Topic starter
11/07/2026 1:53 pm
TL;DR: OT living off the land attacks, Elisity reports, can evade detection while trusted admin paths and native industrial protocols look routine. Microsegmentation limits device-to-device reach so a compromised path cannot move freely through the control environment.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Living Off the Land Attacks in OT: The Microsegmentation Fix”.
By the numbers:
- 81% of architecture assessments identified poor IT/OT segmentation.
Key questions
Q: Why do trusted OT admin paths increase lateral movement risk?
A: Because authentication to a VPN, jump host, or shared service does not limit what the session can reach after login.
Q: How do teams know whether IT/OT segmentation is actually working?
A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations.
Q: What breaks when manufacturing networks rely on VLANs for segmentation?
A: VLANs create broad trust zones, so once an attacker enters a segment, they can often move laterally to other reachable devices inside the same zone.
Practitioner guidance
- Define device-level communication policy Inventory which OT assets actually need to communicate, then block every non-essential path between PLCs, HMIs, engineering workstations, historians, and remote access infrastructure.
- Segment trusted admin bridges Isolate VPNs, jump hosts, and shared services that bridge IT and OT, and apply separate policy to each bridge so compromise of one path does not expose the control network.
- Replace coarse VLAN trust with microsegmentation Use asset identity, function, and protocol context to enforce communications at the device level rather than assuming a subnet boundary is enough.
Bottom line: Living off the land in OT is dangerous because native industrial protocols can make attacker traffic look routine while bypassing agent-based detection.
Glossary terms: Living-off-the-Land, Microsegmentation, Zones And Conduits, Engineering Workstation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
11/07/2026 2:03 pm
OT living off the land is fundamentally a segmentation failure, not a detection failure. The article's evidence shows that legitimate industrial commands can blend into normal traffic because the protocols themselves were not designed to prove intent. In that environment, alerts are always downstream of the real problem. Practitioners should therefore judge control quality by how tightly the architecture constrains lateral movement, not by how much telemetry it collects.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: When should OT teams prioritise segmentation over more detection tooling?
A: When the environment contains legacy controllers, unauthenticated protocols, or assets that cannot run endpoint agents, segmentation should come first. Detection still matters, but it cannot prevent movement once an attacker is already using trusted tools and native protocols. In those conditions, constraining reach is the stronger control.
👉 Read our full editorial: Microsegmentation closes the OT gap that LOTL attacks exploit
This post was modified 9 hours ago by NHI Mgmt Group