TL;DR: Operational technology environments are shifting from isolated systems to connected IT, IoT, and cloud architectures, which expands attack surface and raises the need for continuous verification, just-in-time privilege, and monitored remote access, according to SSH Communications Security. The governance problem is no longer network location, but whether every machine, vendor, and session can be trusted only for the exact task and duration required.
At a glance
What this is: This is an analysis of why OT zero trust now depends on identity governance, with continuous verification, just-in-time privilege and monitored remote access replacing location-based trust.
Why it matters: For IAM, PAM and NHI teams, OT access can no longer be treated as a network segmentation issue alone, because third-party sessions, machine access and privileged maintenance all need lifecycle control.
Context
OT security now has an identity governance problem because industrial environments are no longer isolated from IT, cloud and IoT connectivity. In that model, the question is not just whether a network is segmented, but whether each identity, device and session is authorised for the exact task it needs to perform.
Legacy OT systems were often designed for fixed sites and long-lived access assumptions, which do not hold once remote maintenance, vendor support and cloud-connected operations become normal. Zero trust changes the control model from location-based trust to continuous verification, which makes privilege scope and session duration central governance variables.
The article’s core point is that OT security, IAM and PAM are now inseparable. Once privileged access is delivered through remote channels and third parties, the governance problem becomes how access is issued, monitored and retired across the full operational lifecycle.
Key questions
Q: How should security teams apply zero trust to OT without disrupting operations?
A: Start with identity inventory, least privilege, and segmentation that respects safety and uptime. Then move to stronger verification and policy enforcement only after you can observe normal machine behaviour, log decisions, and define safe rollback paths. In OT, the control objective is to reduce implicit trust without creating operational instability.
Q: Why do standing privileged accounts create compliance and security risk?
A: Standing privileged accounts keep high-risk access available even when no task requires it. That widens the window for misuse, weakens audit evidence, and makes offboarding harder because access survives beyond the business need. Regulated programmes should treat persistent privilege as a control failure unless there is a documented and approved exception.
Q: What breaks when OT remote access still relies on reusable passwords or SSH keys?
A: Reusable secrets create a durable entry path that survives the job they were meant to secure. Once one secret is exposed, the same credential can be replayed across sessions, which weakens accountability and makes revocation slower than the exposure window.
Q: How do IAM and PAM teams govern third-party access in OT?
A: They should use one control model for internal administrators and external vendors, with MFA, encrypted tunnels, least privilege and session recording applied consistently. The key is to tie access to a specific task and retire it as soon as that task is complete.
Technical breakdown
Why standing access is a weak fit for OT environments
Operational technology environments often depend on privileged accounts that were originally created for stable, local administration. Once those accounts are reused for remote maintenance, third-party support or cross-domain operations, the original trust model breaks down. Standing access gives an attacker or over-permissioned operator a long-lived path into systems that were never designed for constant exposure. Zero trust replaces that with task-scoped trust decisions made at the moment access is needed, not when the account is provisioned.
Practical implication: treat standing OT administrator access as a governance defect, not just an access convenience.
How just-in-time privilege changes OT control design
Just-in-time privileged access issues permissions only for the duration of a specific task and then removes them automatically. In OT, that matters because maintenance activity, vendor troubleshooting and emergency changes often happen under tightly controlled windows. JIT reduces the value of stolen credentials and limits the blast radius of a misused session. It also creates a cleaner audit trail, because the access event is tied to an approved purpose rather than a persistent account state.
Practical implication: align OT elevation workflows to maintenance windows, break-glass scenarios and post-session revocation.
Why ephemeral authentication matters more than reusable keys
Static passwords and reusable SSH keys are poor fits for distributed industrial estates because they persist far beyond the session they were meant to secure. Ephemeral certificates and passwordless authentication shorten that exposure by issuing credentials in real time and letting them expire automatically after use. This reduces credential theft risk and makes remote access easier to govern across heterogeneous OT environments. The architectural shift is from storing trust in a reusable secret to minting trust for a single session.
Practical implication: replace reusable OT secrets with short-lived authentication tied to session completion and policy checks.
Threat narrative
Attacker objective: The attacker aims to reach privileged OT functions that can be used to disrupt operations, pivot through connected systems or support ransomware and supply chain activity.
- Entry begins when remote OT connectivity, vendor support or cloud integration creates a reachable path into systems that were previously isolated.
- Credential abuse follows when standing privileges, reusable passwords or long-lived keys are used to authenticate into privileged maintenance workflows.
- Escalation occurs when the same access can be reused across sessions, sites or devices without task-specific limitation or continuous verification.
