xOT visibility closed Juneau’s OT blind spots in a lean utility

At a glance

What this is: This is a Dragos case study showing how OT visibility, network mapping, and segmentation helped a small water utility reduce blind spots and respond more safely to a near-miss.

Why it matters: It matters to practitioners because lean OT and identity teams often inherit undocumented access paths, default credentials, and fragile operational knowledge that can turn a single access issue into a service outage.

Context

Lean operational teams often inherit environments that grew over decades without a system-wide security design, which leaves undocumented paths, weak credential practices, and fragile response assumptions in place. In OT, that creates a governance gap between what operators think the environment looks like and what is actually connected or reachable.

That gap matters because visibility is not just an inventory exercise. It is what lets a team map communication flows, isolate compartments, and decide where a failure can be contained before an incident forces a field response. The article’s Juneau example is unusual in size, but the underlying operating problem is common across critical infrastructure.

Key questions

Q: What breaks when OT environments rely on undocumented assets and operator memory?

A: Containment breaks first. Teams cannot confidently tell which nodes are exposed, which communication paths are normal, or where a compromise can spread. That slows triage, increases the chance of unnecessary field dispatch, and can turn a manageable event into a service interruption. Visibility and documentation are what make containment decisions credible.

Q: What breaks when default passwords remain on OT systems?

A: Default passwords turn critical infrastructure devices into easy entry points, especially when those systems are internet-exposed or poorly monitored. Once an attacker authenticates with unchanged credentials, they may not need exploitation at all. The result is often direct movement toward higher-value operational assets, with containment becoming much harder after the first login.

Q: How should critical infrastructure teams prioritise visibility over emergency response tools?

A: Prioritise visibility first when the team cannot confidently answer what exists, how it communicates, or what can be isolated. Emergency tools help after you understand the environment, but they do not replace a trustworthy asset map or containment model. In lean OT environments, visibility determines whether response actions are targeted or improvised.

Q: What should utilities do when a remote access supply-chain incident threatens operations?

A: Treat the event as a containment and validation problem, not just a vendor issue. Confirm which paths could be used to reach operational assets, restrict the exposed access routes, and verify whether credential or configuration weaknesses could compound the incident. The goal is to reduce blast radius before service delivery is affected.

Technical breakdown

Why OT asset visibility changes the security model

OT visibility is the ability to see what assets exist, how they communicate, and where undocumented dependencies create risk. In the Juneau case, the utility had roughly 50 remote nodes and no complete map of how they interacted, so the team could not reliably reason about exposure or containment. Once those relationships were visible, they could redesign compartments and remove hidden failure paths. That shifts security from reactive troubleshooting to evidence-based control of the environment. See the OT Asset Visibility Guide.

Practical implication: build a defensible asset-and-flow inventory before you try to harden or segment the environment.

Why default passwords and weak logon controls remain an OT access risk

Default passwords across field logon systems are a classic access-control failure because they collapse authentication into shared, predictable secrets. In OT, those credentials are especially risky when they are spread across operational nodes and managed by a small team that may not have central identity oversight. The Juneau article shows that identity hygiene in OT is not abstract policy work; it is part of keeping remote operators, field systems, and response actions from becoming trivially accessible.

Practical implication: inventory and eliminate default or shared credentials before you depend on the system for segmentation or incident response.

How segmentation changes incident containment in critical infrastructure

Segmentation divides an OT environment into smaller trust zones so a compromise or fault in one area does not automatically spread everywhere. Juneau’s team used the visibility map to isolate network compartments and gain the option to quarantine specific nodes if an attack occurs. That matters because many OT environments have grown through exceptions and undocumented paths, which means the true blast radius is often larger than operators assume. Segmentation only works when the network map reflects reality. See the OT Security Guide.

Practical implication: align zoning and conduit decisions to the actual communication graph, not the historical architecture diagram.

Threat narrative

Attacker objective: The most likely objective was to reach or disrupt operational control in a way that could force service interruption and expose a critical water delivery process to shutdown.

