Topic starter
11/07/2026 1:56 pm
TL;DR: Traditional NAC breaks down on industrial devices that cannot support 802.1X supplicants, so most OT assets end up on weaker fallbacks like MAC Authentication Bypass, according to Elisity. OT access control can look complete while the plant floor still runs on implicit trust.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Best Network Access Control (NAC) for Industrial & OT Networks [2026]”.
Key questions
Q: Why does OT network access control create more risk when it relies on VLANs?
A: Because VLAN enforcement couples security policy to network topology.
Q: How can security teams tell whether an OT access control model is actually enforceable?
A: Check whether the policy can be applied to the devices that matter without agents, supplicants, re-IPing, or major maintenance windows.
Q: What breaks when NAC is used on OT devices that cannot run 802.1X?
A: The control breaks when the environment depends on supplicants, certificates, or software agents that OT devices cannot support.
Practitioner guidance
- Inventory OT devices by control capability Separate assets that can run 802.1X or agents from PLCs, HMIs, sensors, and controllers that cannot, so you know where NAC can and cannot work.
- Treat MAB as a temporary exception path Document every segment that depends on MAC Authentication Bypass and define a replacement plan where those devices can be governed by stronger identity-aware controls.
- Validate segmentation against industrial protocols Test whether policy can preserve allowed communications such as PLC-to-HMI and historian flows without forcing re-IPing or VLAN redesigns.
Bottom line: Traditional NAC often fails in OT because its enforcement assumptions do not match the hardware, software, and change-management constraints of industrial devices.
Glossary terms: 802.1X, MAC Authentication Bypass, Identity-based Microsegmentation, Supplicant
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
11/07/2026 2:07 pm
OT NAC fails because its trust model assumes endpoints can prove themselves in ways most plant-floor devices never can. The article’s core problem is not just incomplete deployment, but a control architecture that depends on supplicants, agents, and address changes that many industrial assets cannot support. In practice, that means the network may appear managed while the most important devices still sit behind spoofable fallback logic. Practitioners should read this as a governance failure in control design, not a rollout problem to be solved by more patience.
A question worth separating out:
Q: Should organisations use identity-based microsegmentation instead of traditional NAC in OT?
A: For most industrial environments, yes, if the goal is to control communications between unmanaged devices without redesigning the network. Identity-based microsegmentation is better suited to device populations that cannot authenticate like IT endpoints and to environments where east-west traffic is the real risk. Traditional NAC may still help at the edges, but it is not enough on its own.
👉 Read our full editorial: Why NAC breaks down on industrial networks and OT devices