Why identity-based Zero Trust is replacing VPNs in OT access

At a glance

What this is: This article argues that OT remote access should move from VPN-based network trust to identity-based Zero Trust because broad network visibility amplifies lateral movement risk.

Why it matters: It matters because OT teams must secure remote engineering, vendor, and operator access without breaking reliability, and access decisions now shape how far a compromise can spread.

Context

Operational technology environments were designed for reliability, safety, and deterministic control, not broad external connectivity. As remote access becomes routine for engineering, vendor maintenance, and operations support, the identity and access model becomes part of OT security architecture rather than a separate IT concern.

The core governance gap is that many industrial networks still assume network location can stand in for trust. That assumption weakens when flat or lightly segmented OT environments are paired with VPN access, because a single authenticated session can expose far more of the plant than the task requires.

Key questions

Q: What breaks when VPN-based remote access is the default for OT?

A: VPN-based access often grants broader network reach than the task requires, which expands the attack surface and makes lateral movement easier. It also tends to preserve standing access instead of limiting sessions to the maintenance window or emergency use case. The breakage is not just technical, it is governance failure through overexposure.

Q: Why does identity-based Zero Trust reduce OT lateral movement risk?

A: It reduces risk because access is granted to specific resources instead of the whole network. In OT, that matters when vendors, engineers, and operators need remote access but should not see every controller, port, or service. Narrow authorization limits what a stolen credential or over-permissioned account can touch.

Q: How do security teams know VPN access is too broad for OT?

A: The warning signs are broad network visibility after login, shared access paths for multiple roles, and remote sessions that can browse systems unrelated to the current task. If a single credential can reach more than one operational zone, the access model is wider than the work requires.

Q: Should organisations keep VPNs or move to identity-based OT access?

A: Organisations should move remote OT access toward identity-based controls when the current VPN model creates broad reach across flat or lightly segmented networks. VPNs may still encrypt traffic, but they do not solve the governance problem of who can reach which industrial resource. The decision is about containment, not connectivity alone.

Technical breakdown

Why VPN trust expands OT attack surface

Traditional VPNs were designed to authenticate a user and then place that user inside the network boundary. In OT environments, that model collides with flat addressing, legacy protocols, and fragile segmentation, so authenticated access often becomes broad reach rather than narrow task access. If credentials are stolen or an account is over-permissioned, the remote session can expose multiple industrial systems that were never meant to be browsed from a distance. The security problem is not encryption alone. It is the implicit trust that follows authentication and the lack of fine-grained resource restriction after the tunnel opens.

Practical implication: replace network-wide remote access with per-resource authorization boundaries.

How identity-based zero trust changes access in OT

Zero Trust Network Access shifts the decision point from the network to identity, device, and policy. Instead of making a remote user part of the environment, it authorizes only specific resources, such as a controller, port, or service, and hides everything else. That matters in OT because operational simplicity and uptime often prevent deeper redesigns. Identity-centric access preserves the existing plant topology while changing who can see what, which is the right level for controlling remote access in industrial settings. The model is especially relevant where third-party vendors and distributed engineering teams need limited, auditable access.

Practical implication: scope remote access to explicit OT resources rather than entire subnets.

Why lateral movement containment matters in industrial networks

Lateral movement becomes easier when industrial environments combine shared credentials, over-permissioned access, and weak segmentation. In that setting, a compromised remote session is not just an entry point, it is a path to additional systems, controllers, and production-impacting assets. Identity-defined micro-perimeters reduce that path by binding access to user role, context, and specific services. The goal is not to eliminate all connectivity. It is to make each connection narrow enough that compromise does not automatically become plant-wide reach. That is a materially different control model from VPN-era trust.

Practical implication: design OT access so compromise of one session does not create environment-wide reach.

Threat narrative

Attacker objective: The attacker wants to turn one remote access session into broad lateral reach across industrial systems and critical assets.

