated into security operations, teams lose visibility into the boundary where digital control meets physical impact.

The identity angle is indirect but real. OT environments now depend on service accounts, remote access paths, API integrations, and cloud-connected pipelines to move telemetry into enterprise tools. That means access control, credential handling, and routing policy all affect whether operational data can be trusted, retained, and acted on safely. The starting position described in the article is increasingly typical, not exceptional.

As OT systems converge with cloud and enterprise analytics, telemetry is becoming both a resilience input and a security control surface. The practical question is no longer whether the data exists, but whether the pipeline preserves enough context to support detection, attribution, and safe response without overwhelming the SOC or the budget.

Key questions

Q: What breaks when OT telemetry is treated like ordinary SIEM data?

A: The main failure is economic and operational. Continuous OT streams overwhelm ingestion-based security tools, so teams either drop data, down-sample it, or delay analysis until after the moment that mattered. That creates blind spots in detection, slows response, and weakens the link between physical process behaviour and security judgement.

Q: Why do OT environments need enrichment before ingestion?

A: Because context determines whether a signal deserves expensive retention or can be routed elsewhere. If asset ownership, threat intelligence, and identity context arrive only after ingestion, the organisation has already paid full SIEM cost and lost the chance to make a timely routing decision. Pre-ingestion enrichment makes the pipeline itself a control point.

Q: What do teams get wrong about OT telemetry visibility?

A: They assume more collection automatically means better security. In practice, ungoverned collection can create cost, latency, and noise without improving detection. The real objective is not to store every byte in the SIEM, but to preserve the right context at the right point in the pipeline so analysts can act on meaningful signal.

Q: Who should be accountable when telemetry access exposes sensitive data?

A: Accountability should sit with the data and security owners who define classification, retention, masking, and access policy. If telemetry contains personal data, secrets, or regulated records, those controls need explicit ownership, not informal engineering discretion.

Technical breakdown

Why OT telemetry does not fit SIEM log models

OT telemetry is continuous, high-frequency, and numeric, while SIEMs are optimised for discrete, text-oriented security events. A temperature reading every second, a vibration feed, or a valve position stream can generate too much data to ingest economically at full fidelity. This creates a structural mismatch: the security stack expects events, but operations produces signals. Once teams down-sample or discard data to fit storage models, they lose the context needed to distinguish normal operational variation from malicious interference.

Practical implication: define which OT signals need security retention before they reach the SIEM, not after.

Why pre-ingestion enrichment changes the security model

Enrichment attaches context such as asset identity, threat intelligence, geolocation, and ownership to telemetry while it is still in motion. That matters because a raw event and a contextualised event support different decisions. If enrichment happens after ingestion, the organisation has already paid ingestion cost and lost decision time. If it happens before ingestion, the pipeline can route high-value events to the SIEM and lower-value events elsewhere. In effect, enrichment becomes part of detection design, not just post-event analysis.

Practical implication: move enrichment upstream so routing decisions are based on value, not just volume.

How agentic AI can govern telemetry pipelines

Agentic AI in this context is not a chatbot. It is a software system that can decide how to classify, parse, filter, and route new telemetry patterns without waiting for manual rule changes. Used carefully, it can detect schema drift, generate parsers for new sources, and identify which fields are security-relevant. That reduces the operational lag between a new OT source appearing and the security team being able to use its data. The risk is governance drift if those decisions are not auditable and bounded by policy.

Practical implication: require human-approved policy boundaries for any AI that classifies or routes operational telemetry.

Threat narrative

Attacker objective: The attacker aims to move from visibility into operational systems to disruption of physical processes, safety controls, or continuity of service.

1. Entry occurs when attackers reach operational systems through exposed connectivity such as misconfigured VPNs, middleware flaws, or remote access paths linking OT to IT.
2. Escalation follows when the attacker can observe or manipulate telemetry that should have remained isolated, turning operational data into a source of reconnaissance or control influence.
3. Impact occurs when altered readings, disrupted telemetry, or delayed detection hide malicious activity long enough to affect safety, production, or business continuity.

NHI Mgmt Group analysis

OT telemetry has become a governance problem, not just an observability problem. The issue is no longer simply that security teams lack data. The deeper problem is that the pipeline itself decides whether operational signals become security evidence, and that decision now shapes detection, retention, and response. For practitioners, this makes telemetry architecture part of control design, not an IT plumbing detail.

Continuous-data blind spots create a detection-response latency gap. Security teams often assume they can analyse OT data later, after ingestion or during investigation, but that assumption breaks when the data volume is too high to store economically. When context arrives after the fact, the organisation has already lost the opportunity to suppress low-value noise and retain high-value signal. Practitioners should treat latency between signal creation and security action as a control weakness.

