Zero Trust for OT is replacing the air gap assumption

At a glance

What this is: CISA’s OT Zero Trust guidance argues that air-gapped assumptions no longer match operational reality because connectivity, remote access and IT/OT integration create persistent paths into OT.

Why it matters: OT, IAM and PAM teams need to govern access as a dynamic control problem, because identity-aware segmentation and continuous validation are now central to limiting blast radius in converged environments.

Context

The core governance problem is that OT environments were designed for isolation, but modern operations have made that assumption difficult to sustain. Remote vendor support, cloud-connected interfaces and enterprise integrations create access paths that must be controlled rather than denied in theory. For IAM and OT security teams, the question is no longer whether connectivity exists, but how to segment it, authenticate it and monitor it without disrupting safety or availability.

In this context, Zero Trust for OT is less about importing a generic enterprise model and more about enforcing identity-aware access around systems that cannot tolerate frequent change. That makes segmentation, strong access control and continuous validation the practical controls that replace the old air gap story. The identity bridge is real here because every route into OT now depends on governed human, service or vendor access.

Key questions

Q: What fails when organisations treat OT as air-gapped in practice?

A: The failure mode is assuming that physical or logical separation still exists after remote support, cloud integration and vendor connectivity are added. Once those paths are present, the real control problem is access governance. Organisations lose visibility into who can reach which assets, and they often discover that old network boundaries no longer match operational reality.

Q: Why do shared IT and OT access paths increase operational risk?

A: Shared access paths increase risk because they connect business systems to process and safety environments through the same trust relationship. If an attacker takes over a privileged account or remote access channel, the breach can cross from corporate IT into control systems. In OT, that can become a production or safety incident, not just an IT problem.

Q: How can security teams tell whether Zero Trust is applied consistently?

A: A consistent Zero Trust programme applies the same verification, least-privilege, and review logic to employees, contractors, and vendors. If third-party accounts still rely on separate VPN exceptions, shared credentials, or informal approval paths, the programme is incomplete. Consistency shows up in identical policy treatment, not just in similar technology labels.

Q: What should critical infrastructure teams do when they must preserve both access and isolation?

A: They should use governed, identity-based access that is tightly scoped to the required OT asset and supported by segmentation that can survive degraded connectivity. The operational goal is not to pretend no route exists, but to make any route deliberate, observable and reversible. That approach supports both continuity and containment.

Technical breakdown

Why the OT air gap collapses under real-world connectivity

An OT air gap only works when the environment is physically and logically isolated, which is rarely true once remote administration, vendor support, and IT integration are introduced. VLANs, firewall rules, and inherited trust zones can preserve separation only if they are accurately configured and continuously monitored. In practice, many OT networks contain approved pathways that become implicit trust paths. Zero Trust changes the design assumption from perfect isolation to verified connectivity, where access is explicit, scoped, and observable.

Practical implication: treat every OT access path as a governed exception, not as evidence that the network remains isolated.

How segmentation and identity-aware access work together in OT

Segmentation limits where traffic can move, while identity-aware access decides who or what may enter a zone in the first place. In OT, that pairing matters because broad network access is often the real risk, not just credential theft. Strong segmentation without identity control can still leave overbroad routes open; identity control without segmentation can still expose too much once a session is established. Effective OT Zero Trust therefore combines policy enforcement at the connection point with continuous validation of user, device and session context.

Practical implication: align segmentation policy with identity and device assurance so access is both narrow and continuously checked.

Why continuous validation matters in fragile OT environments

OT systems are constrained by uptime, safety, and legacy dependencies, so security controls must operate without constant reconfiguration. Continuous validation is the mechanism that keeps access decisions current as posture, destination, or context changes, rather than assuming a trusted session remains safe. That matters in OT because a connection that is acceptable at session start may become dangerous if the user changes task, the device posture degrades, or the route expands. Zero Trust in this setting is therefore a runtime control model, not a one-time architecture decision.

Practical implication: make session monitoring and policy re-evaluation part of OT access governance, especially for remote and third-party connections.

Threat narrative

Attacker objective: The attacker seeks to move from a trusted access path into operational systems where segmentation failure can translate into safety, availability or process impact.

1. Entry occurs through remote vendor access, cloud-connected interfaces, or overly permissive IT-to-OT integration rather than through a physically isolated perimeter.
2. Once inside, an attacker can exploit weak segmentation or misconfigured trust boundaries to reach OT-relevant systems and expand access.
3. The operational impact is potential disruption of industrial processes, loss of control over critical systems, or a wider compromise of the IT/OT environment.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• HPE Aruba Instant On hard-coded credentials: Hard-coded admin credentials in HPE Aruba Instant On access point firmware let anyone bypass login (CVE-2025-37103); no exploitation reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The air gap is now a governance fiction, not a security control. Once remote support, cloud interfaces and IT/OT integration exist, the question shifts from preserving perfect isolation to enforcing explicit, monitored trust boundaries. That makes identity, segmentation and monitoring the operating model for OT defence, not optional enhancements. Practitioners should govern OT access as a continuous control problem, not a perimeter design problem.

