Why NAC breaks down on industrial networks and OT devices

At a glance

What this is: Elisity argues that traditional NAC breaks down in industrial and OT networks because most plant-floor devices cannot support 802.1X, pushing teams toward weak fallback controls such as MAC Authentication Bypass.

Why it matters: This matters because OT access control failures do not just weaken authentication, they leave critical devices exposed to spoofing, lateral movement, and segmentation designs that operations teams cannot safely sustain.

Context

Network access control is often designed around managed IT endpoints, not the realities of industrial and OT environments. In plants, many devices cannot run a supplicant, cannot host an agent, and cannot tolerate redesigns that change addressing or communication paths. That creates a gap between what NAC promises on paper and what can actually be enforced on the plant floor.

For identity and access teams, the important distinction is that OT network access control is not just a lower-coverage version of IT NAC. It is a different operating problem, because access decisions have to fit device constraints, operational dependencies, and industrial communication patterns. In that setting, identity-based policy and segmentation become governance issues, not just network design choices.

Key questions

Q: What breaks when NAC is used on OT devices that cannot run 802.1X?

A: The control breaks when the environment depends on supplicants, certificates, or software agents that OT devices cannot support. Teams then fall back to MAC Authentication Bypass or broad exceptions, which means the access decision is based on weak identifiers rather than real authentication. In practice, that leaves the plant floor only partially governed.

Q: Why does OT network access control create more risk when it relies on VLANs?

A: Because VLAN enforcement couples security policy to network topology. In industrial environments, changing a VLAN can alter IP addressing, disrupt PLC and HMI communications, and force changes that operations teams will resist. The result is brittle segmentation, not resilient access governance.

Q: How can security teams tell whether an OT access control model is actually enforceable?

A: Check whether the policy can be applied to the devices that matter without agents, supplicants, re-IPing, or major maintenance windows. If enforcement only works on laptops and a small subset of managed endpoints, the model is not operationally complete for OT. Coverage has to match the real device population, not the ideal one.

Q: Should organisations use identity-based microsegmentation instead of traditional NAC in OT?

A: For most industrial environments, yes, if the goal is to control communications between unmanaged devices without redesigning the network. Identity-based microsegmentation is better suited to device populations that cannot authenticate like IT endpoints and to environments where east-west traffic is the real risk. Traditional NAC may still help at the edges, but it is not enough on its own.

Technical breakdown

Why 802.1X assumptions fail on OT devices

Traditional NAC depends on 802.1X, which assumes an endpoint can run a supplicant and participate in certificate-based authentication. That model fits laptops and managed workstations, but not PLCs, HMIs, RTUs, sensors, or many controllers that were built for process reliability, not enterprise authentication. When vendors fall back to MAC Authentication Bypass, the control degrades into device recognition rather than real authentication. That means the enforcement model may still look structured while relying on a spoofable identifier.

Practical implication: treat any OT access scheme that depends on MAB as an exception path, not an identity control you can trust at scale.

Why VLAN-based NAC creates operational risk in industrial networks

NAC is usually enforced through VLAN placement, which ties access control to network topology. In OT environments that is fragile because changing a VLAN can change an IP address, interrupt PLC-to-HMI communication, and force revalidation of production dependencies. The result is that security policy becomes inseparable from the network layout, and the layout becomes harder to change than the risk justifies. Over time, that drives VLAN sprawl and brittle ACL management.

Practical implication: avoid treating segmentation as a re-addressing project, and validate whether policy can be enforced without disrupting industrial communication flows.

Why identity-based microsegmentation maps better to industrial access control

Identity-based microsegmentation shifts the question from whether a device can authenticate through 802.1X to what the device is and what it should be allowed to do. Instead of granting broad network admission and then sorting devices into VLANs, policy is bound to the device identity and communication intent. That approach aligns better with industrial zones and conduits because it can preserve existing infrastructure while narrowing allowed east-west communications. It also reduces reliance on headless-device enrollment that many OT assets can never complete.

Practical implication: evaluate whether policy can follow the device identity rather than the port, because that is the control model OT environments can actually sustain.

Threat narrative

Attacker objective: The attacker’s objective is to gain trusted presence inside industrial network segments so they can move between OT assets with minimal resistance.

