OT/IT convergence security depends on controlled access and segmentation

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Admin By Request's blog post: OT/IT convergence increases factory exposure by importing IT vulnerabilities, while overprivileged accounts, uncontrolled vendor access, and rushed remote access setups create persistent operational risk.

Why it matters: This matters because manufacturing security now depends on governing privileged access and remote connectivity without interrupting production, which makes OT and IT control alignment an IAM and PAM problem as much as a network one.

Context

OT and IT convergence changes the security model for industrial environments: systems that once lived behind an assumed boundary now share access paths, identities, and remote support channels. The result is not just broader connectivity, but a collapse of the old separation between production control and enterprise trust.

The core governance gap is that most OT programmes were not built for shared access, external vendors, or frequent privilege changes. When a factory starts depending on remote maintenance and corporate authentication paths, old assumptions about isolation, fixed admin trust, and rare change windows stop holding. Treat OT remote access controls as part of the identity programme, not as a side-channel network issue.

Key questions

Q: How should security teams reduce privileged access risk in OT without causing downtime?

A: Start with the access paths that create the largest blast radius, not the ones that are easiest to change. That usually means vendor remote access, shared administrator accounts, and service identities with broad permissions. Phase controls around maintenance windows, and use monitoring, rotation, and controlled elevation to reduce risk before attempting larger structural change.

Q: Why does remote vendor access increase risk in industrial environments?

A: Remote vendor access increases risk because it extends trust beyond the plant boundary and often relies on credentials that outlive the session. If those credentials are static or broadly reusable, they become a durable entry point into ICS and SCADA systems. The risk is not the vendor relationship itself, but uncontrolled privilege scope.

Q: How does network segmentation limit lateral movement in OT?

A: Network segmentation limits lateral movement in OT by breaking the environment into separate trust zones with firewalls, VLANs, data diodes or industrial DMZs, so a compromised host cannot freely reach controllers, historians or engineering stations. It is most effective when the separated OT zone is paired with tightly scoped rules, jump hosts and monitored allow-lists rather than flat routing.

Q: What is the best way to govern OT remote access without slowing production?

A: The best way is to broker remote OT access through privileged access management with controlled, approved, and revocable sessions, usually via a jump server, MFA, session recording and time-bound access rules. That keeps vendors and engineers on least-privilege paths, avoids shared accounts and lets operators terminate access immediately after the task is complete.

Technical breakdown

Why OT access becomes a privileged identity problem

Once OT and IT share access paths, the question is no longer only whether the network is segmented. The deeper issue is that engineers, IT staff, and vendors all become privileged identities with very different task scopes but often similar rights. That creates standing access, broad entitlement sets, and weak visibility into what each account can do. In OT, those identities are especially sensitive because access often exists to keep production running, not because it was tightly engineered from the start. See the OT Remote Access Guide.

Practical implication: Map every OT-accessing identity to a specific task set and remove any standing privilege that is broader than operational need.

How remote vendor access changes the attack surface

Remote access for maintenance is useful, but it also creates a controllable path into production systems. The risk is not the existence of remote connectivity itself, but persistent credentials, excessive reach, and sessions that are neither scoped nor recorded. In an OT environment, that combination turns third-party support into a high-value entry point. The technical control problem is to make access ephemeral, limited to named assets, and auditable after the session ends.

Practical implication: Require per-session vendor access, narrow asset scope, and session logging for every remote support interaction.

Why segmentation matters more after convergence

Segmentation in OT is not a cosmetic network best practice. It is the mechanism that limits how far an intrusion can travel when corporate credentials, phishing, or a compromised remote tool reach the factory environment. A flat network turns one foothold into broad lateral movement. A separated OT zone with explicit firewall paths forces the attacker to meet additional control points before touching controllers or supervisory systems. That is especially important where patching is slow and devices cannot be reimaged easily. See the OT Security Platform Buyer's Guide.

Practical implication: Design OT network zones so that only approved traffic crosses between enterprise and plant systems.

Threat narrative

Attacker objective: The objective is to reach industrial systems or their supporting identities in a way that causes production disruption, data theft, or both.