Logical segmentation is the named concept that replaces the old air-gap mindset. The important shift is not simply to break networks into smaller pieces, but to make those boundaries enforceable under live operating conditions. In OT, a static diagram is not a control, while policy that can be validated at runtime is. That means OT teams need controls that survive legacy systems, remote administration and constrained sites without assuming ideal topology. Practitioners should treat segmentation as a policy engine, not a topology drawing.

Identity-centric access is the real bridge between OT security and NHI governance. Remote operators, vendors, automation services and machine identities all create access relationships that must be owned, bounded and reviewed. When OT environments depend on service accounts, certificates or other non-human identities, the governance model must extend beyond human IAM into NHI lifecycle control. Practitioners should map every OT access path to an accountable identity type and its approval boundary.

Assume-breach thinking in OT is not a cloud slogan, it is a resilience requirement. CISA’s framing shows that limiting movement and damage matters because OT systems cannot always be patched, reconfigured or taken offline quickly. This changes the control objective from perfect prevention to controlled containment under operational stress. Practitioners should design for safe degradation, not just secure normal-state operations.

DDIL resilience is now part of OT access governance. Disconnected, degraded, intermittent and limited-bandwidth conditions are common enough that centralised access models can become operational liabilities. A resilient OT access design has to continue policy enforcement when links are unstable or partially unavailable. Practitioners should validate that their access architecture still enforces boundaries when connectivity is poor, not only when the network is healthy.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Logical segmentation: OT teams should stop treating segmentation as a static design artifact and start treating it as an enforceable trust boundary. When the control is dynamic, the programme can limit access even as remote operations and vendor support expand. Practitioners should validate whether their segmentation still holds when links, credentials or routes change.

Zero Trust for OT changes the review question for IAM and PAM teams: who can reach a system is now as important as whether the system sits behind a perimeter. That puts identity-bound access, session monitoring and revocation discipline at the centre of industrial security governance. Practitioners should expect more scrutiny of remote administration, third-party access and machine identities.

The strongest OT programmes will align access policy with operational resilience, not just prevention. In practice, that means verifying that isolation and recovery still work when connectivity is degraded, because those are the conditions under which traditional perimeter thinking fails first. Practitioners should test whether access control still functions when the network is unstable, not only when it is healthy.

For practitioners

• Map every OT access path to an explicit owner Inventory remote vendor links, cloud-connected interfaces and IT-to-OT integrations, then assign a business owner and technical approver to each route. The goal is to eliminate hidden trust paths and make exceptions visible for review.
• Enforce segmentation as a live policy Treat segmentation rules as enforceable controls that can be validated and updated, rather than as a one-time network design choice. Review whether VLANs, firewall rules and conduits still reflect current operational dependencies.
• Gate OT connectivity on identity and device context Require strong authentication and device posture checks before any remote or third-party session can reach OT assets. Keep the policy narrow so the user or service account reaches only the assets required for the task.
• Test containment under degraded connectivity Exercise access control, monitoring and isolation procedures in conditions that simulate limited bandwidth, intermittent links and partial outage. Confirm that essential OT operations continue while unnecessary access paths are constrained.

Key takeaways

• OT security breaks when organisations rely on a symbolic air gap instead of enforced segmentation, identity checks and continuous monitoring.
• The article’s guidance reflects a broader shift toward access governance in converged environments where remote connectivity is unavoidable.
• Practitioners should inventory every OT route, scope it tightly and test whether containment still works under degraded connectivity.

Key terms

• Secret Segmentation: The practice of separating credentials by tenant, context, environment, or user so one compromise does not expose everything. For AI systems, segmentation reduces blast radius and helps align access with the exact workflow the agent is executing.
• Identity-centric access: Identity-centric access is an access model that makes identity the primary basis for deciding what a subject can reach. It uses verified identity, attributes, roles, device state, and context to determine permissions, rather than relying only on network location or static perimeter trust.
• DDIL Resilience: DDIL stands for disconnected, degraded, intermittent and limited-bandwidth conditions. In security architecture, it describes environments where access controls must keep working even when links are unstable, making distributed enforcement and local policy execution essential.
• Zero Trust for OT and IIoT: A security model for industrial and connected-device environments that assumes no network path is inherently trusted. It applies strong identity, least privilege, and continuous verification to operational traffic so teams can reduce exposure without depending on broad perimeter access or static network trust.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps identity and security practitioners build the governance discipline needed for modern access models across IT and OT.