Zero trust for OT security needs a programmatic rollout

At a glance

What this is: This is an OT security analysis arguing that traditional air gaps are weakening as IT and OT converge, and that zero trust must be rolled out as a phased programme rather than a simple tooling change.

Why it matters: It matters to identity and security practitioners because OT environments still depend on legacy identity systems, availability constraints and low-latency control paths that make standard IT access patterns unsafe.

Context

Operational technology security used to rely on physical separation, but that assumption weakens once industrial systems connect to enterprise networks for remote monitoring, grid modernization and other operational demands. Zero trust becomes the relevant control model when isolation is no longer reliable, but OT environments still impose safety, latency and uptime constraints that standard enterprise designs do not face. For identity and access teams, the governance challenge is not just stronger authentication. It is building access controls that fit legacy OT identities, critical infrastructure availability and segmented operational networks.

The practical problem is that OT zero trust is not a wholesale platform replacement. It is a staged governance change that has to align policy, topology and operations before enforcement begins. That makes it relevant to IAM, PAM and NHI governance because OT environments often contain long-lived accounts, proprietary identity stores and tightly coupled operational workflows. The article’s starting position is typical for converged environments, where technical isolation has eroded faster than access governance has evolved.

Key questions

Q: How should security teams apply zero trust to OT without disrupting operations?

A: Start with identity inventory, least privilege, and segmentation that respects safety and uptime. Then move to stronger verification and policy enforcement only after you can observe normal machine behaviour, log decisions, and define safe rollback paths. In OT, the control objective is to reduce implicit trust without creating operational instability.

Q: Why do standard IT access controls often fail in OT environments?

A: Standard IT access controls often assume modern identity systems, flexible routing, and maintenance windows that OT does not have. OT frequently depends on proprietary identities, deterministic traffic, and continuous availability. When those constraints are ignored, access controls can create latency, downtime, or exceptions that undermine both security and operations.

Q: What are the signs that Zero Trust is being misapplied in a university environment?

A: Common warning signs include overly broad user access, weak authentication, manual provisioning that cannot keep up with turnover, and identity controls that do not reflect specific user tasks. When schools still rely on perimeter thinking or grant more access than necessary, Zero Trust becomes partial rather than operational. The result is weaker containment and a higher chance of exposing sensitive student and staff data.

Q: What should critical infrastructure teams prioritise before enforcing OT zero trust?

A: They should prioritise asset scoping, identity mapping and a phased execution plan that separates policy design from enforcement. That sequence lets teams protect the most important systems first while avoiding the operational disruption that comes from forcing a full access redesign too quickly.

Technical breakdown

Why air gaps and standard IT ZTNA fail in OT

An air gap assumes that operational systems remain physically and logically separate from enterprise networks. In modern OT environments that assumption is breaking down because remote monitoring, centralised operations and convergence with IT all create new access paths. Standard IT ZTNA often fails here because it expects cloud-mediated routing, modern identity integration and user-workflow flexibility that can conflict with protocol timing, latency tolerance and safety requirements in control systems. The architectural issue is not zero trust itself. It is applying a design built for office endpoints to systems that cannot tolerate delay, interruption or forced identity migration.

Practical implication: treat OT access architecture as a separate design problem and validate routing, protocol timing and identity dependencies before enforcing policy.

How legacy OT identity changes zero trust design

OT environments frequently use siloed, proprietary or long-lived identity systems that were not built around central IAM patterns. That changes the zero trust design because access governance cannot assume every subject will be migrated into a modern identity provider before controls can be enforced. Instead, policy has to bridge legacy identities, operational accounts and device or service relationships without disrupting the control plane. This is where identity governance becomes central to OT security. The access model must recognise who or what is authorised, preserve operational continuity and still reduce standing access wherever possible.

Practical implication: inventory legacy OT identities first and design a bridge strategy that can enforce policy without forcing a full identity-platform migration.

Why programmatic rollout matters more than a single zero trust product

Zero trust in OT is best treated as a programme with sequencing, not as a product category. Assessment establishes readiness and control gaps. Strategy creates cross-functional alignment. Roadmap converts critical assets into phased policy and technology changes. Execution then enforces policy while measuring outcomes through OT resilience, uptime and safety rather than IT-only metrics. This phased model matters because OT risk is operational as well as cyber risk. Without sequencing, teams often overcorrect with controls that create downtime or undercorrect with controls that leave exposure in place.

Practical implication: build an OT zero trust roadmap with staged policy enforcement and OT-specific success measures before any broad rollout.