- Impact is the ability to disrupt industrial operations, alter control processes or move from one connected environment into broader infrastructure.
Breaches seen in the wild
- Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
OT zero trust has become an identity governance problem, not just a network design problem. Once industrial environments connect to IT, IoT and cloud services, location can no longer be the main trust boundary. The real question is whether every identity, device and session is governed for the exact task it must perform, then withdrawn immediately after use. That shifts OT security from static segmentation to continuous lifecycle control.
Standing privilege is the central governance failure in connected OT. OT programmes that still rely on persistent administrator access are carrying trust forward far beyond the maintenance task that justified it. That creates an identity blast radius in which vendor support, remote operations and break-glass access all inherit the same exposure pattern. Practitioners should treat every durable OT credential as a governance exception that must be justified, not assumed.
Ephemeral credential trust debt is now a defining OT risk. Passwords, SSH keys and other reusable secrets were acceptable when access was local and infrequent, but they become structural liabilities once operations are distributed. The problem is not only theft, but reuse across sessions and sites without re-authorisation. The implication is that OT identity design must move toward issuance-time trust, not reliance on secrets that outlive the task.
Zero trust only works in OT when PAM, IAM and third-party access are governed as one lifecycle. Remote maintenance, supplier support and operational administration are the same control plane from a risk perspective, even if different teams own them. This is where many programmes fail: they segment the network but leave identity, privilege and session oversight fragmented. Practitioners need a single governance model for who can enter, what they can do and when that access ends.
IEC 62443 and NIS2 pressures are pushing OT teams toward auditable identity controls. Compliance is not the driver of security, but it does force clearer evidence of session monitoring, access expiration and privileged access governance. That makes identity telemetry part of operational resilience rather than an optional logging layer. Teams should expect audits to ask how trust is granted, not just where the network is segmented.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Read next: Zero Trust Identity Guide
What this signals
Identity governance is now the operating model for OT zero trust. Once industrial access crosses network, vendor and site boundaries, the programme has to decide who can act, for how long and under what conditions. That makes privileged access governance, not segmentation alone, the practical control surface for OT teams.
OT programmes should expect access reviews to become more evidence-driven. Session recordings, expiry logs and approval trails matter because they prove that trust was granted for a task, not for an environment. Without that evidence, zero trust in OT remains a design intent rather than an auditable control.
The pressure is moving from protecting the perimeter to proving the legitimacy of every maintenance session. That is where identity, PAM and remote access governance begin to converge for critical infrastructure teams.
For practitioners
- Eliminate standing OT administrator access Replace persistent privileged accounts with task-scoped elevation that is approved per session and revoked automatically after the maintenance action ends.
- Issue ephemeral credentials for remote maintenance Move password and SSH key based access to short-lived certificates or equivalent ephemeral authentication so remote support sessions do not reuse the same secret across jobs.
- Unify vendor access with PAM governance Treat third-party OT support as part of the same privileged access policy set as internal administration, including MFA, encrypted tunnels, session monitoring and approval records.
- Tie OT access reviews to live session evidence Use session recording and monitoring data to validate who accessed which site, what task was performed and whether access expired when the job ended.
Key takeaways
- OT zero trust fails when teams rely on network location instead of governing each identity and session for a specific task.
- Reusable credentials and standing privilege widen the attack path in connected industrial environments, especially for vendors and remote maintenance.
- Identity-led controls such as JIT access, ephemeral authentication and session monitoring are the practical mechanisms that make OT zero trust auditable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | OT privileged accounts and vendor access in this article are over-scoped and persist too long. |
| NHI-07 — Long-Lived Secrets | The article warns against static passwords and SSH keys in connected OT environments. | |
| Recommendation — Reduce OT standing access by narrowing privileged scope and forcing task-bound elevation. Replace long-lived OT credentials with short-lived authentication tied to session completion. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post centres on continuous verification and granular access control for OT sessions. |
| Recommendation — Apply entitlement controls to enforce least privilege and session-specific authorisation in OT. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential expiration and replacement are central to the article's authentication model. |
| Recommendation — Manage OT authenticators so passwords and keys are issued, expired and revoked on schedule. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article describes credential compromise and movement across connected OT environments. |
| Recommendation — Map OT remote-access abuse to credential access and lateral movement tactics in detections. | ||
Key terms
- Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
- Just-in-Time Privileged Access Management: A control model that grants elevated access only for a defined task or session, then removes it automatically. In cloud environments, it reduces the time privileged credentials remain usable and makes misuse harder to sustain. The value depends on strong approval, logging, and revocation processes.
- Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org