TL;DR: Firewall-led segmentation in OT becomes brittle as environments change, because static IP and port rules struggle to enforce least privilege, vendor access, and east-west control across zones and conduits, according to Xage Security. The governance gap is not perimeter defence but identity-aware enforcement that can adapt without constant rule churn.
At a glance
What this is: Xage Security’s article argues that traditional firewall-centric segmentation is too static for OT and that zero trust segmentation better fits zone-based control, identity-aware access, and time-bound authorization.
Why it matters: It matters because OT and industrial teams often inherit long-lived firewall exceptions and broad vendor access, while IAM, PAM, and NHI controls can reduce lateral movement and improve segmentation governance.
Context
Most industrial networks still rely on legacy segmentation patterns that were built for stable boundaries, not for changing assets, temporary access, and vendor maintenance. In OT, the problem is not simply where the perimeter sits, but whether enforcement can follow identity, purpose, and time-bound need across the OT and ICS identity model.
When segmentation is anchored to static network rules, every new connection tends to create more exceptions, more maintenance overhead, and more risk of permanent access. That is why the governance question is shifting from where to place firewalls to how to express least privilege across zones and conduits without breaking operations.
Key questions
Q: What breaks when OT segmentation depends on static network rules?
A: Static OT segmentation breaks when network location is no longer a reliable proxy for trust. As environments add cloud connectivity, robotics, edge systems, and modern applications, IP-based rules and manual policy changes become brittle, create hidden trust paths, and leave lateral movement opportunities that are hard to detect or audit.
Q: Why does identity matter in OT segmentation decisions?
A: Identity matters because OT access is increasingly about who or what is connecting, not just which network segment they are on. When policy is tied to verified identity, role, and time window, organisations can limit access to the exact asset and task required. That reduces persistent trust, narrows blast radius, and gives security teams a clearer governance model.
Q: How do organisations prevent vendor access from becoming permanent?
A: They scope vendor connectivity to named assets, require approved time windows, and revoke access automatically when the maintenance task ends. The key is to avoid broad VPN reach or long-lived firewall exceptions that outlive the original request. Without expiry and revocation discipline, temporary access tends to become a standing pathway into operational systems.
Q: How should teams align OT segmentation with IEC 62443?
A: Teams should map zones, conduits, and access paths to a policy model that can be enforced consistently across the environment. IEC 62443 alignment is most useful when it drives real segmentation decisions, not just documentation. The practical test is whether the model can support secure communication, least privilege, and controlled change without creating operational fragility.
Technical breakdown
Why static firewall rules struggle in OT segmentation
Firewalls were designed to enforce network boundaries, not to express identity-aware policy across dynamic industrial environments. In OT, they usually depend on IP addresses, ports, and protocol allow or block logic, which makes them brittle when devices change, vendors connect remotely, or process systems are reconfigured. That creates a mismatch between the security model and the operational reality. Static segmentation can preserve a boundary, but it does not reliably encode who should connect, under what conditions, or for how long. As the rule set grows, exceptions accumulate and the policy becomes harder to reason about. See the OT Security Guide.
Practical implication: Treat firewall rules as boundary controls, not as the full segmentation policy.
How identity-driven zero trust segmentation changes enforcement
Zero trust segmentation keeps the zone and conduit model, but shifts policy enforcement away from static network constructs and toward identity, role, and session context. That means the control decision can be tied to a verified device, application, or operator identity, then limited to the specific action and time window required. This is closer to how industrial operations actually work, where access is often temporary and task-based. The architectural change matters because it reduces the need to rewrite low-level rules every time a system, contractor, or workflow changes. It also reduces the chance that one approved connection becomes a standing pathway. See the Zero Trust Identity Guide.
Practical implication: Use identity-backed policy to make OT access conditional rather than permanently granted.
Why vendor and maintenance access become a segmentation governance problem
Remote support and maintenance are where segmentation failures often become governance failures. If vendor access is handled through broad VPN reach or firewall exceptions, the organisation loses control over scope, duration, and revocation. The real issue is not remote access itself, but unmanaged persistence: access approved for a task often remains available after the task ends. That expands the blast radius for credential misuse and lateral movement. In industrial settings, this is especially risky because many protocols and assets are not designed to resist broad trust once a boundary is crossed.
Practical implication: Bind third-party access to explicit identity, asset scope, and expiry controls.
Threat narrative
Attacker objective: The objective is to gain durable access to industrial systems by exploiting broad or lingering segmentation pathways rather than a single controlled session.
- Entry occurs when remote maintenance, vendor connectivity, or internal access is expanded through firewall exceptions that widen the reachable attack surface.
- Credential or network access is then reused beyond the original task, because static rules are easier to leave in place than to revoke cleanly.
- An attacker or misused account can move laterally across permissive internal paths once a segment boundary has been crossed.
- The impact is broader industrial exposure, including unnecessary reach into operational systems and a larger blast radius if an identity is compromised.
Breaches seen in the wild
- Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Firewalls are necessary in OT, but they are not a complete segmentation model. The article is right to separate perimeter enforcement from internal policy expression. In complex industrial environments, static IP and port rules cannot carry the full burden of identity-aware authorization, especially when remote support and maintenance change frequently. Practitioners should treat firewall-centric zoning as a partial control and move toward policy that is evaluated at access time, not just at network design time.
