xot visibility is now the control plane for operational resilience

At a glance

What this is: This is Dragos’s case for xOT monitoring as the control that turns industrial networks from blind spots into defensible environments, with visibility gaps shown to delay detection for months.

Why it matters: It matters because OT teams cannot manage what they cannot see, and identity, access, and network monitoring all fail when exposed systems, credentials, or lateral movement go undetected.

By the numbers:

• The adversary had been present in their environment for over 300 days before anyone knew.
• Over a single weekend, more than 30 municipal water utilities had their OT systems compromised.

Context

xOT monitoring is the practice of passively observing the extended operational technology environment so operators can detect abnormal traffic, access patterns, and process changes before they affect physical operations. The core governance gap is not whether security tools exist, but whether they can see legacy industrial systems, proprietary protocols, and remote activity without disrupting uptime.

Traditional IT security models break down in OT because availability, safety, and protocol context matter more than host-centric telemetry. Where identity intersects, the issue becomes even sharper: engineering workstations, service accounts, and remote access pathways can all become persistence and movement channels if they are not visible at the network layer.

Key questions

Q: What breaks when OT environments are monitored only with IT security tools?

A: IT tools often miss industrial protocol context, cannot safely instrument many legacy assets, and can introduce availability risk if deployed inline. The result is a false sense of coverage: operators collect logs and alerts, but they still cannot see unauthorized commands, process manipulation, or lateral movement in time to protect operations.

Q: Why does hidden OT access create so much operational risk?

A: Hidden access matters because industrial operations depend on knowing which systems are talking, what commands are being issued, and whether the control environment has been altered. If access is invisible, teams cannot tell whether an intrusion is limited, whether a control system is affected, or whether shutdown decisions are justified.

Q: What are the signs that OT monitoring is failing to provide real visibility?

A: Common signs include unexplained blind spots in protocol coverage, inability to interpret device-to-device traffic, no reliable baseline for normal operations, and response decisions that depend on guesswork after an incident. If a team cannot answer which systems were touched, monitoring is not mature enough.

Q: How should security teams decide between passive OT monitoring and inline controls?

A: In OT, passive monitoring is usually the safer choice because it reduces the chance of disrupting production while still giving defenders useful traffic context. Inline controls may be appropriate in limited cases, but only when the operational risk is understood and the control can fail safely without affecting physical processes.

Technical breakdown

Why passive network monitoring is the only workable OT control layer

OT environments often contain legacy HMIs, PLCs, and embedded devices that cannot safely run endpoint agents or tolerate active scanning. Passive network monitoring solves for that constraint by observing traffic without touching the asset, which preserves availability while still exposing command patterns, configuration changes, and suspicious scanning. In industrial settings, the network is often the only common telemetry source across mixed generations of equipment. That makes the monitoring plane itself a governance control, not just a detection tool.

Practical implication: use passive monitoring as the default visibility layer for OT assets that cannot support traditional endpoint controls.

Why protocol context matters for Modbus, DNP3, and EtherNet/IP

Industrial protocols carry operational intent, not just packets. A write command, logic update, or engineering session can look benign to generic network tools while being highly material to plant safety and process integrity. OT-aware monitoring interprets those protocols in context, so it can distinguish routine operations from unauthorized reprogramming, reconnaissance, or process manipulation. Without that context, security teams collect data but cannot assess whether a command changes the state of a physical process.

Practical implication: ensure monitoring tools understand the industrial protocols in use before relying on their alerts.

How baselining turns OT visibility into detection

OT environments are highly patterned. Devices talk to the same peers, in the same sequences, during the same operational windows, which makes baseline-driven detection unusually effective. Once normal traffic is established, deviations such as a workstation scanning a new subnet, PLC logic changes outside routine windows, or unexpected credential use on engineering assets become visible fast. The value of visibility is therefore not volume, but the ability to compare present behaviour against a stable operational rhythm.

Practical implication: build baselines per site and process line so deviations can be triaged against real operational norms.

Threat narrative

Attacker objective: The attacker objective is to maintain undetected access inside operational networks long enough to map, manipulate, or pressure physical operations without immediate response.

1. Entry occurred when exposed PLCs or externally reachable OT systems were reachable with default or weak credentials, creating a direct path into the environment.
2. Credential or access abuse followed when adversaries used legitimate-looking access or scanning activity to move through OT-connected systems and identify targets.
3. Impact emerged when utilities and operators lacked enough visibility to know whether control systems had been touched, forcing conservative operational decisions and delayed containment.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Extended OT visibility is now a governance requirement, not a technical enhancement. In xOT environments the question is no longer whether a SOC can ingest more telemetry, but whether operators can prove they see the systems that influence physical operations. That shifts monitoring from an optional detector to a foundational control for resilience, safety, and decision-making. Practitioners should treat visibility as part of the control architecture, not a bolt-on sensor layer.