Identity and access control now sit inside the telemetry pipeline. OT data increasingly flows through remote collectors, cloud routing layers, and service accounts that move information between environments. That means weak access governance can expose the very data used to detect attacks, while over-permissive routing can send sensitive operational context to the wrong destination. The practical conclusion is that pipeline identity, not just device identity, needs explicit governance.

Agentic AI may reduce telemetry friction, but it also introduces governance debt if left unbounded. AI-assisted parsing and routing can help teams cope with new formats and noisy data sources, but only if its decisions are explainable, policy-bound, and reviewed. Without that, organisations risk trading one blind spot for another. Practitioners should insist on auditable rules for any AI that classifies or forwards operational signals.

Event-driven security thinking is no longer enough for cyber-physical environments. OT security now depends on preserving continuous context across collection, enrichment, and routing. That shifts the market toward data pipelines that can support both resilience and security outcomes. For practitioners, the implication is clear: invest in control points that preserve context before the SIEM ever sees the data.

What this signals

Continuous telemetry is turning pipeline design into a security decision. For SOC and resilience teams, the priority is no longer just collecting more data but deciding where context is attached, how long it is retained, and which identity-controlled services are allowed to move it. That makes pipeline governance part of operational defence, especially when data must support both safety and incident response.

Pipeline identity is an emerging control surface. The collectors, forwarders, and automation components that carry OT data now behave like non-human identities because they authenticate, route, and transform information across trust boundaries. That means entitlement review, credential rotation, and offboarding matter even in data engineering workflows, particularly where service accounts can influence what the SOC sees. See the NHI Lifecycle Management Guide for the lifecycle angle and NIST Cybersecurity Framework 2.0 for the broader control structure.

Enrichment timing is becoming a resilience metric. Organisations should watch how many high-value OT events are enriched before ingestion, how quickly new sources are parsed, and how often AI-assisted routing decisions remain explainable under audit. Those signals tell you whether telemetry is acting as a security asset or simply becoming a more expensive log stream.

For practitioners

• Define OT telemetry retention by security value Classify OT sources into high-value, medium-value, and operational-only streams before ingestion so the SIEM is reserved for data that can drive detection or investigation. Use asset criticality, threat relevance, and physical impact potential as the decision criteria.
• Move enrichment into the collection pipeline Attach asset ownership, geolocation, threat intelligence, and identity context while telemetry is in motion so downstream routing can suppress low-value noise without losing forensic detail.
• Govern service accounts and routing identities Treat collectors, forwarders, and pipeline automation as identities with scoped access, rotation, and audit trails because they can expose or misroute the operational data they move.
• Test AI-assisted parsing for auditability If you use AI to generate parsers or classify new OT sources, require reproducible outputs, approval gates, and logs that show why a feed was routed or filtered.
• Align SOC and OT teams on shared thresholds Agree which anomalies trigger security escalation versus engineering follow-up, so operational noise does not suppress genuine attack indicators and security analysts do not ignore process drift.

Key takeaways

• OT telemetry has moved from an engineering dataset to a security control surface because continuous signals can reveal attacks that ordinary logs miss.
• Pre-ingestion enrichment changes the economics and the security model at the same time, because context determines what gets retained, routed, and investigated.
• As OT pipelines become more identity-driven and AI-assisted, governance must extend to collectors, service accounts, and routing logic, not just the underlying devices.

Key terms

• OT Telemetry: Telemetry from operational technology includes continuous measurements from physical systems such as sensors, controllers, and industrial equipment. Unlike ordinary security logs, it describes how machines are behaving in real time, which makes it useful for both resilience and attack detection.
• Pre-ingestion Enrichment: Pre-ingestion enrichment is the practice of adding context to telemetry before it reaches the SIEM. That context can include identity resolution, asset ownership, threat intelligence, geolocation, and sensitivity markers, allowing organisations to route, retain, or mask data with more precision than raw logs permit.
• Pipeline identity: A pipeline identity is the non-human identity a CI/CD workflow uses to authenticate to cloud, source control, secrets systems, and deployment targets. These identities are often overprivileged because they must automate multiple steps. That makes them high-value targets and a central concern in supply chain security.
• Agentic AI Routing: Agentic AI routing is the use of an AI system to decide how data should be classified, filtered, and forwarded within a pipeline. In security operations, that only works safely when decisions are bounded by policy, logged, and subject to review.

What's in the full article

DataBahn's full article covers the operational detail this post intentionally leaves for the source:

• How the pipeline architecture handles high-volume OT collection at the edge without overwhelming central tools
• How enrichment and filtering are applied before SIEM ingestion to preserve context while reducing cost
• How AI-assisted parser generation supports new telemetry sources without manual re-engineering
• How policy-driven routing separates security-relevant data from operational telemetry for different consumers

👉 DataBahn's full article covers the telemetry pipeline, enrichment mechanics, and SIEM routing approach in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives identity and security practitioners a common foundation for controlling the identities that move data across modern environments.