Zero trust for OT environments is now an operational need

At a glance

What this is: Illumio says modern OT environments have outgrown air-gapped and perimeter-based defenses as IT, OT, cloud, and IoT converge.

Why it matters: That matters because OT teams now need identity-aware segmentation and continuous validation to limit blast radius without disrupting fragile industrial systems.

By the numbers:

• 58% of organisations hit by a cyberattack in the last year reported having to halt operations.
• 40% of organisations losing a significant amount of revenue after an attack.
• 35% of organisations experiencing brand damage after an attack.

Context

Operational technology security breaks down when industrial networks are treated as if they still behave like isolated plants. Once IT, OT, cloud, IoT, and virtualized gateways share the same environment, the old perimeter model no longer contains trust, movement, or failure in a predictable way.

For identity and access teams, the governance issue is not just network segmentation. It is continuous control over users, devices, workloads, and service-to-service pathways across environments that were never designed for dynamic access decisions. In that sense, OT security now depends on the same policy discipline that modern identity programmes use in hybrid IT.

The article’s starting position is now typical for modern industrial environments, not exceptional.

Key questions

Q: What breaks when air-gapped assumptions no longer match OT reality?

A: Air-gapped assumptions fail when industrial environments connect to cloud services, gateways, and enterprise systems that share data and control paths. At that point, the plant network is no longer isolated enough for static perimeter security to be reliable. Teams need policy-enforced segmentation and continuous validation because the communication pattern, not the physical network boundary, now defines the real exposure.

Q: Why do legacy OT perimeters increase lateral movement risk?

A: Legacy OT perimeters assume that internal network location is a proxy for trust. Once attackers or misconfigurations cross that boundary, broad internal reach makes lateral movement easier across SCADA, MES, and adjacent systems. Least-privilege access and segmentation reduce that blast radius by ensuring devices and services only talk to the systems they actually need.

Q: How do teams know whether IT/OT segmentation is actually working?

A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations. A valid test is whether cross-boundary access is limited to approved identities and whether blocked paths remain blocked during a live containment drill.

Q: When should organisations prioritise Zero Trust for OT over perimeter upgrades?

A: Organisations should prioritise Zero Trust when OT access is still mediated by persistent tunnels, shared paths, or third-party connections. Perimeter upgrades do not fix broad trust once an attacker is inside. If the goal is to reduce blast radius without disrupting operations, explicit access policy and segmentation should come before another VPN refresh.

Technical breakdown

Why the Purdue model breaks in hybrid OT

The Purdue model assumes clean separation between layers, with limited pathways between control systems, supervisory systems, and enterprise IT. That assumption weakens once containerized gateways, SASE, cloud services, and virtualized OT create new communication paths that do not fit the original hierarchy. When the environment becomes hybrid, the architectural question shifts from physical isolation to policy-enforced segmentation and verified communication. In practice, legacy segmentation logic cannot keep up with dynamic dependencies between SCADA, MES, ERP, and remote access paths.

Practical implication: teams need to map real communication flows instead of relying on inherited Purdue zoning.

How zero trust changes OT access control

Zero Trust in OT means access is not granted because a device sits inside the plant network. Every user, device, and workload must be validated continuously, and access should be limited to the minimum required pathway for the task. That matters in OT because many systems are fragile, stateful, and hard to patch, so broad trust assumptions create more risk than they remove. The control model shifts from static network location to contextual policy, with access decisions informed by role, device state, and communication need.

Practical implication: enforce task-specific access and block implicit trust between OT assets and adjacent systems.

Why agentless segmentation matters for fragile industrial assets

Industrial environments often include PLCs, RTUs, and controllers that cannot tolerate agents, reboots, or invasive software. Agentless enforcement avoids introducing instability while still allowing teams to constrain lateral movement and isolate suspicious activity. That is especially important in OT because security controls must preserve availability while reducing blast radius. The practical pattern is visibility first, then policy enforcement that can cut or narrow communications without touching the device itself. This is the operational difference between securing OT and simply monitoring it.

Practical implication: prefer segmentation methods that protect legacy devices without installing software on them.