1. Entry occurs when an OT environment falls back to MAC address-based admission because the device cannot run 802.1X or an agent.
2. Escalation follows when a spoofed or unmanaged device is treated as trusted inside a production VLAN.
3. Lateral movement then becomes possible because VLAN-centric controls do little to restrict east-west traffic between industrial assets.
4. Impact is the ability to reach process-connected systems that should have been isolated by stronger identity-aware controls.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT NAC fails because its trust model assumes endpoints can prove themselves in ways most plant-floor devices never can. The article’s core problem is not just incomplete deployment, but a control architecture that depends on supplicants, agents, and address changes that many industrial assets cannot support. In practice, that means the network may appear managed while the most important devices still sit behind spoofable fallback logic. Practitioners should read this as a governance failure in control design, not a rollout problem to be solved by more patience.

MAC Authentication Bypass is not a security control for industrial access, it is a compatibility compromise that leaves authentication unresolved. Once MAB becomes the dominant path for OT devices, the environment has shifted from device authentication to device identification. That is a materially weaker assurance model because a MAC address is not a durable trust anchor and can be copied quickly. The post is right to frame this as implicit trust, because the real control assumption has already collapsed.

Identity-based microsegmentation is the more defensible operating model for OT because it governs communications rather than port admission alone. That does not mean every industrial environment needs a perfect zero-trust redesign overnight. It means the field needs to stop treating VLAN assignment as equivalent to access governance and start binding policy to device identity, zone membership, and permitted industrial protocols. That is the kind of control shift that aligns with NIST-CSF access authorization principles and with the realities of unmanaged NHI-style device identities in operational networks.

Industrial NAC has become a named example of control-plane mismatch. The concept is simple: a tool can be technically correct for IT and still be structurally wrong for OT. That mismatch is becoming more visible as industrial organisations expand connected device estates without changing their governance model. Practitioners should use that concept to test every access control decision against the actual device population, not against the assumptions of enterprise endpoint management.

For OT, access governance has to be measured by enforceability, not by policy elegance. If a control cannot be applied to the devices that matter without re-IPing, long maintenance windows, or broad compatibility exceptions, it is not yet a real control in that environment. The practical conclusion is to privilege device-aware enforcement models that can survive plant constraints and still reduce east-west exposure.

What this signals

OT access governance should be judged by what can be enforced on unmanaged devices, not by how complete the policy looks in the console. In industrial environments, the control gap is usually between policy and device reality, and that gap widens when teams depend on 802.1X assumptions that PLCs, HMIs, and controllers cannot meet. Practitioners should expect more value from identity-aware enforcement that follows the device than from a port-based admission model that only works on paper.

Plant-floor segmentation is becoming a resilience issue as much as an access issue. Once access control depends on re-addressing, VLAN redesign, or large exception sets, the operational cost of security starts to erode the ability to secure the environment at all. That means OT teams should evaluate whether their control model preserves industrial availability while still reducing lateral movement, because both outcomes matter to the programme.

For practitioners

• Inventory OT devices by control capability Separate assets that can run 802.1X or agents from PLCs, HMIs, sensors, and controllers that cannot, so you know where NAC can and cannot work.
• Treat MAB as a temporary exception path Document every segment that depends on MAC Authentication Bypass and define a replacement plan where those devices can be governed by stronger identity-aware controls.
• Validate segmentation against industrial protocols Test whether policy can preserve allowed communications such as PLC-to-HMI and historian flows without forcing re-IPing or VLAN redesigns.
• Prioritise east-west restrictions inside OT zones Focus on limiting device-to-device communication within plant segments, because north-south admission alone will not stop lateral movement after a device is admitted.
• Use passive discovery before enforcement changes Build the policy model from observed device identity, firmware, and communication patterns before changing access decisions on production networks.

Key takeaways

• Traditional NAC often fails in OT because its enforcement assumptions do not match the hardware, software, and change-management constraints of industrial devices.
• The result is not just partial coverage. It is a control model that can look complete while leaving the most important assets governed by weak fallback trust.
• Identity-based microsegmentation is a better fit when the goal is to control OT communications without depending on supplicants, agents, or VLAN redesigns.

Key terms

• 802.1X: 802.1X is a port-based network access control standard that authenticates a device before it is allowed onto a network. It works well when endpoints can run a supplicant and exchange credentials, but it becomes fragile in industrial environments where many devices cannot participate in that model.
• MAC Authentication Bypass: MAC Authentication Bypass is a fallback access method that identifies a device by its MAC address when normal authentication is unavailable. It provides convenience for unsupported equipment, but it is not strong authentication because MAC addresses can be spoofed and reused with little effort.
• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Supplicant: A supplicant is the client device or software that requests access to a network using EAP. It responds to authentication challenges and presents credentials or cryptographic material through the selected EAP method. In practice, it is the endpoint being evaluated before the network grants access.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity control to broader security and operations decisions.