Topic starter
11/07/2026 1:53 pm
TL;DR: OT attackers increasingly use native industrial protocols and trusted admin paths instead of custom malware, according to Elisity, and Dragos data points to a deeper architecture issue: 56% of penetration tests abused living off the land tools undetected while 81% of assessments found poor IT/OT segmentation. In OT, segmentation, not endpoint telemetry, becomes the decisive control.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Living Off the Land Attacks in OT: The Microsegmentation Fix”.
By the numbers:
- 81% of architecture assessments identified poor IT/OT segmentation.
Key questions
Q: What breaks when manufacturing networks rely on VLANs for segmentation?
A: VLANs create broad trust zones, so once an attacker enters a segment, they can often move laterally to other reachable devices inside the same zone.
Q: Why do trusted OT admin paths increase lateral movement risk?
A: Because authentication to a VPN, jump host, or shared service does not limit what the session can reach after login.
Q: How do teams know whether IT/OT segmentation is actually working?
A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations.
Practitioner guidance
- Define device-level communication policy Inventory which OT assets actually need to communicate, then block every non-essential path between PLCs, HMIs, engineering workstations, historians, and remote access infrastructure.
- Segment trusted admin bridges Isolate VPNs, jump hosts, and shared services that bridge IT and OT, and apply separate policy to each bridge so compromise of one path does not expose the control network.
- Replace coarse VLAN trust with microsegmentation Use asset identity, function, and protocol context to enforce communications at the device level rather than assuming a subnet boundary is enough.
Bottom line: Living off the land in OT is dangerous because native industrial protocols can make attacker traffic look routine while bypassing agent-based detection.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:03 pm
OT living off the land is fundamentally a segmentation failure, not a detection failure. The article's evidence shows that legitimate industrial commands can blend into normal traffic because the protocols themselves were not designed to prove intent. In that environment, alerts are always downstream of the real problem. Practitioners should therefore judge control quality by how tightly the architecture constrains lateral movement, not by how much telemetry it collects.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: When should OT teams prioritise segmentation over more detection tooling?
A: When the environment contains legacy controllers, unauthenticated protocols, or assets that cannot run endpoint agents, segmentation should come first. Detection still matters, but it cannot prevent movement once an attacker is already using trusted tools and native protocols. In those conditions, constraining reach is the stronger control.
👉 Read our full editorial: Living off the land attacks in OT expose the segmentation gap