Standing exception debt is the real OT segmentation failure mode. The article describes a pattern that security teams know well: every temporary access request creates another exception, and those exceptions tend to persist. Over time, the environment becomes harder to audit, harder to explain, and easier to traverse. That is not just a firewall maintenance problem; it is a governance problem about who can connect, for how long, and under what conditions. The right control objective is not fewer rules, but fewer durable exceptions.
The OT identity boundary now matters as much as the network boundary. Once segmentation depends on identity, the organisation has to govern operators, contractors, device identities, and service access as first-class control objects. That brings OT closer to the same governance discipline used for privileged access and NHI lifecycle management, especially where machine identities and remote support are involved. The practical conclusion is that segmentation policy and identity policy can no longer be run as separate programmes.
IEC 62443 alignment is about control intent, not checkbox compliance. The article correctly points out that industrial segmentation should align with secure architecture requirements, but compliance only matters if it reduces operational ambiguity. The lesson for practitioners is to map zones, conduits, identities, and access windows to one coherent policy model rather than treating standards, firewall rules, and remote access as separate layers. That is where operational resilience and segmentation governance converge.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
- Read next: OT and ICS Identity and Access Guide
What this signals
OT segmentation is becoming an identity governance problem as much as a network design problem. As environments become more dynamic, the question is not whether a firewall can block traffic, but whether access can be expressed as a governed identity decision that expires when the task ends. That shift pushes OT teams toward identity-centric zero trust, especially where remote support and maintenance are part of normal operations.
Standing exception debt: when segmentation policy accumulates temporary allowances that never get removed, the control model turns fragile and opaque. That is the point at which lateral movement risk increases, because the environment no longer reflects the architecture on paper. In practice, the programme has to measure how many exceptions exist, who owns them, and whether they still match live operational need.
The hardest part of modern OT segmentation is no longer designing zones. It is maintaining consistent enforcement as devices, vendors, and workflows change, while still preserving availability and operational continuity. Teams that can tie access to identity, expiry, and asset scope will find it much easier to sustain least privilege than teams that keep adding rule after rule.
For practitioners
- Redesign segmentation around identity-aware policy Use roles, device identity, and time-bound access to define who can reach each OT zone instead of relying on static IP and port rules. See the Zero Trust Identity Guide.
- Inventory and retire permanent firewall exceptions Review legacy rules that were created for temporary maintenance or vendor access and remove any pathway that no longer has an active business need.
- Bind third-party access to explicit expiry Require vendor sessions to be scoped to named assets and time windows so maintenance access does not become standing access.
- Map OT zoning to IEC 62443 requirements Translate each zone, conduit, and access path into a policy model that supports secure segmentation and system-level governance.
- Simplify internal firewall roles where zero trust is in place Keep firewalls at the perimeter and reduce their role in internal policy expression when identity-backed controls can enforce the same intent more cleanly.
Key takeaways
- Firewall-centric segmentation can preserve boundaries, but it does not scale well when OT environments change frequently and need identity-aware access decisions.
- The core governance problem is standing exception debt, where temporary access and rule exceptions linger long after the original operational need ends.
- A zero trust segmentation model improves control by tying access to identity, asset scope, and time-bound need instead of relying on static network rules.
Related NHI Mgmt Group resources: Zero Trust Identity Guide · OT and ICS Identity and Access Guide · IEC 62443 Guide · Schneider Electric Jira breach 2024
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity-based OT segmentation depends on controlled permissions and explicit authorization boundaries. |
| Recommendation — Apply PR.AA-05 to keep OT access explicitly authorised and limited to the required scope. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article’s core claim is that broad internal access undermines segmentation and increases lateral movement risk. |
| Recommendation — Enforce AC-6 so OT access remains least privilege, even when connectivity changes over time. | ||
| CIS Controls v8 | CIS-5 — Account Management | Temporary vendor and contractor access is central to the segmentation governance problem described here. |
| Recommendation — Use CIS-5 to control account lifecycle and remove access that no longer has an active operational purpose. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud-adjacent identity governance principles directly support identity-driven segmentation and remote access control. |
| Recommendation — Apply IAM domain controls to bind OT connectivity to verified identities and approved access scope. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Over-broad segmentation and lingering access make credential abuse and lateral movement more likely in OT. |
| Recommendation — Map exposed OT pathways to TA0006 and TA0008, then hunt for broad trust and lateral movement opportunities. | ||
Key terms
- Zones And Conduits: An industrial security model that groups assets into zones with shared security requirements and defines controlled conduits between them. It is most effective when the conduits are enforced at a granular level, because coarse segmentation often leaves too much trust inside each zone.
- Zero Trust Micro-Segmentation: A Zero Trust approach that divides the environment into small policy zones so workloads, users, and endpoints only communicate when explicitly allowed. It shifts protection from the perimeter to the application and workload layer, where trust is continuously constrained by policy rather than assumed by network location.
- Standing Exception Debt: The accumulation of temporary access rules, firewall exceptions, and special-case connectivity that remain active long after the original need has ended. In security operations, it is a governance failure because the environment becomes harder to audit, harder to simplify, and easier to misuse.
- Identity-Aware Access: Identity-aware access is an authorization model that evaluates who or what is making a request, what it is trying to reach, and under what context. It replaces broad, persistent trust with request-level decisions. In agentic environments, it is the control that can contain a deceived agent before it reaches enterprise systems.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the access problems that show up in hybrid, OT, and distributed environments.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org