Zero trust for critical infrastructure depends on identity-aware containment

At a glance

What this is: ColorTokens argues that critical infrastructure security fails when OT is treated as isolated, and that zero trust must be built around identity-aware containment and mission continuity.

Why it matters: For IAM and security teams, the key lesson is that OT resilience depends on controlling who and what can move inside the environment, not just on perimeter defences or patch cycles.

Context

Critical infrastructure security breaks down when connectivity is assumed away. OT networks frequently depend on legacy software, remote monitoring, vendor paths and shared infrastructure, which means the old isolation model does not match how these systems actually operate. In that environment, the question is not whether adversaries will find a route in, but whether access paths are controlled well enough to keep compromise from spreading.

This is where the identity angle becomes operational rather than theoretical. If users, systems and vendors can traverse OT environments without strong access boundaries, then zero trust has to focus on authorization, segmentation and containment. For resilience teams, that makes identity-aware policy enforcement part of mission protection, not just an IAM control issue.

Key questions

Q: What breaks when Zero Trust stops at authentication?

A: Zero Trust breaks when teams stop at authentication because proving identity does not automatically define what that identity may do. If authorization is still implicit inside applications, a compromised account can still move through systems with excessive privilege. The control gap is not login strength, but decision quality after login.

Q: Why does indirect connectivity create such high mission risk in critical infrastructure?

A: Indirect connectivity creates risk because it gives attackers workable paths into environments that teams believe are isolated. Once those paths exist, legacy OT systems, delayed patching and broad internal trust can let a single foothold affect operations. The consequence is not just intrusion but loss of control over systems that support public safety or essential services.

Q: How do security teams know whether containment is actually working?

A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded. A working containment model prevents re-escalation, blocks credential regeneration, and remains effective even when the target is polling for state changes. If any of those fail, containment is only partial.

Q: What should critical infrastructure teams prioritise: patching or segmentation?

A: When patch windows are constrained, segmentation must come first because it reduces exposure while vulnerable assets remain in service. Patching still matters, but it cannot be the only control in OT where downtime is expensive or unsafe. The right order is to contain the asset, then remediate it on the schedule operations can tolerate.

Technical breakdown

Why OT air gaps fail in practice

An air gap implies physical or logical separation, but OT environments often contain indirect pathways that defeat that assumption. Vendor access, remote monitoring, shared infrastructure and convenience-based connections create reachable edges even when systems are not directly internet-facing. Once one of those edges is exposed, legacy OT software and constrained patch windows make the environment hard to harden quickly. The practical issue is not only exposure, but hidden connectivity that operators do not fully inventory. That is why breach containment in OT depends on knowing where the reachable paths actually are, not where architecture diagrams say they should be.

Practical implication: map every indirect OT pathway and remove or isolate connections that exist only for convenience.

How microsegmentation changes the attack path

Microsegmentation breaks broad east-west movement into smaller, explicitly governed trust zones. In OT, that matters because an attacker who reaches one system should not automatically inherit visibility or reach across the rest of the operational estate. Segmentation is not just a network design choice. It becomes a resilience control that limits blast radius when patching is delayed or a vulnerable asset cannot be taken offline. This also changes how identity is enforced, because access policy must bind users and services to specific assets, not to an open internal environment.

Practical implication: segment OT into tightly scoped trust zones and align identity rules to each zone’s operational role.

Identity enforcement as containment, not just authentication

Strong identity enforcement in OT is about restricting what authenticated users and systems can actually do after login. Authentication alone does not stop lateral movement if authorization is broad, inherited or poorly scoped. Zero trust in OT therefore depends on identity-aware containment, where access is constrained by role, asset criticality and operational need. That model is especially important when maintenance cycles, vendor support and public safety requirements limit how quickly vulnerable assets can be patched or replaced.

Practical implication: enforce least-privilege access at the point of use so authenticated access cannot expand into mission-wide reach.

Threat narrative

Attacker objective: The attacker aims to turn a foothold in one connected OT segment into operational disruption that affects critical services and mission continuity.