1. Entry occurred through a supply-chain incident involving a widely used remote access tool, which brought the utility within hours of shutting off water to roughly half the city.
2. Credential weakness was also present, because a distribution operator had been using default passwords across every field in the xOT logon system.
3. Escalation risk came from undocumented paths and incomplete visibility, which meant the team could not quickly confirm how far access or disruption might spread.
4. Impact would have been service interruption and loss of control over potable water operations, which is why visibility and segmentation became urgent.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OT visibility is now a governance control, not a monitoring luxury. When a utility cannot accurately describe its assets, connections, and trust boundaries, it cannot claim confident operational control. The Juneau example shows that visibility directly affects containment, recovery, and even budget justification because it converts guesswork into defensible decisions. Practitioners should treat asset and flow visibility as a prerequisite for safe OT governance.

Default credentials in OT are an access-control failure with physical consequences. The article’s note about default passwords across xOT logon systems shows how identity weakness in operational environments can become a community safety issue. That is exactly where MFA mistakes and credential hygiene intersect with OT governance: the access layer has to be credible before the environment can be safely segmented or monitored. Practitioners should remove shared and default secrets as a resilience measure, not just a compliance task.

Lean staffing turns institutional knowledge into a single point of failure. Juneau’s story is not just about technology, but about what happens when only two or three people understand the system well enough to operate it. That creates operational fragility because control decisions depend on memory rather than documented state. The practitioner conclusion is clear: governance must preserve system knowledge in ways that survive turnover and emergency response.

OT blind-spot debt: this article illustrates the accumulation of undocumented nodes, hidden dependencies, and weak identity controls that eventually outrun manual operations. The concept matters because the debt does not appear all at once, but it determines whether a small incident stays local or becomes a service outage. Practitioners should treat visible architecture, credential hygiene, and documented containment paths as part of the same control plane.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: OT Asset Visibility Guide

What this signals

OT blind-spot debt: when asset discovery, identity hygiene, and containment design all lag the real environment, the organisation accumulates a governance debt that only becomes visible during an incident. The practical signal is not just missing inventory, but the inability to answer which nodes can be quarantined without stopping service.

Lean OT teams need operating models that survive turnover, because the Juneau example shows how quickly system knowledge can become concentrated in too few people. That pushes practitioners toward documented flows, explicit trust boundaries, and response processes that do not depend on a single veteran operator being available.

For practitioners

• Build a complete OT asset-and-flow inventory Document every remote node, communication path, and operational dependency before making further segmentation changes or control decisions.
• Eliminate default and shared credentials in field systems Find every login system that still relies on common passwords or local operator knowledge, then replace it with managed authentication and revocation processes.
• Map containment zones to the real network graph Use the actual communication pattern to define which nodes can be isolated or quarantined during an incident, rather than relying on legacy diagrams.
• Preserve operator knowledge outside individual heads Record dependencies, recovery steps, and exception handling so a small team can maintain safe operations when experienced staff are unavailable.
• Use visibility to shorten incident triage Create a process that answers what is affected, what can be isolated, and who needs to act before anyone leaves the control room or dispatches field staff.

Key takeaways

• The article shows that OT blind spots are not a theoretical problem when undocumented paths, weak credentials, and lean staffing meet critical services.
• Juneau’s reported move from roughly 85% uptime to approximately 99.99% shows how visibility can change operational resilience, not just detection quality.
• The control gap that mattered most was the absence of a reliable asset-and-flow map, because without it segmentation, containment, and incident response all remain guesswork.

Related NHI Mgmt Group resources: OT Asset Visibility Guide · OT Security Guide · Top 10 MFA Mistakes · Top 10 SOC Challenges

Key terms

• Operational Technology Asset Visibility: Operational Technology Asset Visibility is the ability to identify and track industrial assets, their roles, and their connections across an OT environment. It is the foundation for risk management because organisations need accurate asset context before they can assess vulnerabilities, prioritise protections, or demonstrate compliance with critical infrastructure obligations.
• Default Credential: A default credential is a factory-set or preset username, password, or secret that remains unchanged after deployment. In NHI environments, it is a high-risk failure because it creates predictable access to privileged systems and often survives into production unless ownership and hardening are explicitly enforced.
• Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners connect access control, lifecycle governance, and operational resilience.