Visibility debt: the hidden exposure created when industrial networks are monitored only after an incident. This article shows how organisations can run for hundreds of days without knowing they are compromised because the right traffic was never observed. That failure mode is more important than any single alert because it means detection, triage, and impact assessment are all delayed at the same time. The practitioner lesson is to reduce unseen exposure before response assumptions collapse.

The identity layer in OT is often the attacker’s easiest persistence path. Engineering workstations, remote access mechanisms, and operational service accounts can all become durable access channels when they are invisible at the network layer. In mixed IT and OT environments, identity governance must extend to how access is used on the wire, not just how it is issued in a directory. Teams should connect OT monitoring with identity and access oversight so hidden privilege does not become hidden movement.

Industrial monitoring must be passive, protocol-aware, and baseline-led. The article makes clear that inline controls and generic IT tooling can create more operational risk than they remove. The practical field standard is therefore traffic-first visibility, protocol interpretation, and site-specific baselines that reflect how each process normally behaves. Practitioners should measure their monitoring programme by whether it changes response confidence, not by how much data it collects.

Regulators and insurers are converging on operational proof, not policy statements. As critical infrastructure scrutiny rises, organisations will increasingly need to demonstrate that they can see and validate what is happening inside xOT environments. That pushes OT visibility into the same category as evidence-based governance in IAM and NHI programmes: if the control cannot be observed, it cannot be trusted. Teams should prepare to show technical verification, not just documented intent.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Ultimate Guide to NHIs — Key Research and Survey Results

What this signals

Visibility debt: industrial teams that do not observe xOT traffic are not just missing alerts, they are accumulating unknown exposure that will shape incident severity and recovery decisions. The programme risk is that controls appear present on paper while the environment remains operationally opaque.

OT visibility now intersects with identity governance because engineering workstations, remote access pathways, and service accounts can all become persistence routes when they are not monitored in context. That means OT security teams and IAM teams need a shared view of who and what can influence control systems, not separate reporting lines.

Visibility programmes should be judged by response confidence, not sensor count. If an operator cannot tell whether a PLC, HMI, or remote session was involved after an alert, the monitoring design has not reached the level of evidence modern critical infrastructure governance now expects.

For practitioners

• Implement passive OT network monitoring Deploy passive sensors that observe industrial traffic without touching assets, especially where endpoint agents or active scanning would threaten uptime.
• Baseline normal process communication Build per-site baselines for device peers, command sequences, and engineering access windows so deviations are obvious during threat hunting.
• Map exposed OT assets and remote pathways Inventory externally reachable PLCs, HMIs, and remote access routes, then prioritize the paths that could let an attacker reach operational control systems.
• Connect OT monitoring to identity oversight Correlate engineering workstation use, service account activity, and remote sessions so hidden privilege does not become hidden lateral movement.
• Prepare evidence for regulators and insurers Retain monitoring outputs that demonstrate asset visibility, protocol interpretation, and response confidence across critical operational zones.

Key takeaways

• The central problem is not a lack of security products, but a lack of operational visibility into the systems that influence physical outcomes.
• The article’s evidence shows that prolonged compromise and sector-wide exposure can remain hidden until outside investigators or incidents force attention.
• Passive, protocol-aware monitoring is the control that turns xOT traffic into actionable evidence for detection, containment, and governance.

Key terms

• Extended Operational Technology: Extended operational technology is the broader set of systems that support industrial and critical infrastructure operations beyond classic plant-floor control networks. It includes connected environments where availability, safety, and long asset lifecycles shape security decisions more than standard enterprise assumptions.
• Passive Monitoring: A monitoring approach that observes traffic, events, or system behavior without installing intrusive agents or performing active scans. It is common in industrial environments because many legacy assets cannot tolerate modern IT security tooling without reliability or compatibility problems.
• Operational Baseline: A starting measurement used to compare performance before and after a change. In resilience and identity programmes, baselines are essential because they let teams prove whether a platform, control, or process change actually improved outcomes.
• Visibility Debt: Visibility debt is the accumulated gap between what an organisation thinks it can see and what it can actually govern. In identity and data security, it grows when cloud resources, non-human identities, and data locations outpace discovery, making remediation slower and less accurate.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to the wider security programme.