Threat narrative

Attacker objective: The objective is to reach OT assets through newly connected pathways and exploit the gap between enterprise access controls and operational system requirements.

1. Entry occurs as IT and OT convergence creates new remote access and monitoring paths that bypass the old assumptions of physical isolation.
2. Escalation follows when standard IT access models and legacy identities are used in environments that were never designed for that level of external connectivity.
3. Impact is operational exposure, where latency, downtime or insecure access paths can undermine safety, resilience and critical infrastructure continuity.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Air gaps have become a governance assumption, not a control. Once OT and IT networks converge, physical isolation no longer guarantees meaningful segmentation or trustworthy access decisions. The article is right to frame zero trust as the replacement for a fading operating assumption rather than as an overlay control. For practitioners, the implication is that OT security planning has to start with where trust is still implicit, not where a perimeter used to exist.

OT zero trust is an identity problem as much as a network problem. Legacy OT identity stores, long-lived accounts and proprietary authentication models are exactly where traditional IAM and PAM assumptions break down. The identity bridge matters because access policy cannot be enforced safely if the organisation cannot map who or what is actually authorised in the OT control plane. Practitioners should treat legacy identity integration as a core design constraint, not an implementation detail.

Programmatic rollout is the only realistic path for converged environments. A phased assessment, strategy, roadmap and execution model creates the sequencing needed to reduce risk without destabilising operations. That approach aligns with how critical infrastructure is actually governed: resilience first, then enforcement, then optimisation. The practitioner takeaway is that OT zero trust succeeds only when policy change, operational safety and technology change move together.

Direct-routing is a named design constraint, not an optimisation. In OT, cloud-routed access can introduce latency and protocol mismatch that change the risk profile of the control system itself. That makes routing architecture part of the security decision, not just the transport layer. Teams should validate local-path traffic handling as a prerequisite for any remote-access enforcement plan.

Zero trust in OT exposes a deeper concept: convergence trust gap. This is the distance between enterprise-style access governance and the reality of operational uptime, proprietary identities and safety-critical workflows. The gap is what forces teams to move from a tool-first mindset to a control-first programme. Practitioners should evaluate every access change against this gap before they deploy it.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: NHI Lifecycle Management Guide

What this signals

Convergence trust gap: OT security teams now have to govern the space between enterprise access assumptions and safety-critical operational reality. The practical question is no longer whether to adopt zero trust, but how to do it without breaking uptime, latency tolerance or legacy identity dependencies.

Identity governance becomes the forcing function once OT and IT are connected. If organisations cannot map and control legacy operational identities, zero trust remains theoretical and enforcement decisions will keep leaking back to network segmentation alone.

For readers building programmes now, the next pressure point is sequencing. Assessment, identity integration and direct-routed access design have to be treated as linked controls, not separate workstreams.

For practitioners

• Map the OT protect surface Identify the critical OT assets, control systems and remote access paths that must be governed first, then tie each to an access policy owner.
• Build a phased zero trust roadmap Separate assessment, strategy, policy enforcement and technology enablement so that each stage can be measured against operational resilience and uptime.
• Validate legacy identity integration Check how siloed OT identities, proprietary authentication and long-lived operational accounts will be integrated without forcing a disruptive migration.
• Test direct-routed access paths Confirm that sensitive operational traffic stays on local network paths and does not depend on cloud routing that could add latency or protocol incompatibility.
• Define OT-specific success metrics Measure the rollout with safety, uptime and resilience indicators instead of relying only on IT security KPIs.

Key takeaways

• OT zero trust is a governance programme, not a single product choice, because operational environments have latency, uptime and legacy identity constraints that enterprise tools do not automatically solve.
• The article’s central evidence is that physical isolation is weakening as IT and OT converge, which forces access control to move closer to identity, routing and operational policy.
• The practical control shift is to phase assessment, strategy, roadmap and execution so that security improvements do not disrupt the systems they are meant to protect.

Key terms

• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Direct-Routed Access: An access architecture where traffic is enforced inside the customer boundary instead of being backhauled through a shared cloud broker. The value is tighter operational control, lower external exposure, and a clearer trust boundary for high-sensitivity or regulated environments.
• Legacy Identity Data: Legacy identity data is older customer identification material that was collected under prior retention practices and still exists in current systems. It often includes scanned passports, licences, and supporting files stored in email, cloud drives, or CRM platforms. Managing it requires discovery, legal review, remediation, and deletion scheduling.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and secrets management for practitioners working across modern access programmes. It helps security and identity teams translate governance requirements into operational controls that fit real-world environments.