1. Entry occurs when a remote user authenticates through VPN and gains broad network visibility into OT systems that were never meant to be generally reachable.
2. Escalation follows when stolen credentials, over-permissioned access, or weak segmentation let the attacker move laterally from the initial remote foothold.
3. Impact is the ability to reach more industrial assets than the task requires, increasing the chance of operational disruption or production-system compromise.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

VPN trust is now a governance failure, not just an access design choice. OT environments were never built for broad network exposure after authentication, yet that is exactly what VPN-centric remote access still does. When the environment is flat or only lightly segmented, the trust boundary moves from the task to the tunnel. Practitioners should treat the access model as a control plane decision, not a connectivity convenience.

Identity-defined access is the right unit of control for OT remote work. The operational question is no longer whether remote access exists, but whether each session is tied to one role, one resource, and one approved path. That approach preserves reliability while shrinking the blast radius of stolen credentials and over-permissioned vendor access. The practitioner takeaway is that authorization must be narrower than the network.

Micro-perimeters matter because industrial compromise is often about reach, not initial entry. Once a remote user can see too much of the plant, lateral movement becomes a structural risk rather than an exceptional event. Cloaked infrastructure and resource-level policy reduce reconnaissance and remove the assumption that authenticated users deserve visibility into the environment. The implication is that OT security should optimise for containment, not just perimeter entry control.

Remote access governance in OT now has to account for third parties and legacy assets together. Vendors, contractors, and operators often need different scopes, but legacy devices and unmanaged systems do not support modern enforcement in the same way. That makes identity-based policy and secure bridging the practical governance layer across old and new infrastructure. Practitioners should align access, segmentation, and off-network support around the least-visible path possible.

What this signals

Identity-based OT access is becoming a containment control. The programme question is no longer whether remote users can connect, but whether they can see only the minimum industrial resources required for the task. That shift changes access governance from network admission to blast-radius reduction.

Remote access design now sits inside OT resilience planning. If VPNs expose more of the plant than they protect, then remote connectivity becomes a resilience issue, not just an IAM issue. Practitioners should align access scope, segmentation, and vendor pathways so one compromise does not become a plant-wide problem.

For practitioners

• Map remote OT access to explicit resources Replace subnet-wide VPN access with resource-scoped authorization so each role reaches only the systems, ports, and services needed for the task.
• Separate third-party vendor access from operator access Define different policy paths for vendors, contractors, and internal engineers so vendor maintenance does not inherit broad visibility into production networks.
• Create identity-defined micro-perimeters around critical systems Bind access decisions to user identity, device posture, and context, then hide non-authorized OT assets from remote sessions.
• Keep legacy assets off the broad network path Use secure bridge patterns for unmanaged controllers and older devices that cannot support modern agents, rather than exposing them through general remote access.
• Review segmentation assumptions in flat OT environments Check whether current routing and network segmentation actually prevents lateral movement after authentication, especially where VPN access was added as a layer rather than a redesign.

Key takeaways

• VPN-based remote access still embeds network trust into OT environments, which can widen exposure after authentication.
• The article argues that identity-based Zero Trust narrows access without forcing a plant redesign, making it easier to limit lateral movement.
• For practitioners, the practical test is simple: if a remote user can see more than the current task requires, the access model is too broad.

Key terms

• Identity-first Zero Trust: An access model that treats identity as the primary enforcement point instead of network location. Every request is evaluated using context, entitlements, and risk signals so trust is continuously earned rather than assumed.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Identity-defined Micro-Perimeter: A policy boundary around a specific resource or service that is enforced through identity and authorization rather than through a flat network segment. For OT, it limits which controllers, ports, or services a remote session can see or reach.
• Direct-Routed Access: An access architecture where traffic is enforced inside the customer boundary instead of being backhauled through a shared cloud broker. The value is tighter operational control, lower external exposure, and a clearer trust boundary for high-sensitivity or regulated environments.

Deepen your knowledge

NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.