1. Entry occurs when a corporate workstation, vendor channel, or exposed remote access tool provides a path from IT into OT-connected systems.
2. Escalation follows when broad or persistent privileges let an intruder move from one connected system to more sensitive operational assets.
3. Impact emerges as the attacker disrupts production, exfiltrates intellectual property, or uses OT adjacency to increase the business cost of the intrusion.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT/IT convergence turns access governance into an operational control problem: once production systems depend on enterprise identities, the issue is no longer only network exposure. The control plane becomes mixed, and that means privilege scope, access timing, and vendor accountability all matter inside the plant. The practical consequence is that IAM and PAM controls must be designed for uptime-sensitive environments, not copied from office IT.

Standing access is the wrong default for factories: the article's recurring pattern is that broad rights accumulate because people want work to keep moving. That is exactly how OT environments end up with overprivileged accounts, shared credentials, and unclear ownership. The governance lesson is that permanent privilege is a process failure, not just a technical convenience.

Remote vendor access needs lifecycle governance, not just connectivity: third-party access in OT is useful only when it is scoped, time-limited, and revocable at the end of the task. Without that lifecycle discipline, vendor credentials outlive the work they were issued for and expand the blast radius of any compromise. This is where OT remote access governance becomes a control objective, not a support function.

Segmentation is the last boundary that still matters once convergence starts: flat plant networks let one foothold reach too much too quickly. When patching is slow and downtime is expensive, separating OT zones and constraining traffic paths becomes the main limiter on lateral movement. Practitioners should treat network zoning as a prerequisite for resilience, not as an optional architecture preference.

Production availability changes the security economics: controls that cannot survive operations will be bypassed, delayed, or quietly abandoned. That means the real test for OT governance is whether a control reduces exposure without forcing unsafe workarounds. The programme that wins is the one operations can live with, because in manufacturing, impractical security is usually temporary security.

Read next: OT Remote Access Guide

What this signals

The convergence problem is not that factories are connecting to IT, but that they are importing IT trust assumptions into an environment that cannot tolerate broad, persistent access. Teams should expect the most effective programmes to move privilege decisions closer to task execution and away from static entitlement models.

Convergence governance: once remote support and corporate identity reach the plant floor, the control question shifts from whether users can connect to whether each connection is narrowly bounded, observable, and revocable. That is the standard that separates a usable OT programme from one that merely extends enterprise risk into production.

For practitioners

• Implement logging-first visibility for OT access Inventory privileged OT users, vendor connections, and remote tools in monitor-only mode before changing entitlements or workflows.
• Replace permanent admin rights with task-scoped elevation Move technicians and support staff to just-in-time elevation for specific maintenance activities, with automatic expiry when the task ends.
• Scope vendor access to named assets only Require time-limited access for third parties, limit sessions to the devices they need, and log every remote action for review.
• Separate plant and corporate networks by policy Place OT systems in their own zone and permit only explicitly approved traffic between enterprise and industrial environments.

Key takeaways

• OT/IT convergence increases exposure because it brings enterprise identity and remote access patterns into production environments that were never built for broad connectivity.
• The highest-risk conditions are standing privilege, uncontrolled vendor access, and flat network paths that let one foothold travel too far.
• A workable OT security programme reduces risk by scoping access, separating zones, and using controls that operations can sustain in practice.

Related NHI Mgmt Group resources: OT Remote Access Guide · OT Asset Visibility Guide · OT Security Platform Buyer's Guide · OT Incident Response Guide

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• IT/OT Convergence: The integration of enterprise information systems with industrial operations so data, users and workflows move across both environments. In manufacturing, convergence improves visibility and efficiency, but it also forces identity controls to work across systems that were historically governed very differently.
• Just-in-Time Elevation: A temporary access pattern that grants a user or system elevated permissions for a limited period. It reduces exposure compared with always-on privilege, but it does not necessarily remove the underlying role or account from the environment, so governance must still address the residual entitlement path.
• Remote Session Recording: Remote session recording is the capture of a live remote access session for later review. It records screen activity, keystrokes or commands, and sometimes audio or file transfer events, so administrators can audit privileged access, investigate incidents and verify what happened during a remote support or administration session.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.