1. Entry often occurs through indirect OT connectivity such as vendor access, shared infrastructure or remote monitoring tools rather than through a direct internet-facing path.
2. Once inside, an attacker can use weak segmentation and broad internal trust to move laterally across operational assets and reach higher-value systems.
3. The resulting impact is not just data exposure but operational disruption, degraded mission continuity and potential public safety consequences.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-aware containment is the real zero trust control for OT. OT resilience fails when organisations treat authentication as the finish line. In critical infrastructure, the issue is not merely who logs in, but whether that identity can move laterally, reach adjacent assets, or disrupt mission support systems. Practitioners should treat access boundaries as operational safeguards, not administrative conveniences.

The air-gap story has become a governance risk. Many environments still inherit an isolation narrative that does not match vendor access, shared services or remote operations. That mismatch creates blind spots in risk ownership, because teams may underinvest in segmentation and visibility until an incident proves the gap. Mission resilience improves when governance assumes connectivity is present and managed, not absent and hoped for.

Patch velocity is not a sufficient safety metric for OT. The article is right to frame three-week patch windows as inadequate in critical environments, but the deeper point is that patching cannot be the only compensating control. Where downtime constraints delay remediation, the control that matters most is blast-radius reduction through enforced containment. That is the governance shift organisations need to make now.

Zero trust in critical infrastructure should be measured by containment outcomes. If a compromise occurs, the question is whether it stays local or becomes operationally contagious. That makes segmentation quality, authorization scope and path visibility the meaningful success criteria. Practitioners should judge their OT programme by how much mission impact remains after an intrusion, not by how many assets are theoretically reachable.

Shared resilience will increasingly define infrastructure risk. The article correctly points out that mission failure can originate outside a single organisation’s fence line, including municipal and regional dependencies. That means critical infrastructure security cannot be managed as a siloed asset problem. Cross-boundary access governance and ecosystem visibility are now part of resilience planning, not optional coordination work.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Identity-aware containment should become the governing idea for OT zero trust programmes. The practical test is no longer whether a site is “protected” in theory, but whether an authenticated user, vendor or workload can cross from one operational zone into another without explicit justification and control.

Where critical infrastructure depends on vendor paths and remote monitoring, trust boundaries have to be defined at the point of access, not inferred from network location. That shifts the programme from perimeter thinking to mission-scoped authorization, which is the only model that meaningfully limits blast radius in legacy environments.

For practitioners

• Map indirect OT connectivity Inventory vendor access, shared infrastructure, remote monitoring tools and other indirect paths that create connectivity in supposedly isolated environments.
• Enforce microsegmentation around critical assets Separate OT into small trust zones so compromise in one area cannot automatically reach field operations, safety systems or other mission-critical assets.
• Bind access to operational need Scope users, systems and vendors to the minimum assets they must reach, and prevent broad internal trust from crossing operational boundaries.
• Build containment for delayed patch windows Assume some OT assets cannot be patched quickly and design isolation controls that keep vulnerable systems usable without exposing the rest of the environment.
• Measure resilience by blast-radius reduction Test whether a compromise can remain local rather than becoming a mission-wide event, and use those results to prioritise control investments.

Key takeaways

• Critical infrastructure remains vulnerable when OT security relies on the fiction of isolation rather than controlled connectivity and mission-scoped access.
• Identity-aware containment is the control that converts zero trust from a slogan into a resilience strategy for systems that cannot be patched on demand.
• For practitioners, the priority is to reduce lateral movement and blast radius so that compromise does not become mission failure.

Key terms

• Identity-Aware Containment: Response actions that stop an email threat from becoming an access or fraud event. This includes investigation, mailbox controls, credential checks, and approval review, all coordinated around identity impact rather than inbox hygiene alone.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Indirect Connectivity: Any access path into a system that is not obvious in the primary network design, such as vendor tooling, shared services, or remote monitoring. In OT, indirect connectivity is often the reason an environment that appears isolated still has real exposure to external or adjacent threats.
• Mission Continuity: The ability of an operational environment to keep delivering essential services during or after a security event. For critical infrastructure, mission continuity is the practical outcome that Zero Trust, segmentation, and identity enforcement are meant to protect when prevention is incomplete.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore how identity governance concepts help security teams reason about access, containment, and lifecycle control across complex programmes.