NHI Mgmt Group analysis

Zero trust has become an OT governance requirement, not a design preference. Once industrial operations depend on hybrid connectivity, air gaps and static perimeters stop functioning as real trust boundaries. The governance problem is no longer whether OT should be connected, but how access is constrained when it is. Practitioners should treat continuous validation and segmentation as baseline controls for modern industrial identity and access management.

The real operational deficit is policy latency, not just tool scarcity. Many OT environments now move faster than the security model that was built for them, which creates a gap between new connectivity patterns and enforceable control. That gap is what attackers exploit when lateral movement is possible across IT, OT, and cloud-adjacent systems. The discipline needed is a policy model that can adapt as communications change, not a one-time segmentation project.

Identity is now embedded in OT resilience. When users, devices, and workloads must be validated continuously, OT security starts to resemble hybrid IAM with a strong segmentation layer. That makes lifecycle governance, least privilege, and device-aware trust decisions relevant to industrial environments that once relied mainly on network isolation. Practitioners should align OT access policy with the same governance rigor used for high-risk enterprise identities.

Security transformation deficit: the mismatch between modern OT connectivity and the controls inherited from isolation-era plant designs. As convergence accelerates, teams that keep treating the perimeter as the control point will continue to absorb unnecessary operational risk. Practitioners should re-baseline OT architecture around verifiable trust paths, not inherited assumptions about network separation.

What this signals

OT teams should stop treating connectivity as a temporary exception. Once industrial operations rely on cloud-linked gateways and shared infrastructure, the control point moves from network location to verified access and segmented communication. That means security programmes need to align OT policy, identity decisions, and device context earlier in the modernization cycle.

Zero trust in OT is really a resilience programme. The practical test is whether critical systems can keep operating while suspicious connections are tightened or cut. If a control cannot preserve availability during enforcement, it is not yet suitable for industrial environments.

Identity-aware segmentation will become a default expectation for hybrid industrial estates. The organisations that move first will be the ones that can describe who or what is allowed to communicate, why that path exists, and how it is constrained when risk changes. Practitioners should prepare for more granular governance over users, workloads, and devices across OT and IT.

For practitioners

• Map real OT communication paths Document traffic between SCADA, DCS, MES, ERP, gateways, and remote access paths before changing control design. The goal is to segment based on observed dependencies rather than historical network diagrams.
• Replace implicit trust with task-scoped access Require validation for every user, device, and workload that touches OT-adjacent services, and limit access to the minimum pathway needed for the task.
• Use agentless controls for fragile assets Avoid endpoint agents on PLCs, RTUs, and controllers that could be destabilized by software changes. Choose enforcement models that isolate traffic without touching the device itself.
• Build policy response for suspicious OT activity Define how segmentation should tighten when anomalous device behavior, unusual protocol activity, or unexpected public IP communication is detected in industrial networks.

Key takeaways

• Modern OT environments are no longer protected by air gaps and static perimeters once IT, cloud, IoT, and industrial systems converge.
• The article grounds the risk in operational impact, citing 58% operational stoppages, 40% significant revenue loss, and 35% brand damage after attacks.
• Practitioners should shift to continuous validation, least privilege, and segmentation that can adapt without destabilizing fragile industrial assets.

Key terms

• Zero Trust for OT and IIoT: A security model for industrial and connected-device environments that assumes no network path is inherently trusted. It applies strong identity, least privilege, and continuous verification to operational traffic so teams can reduce exposure without depending on broad perimeter access or static network trust.
• Security Transformation Deficit: Security transformation deficit describes the gap that appears when modernisation outpaces the controls needed to protect it. In OT, that means new gateways, cloud links, and hybrid services arrive faster than segmentation, governance, and containment can be updated.
• Agentless Microsegmentation: Agentless microsegmentation enforces segmentation through network infrastructure or cloud-native APIs instead of software on the endpoint. This approach is useful when devices cannot support agents, and it reduces rollout friction, but the enforcement model depends on the network and may offer less process-level visibility than host-based controls.
• Purdue Model: The Purdue model is an industrial network segmentation framework that separates enterprise IT from operational control layers. It helps define where remote access may be brokered, which layers are most sensitive, and why direct connectivity into lower OT levels creates unacceptable risk.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and IAM practitioners apply identity discipline to hybrid environments where trust boundaries are no longer static.