Topic starter
11/07/2026 1:56 pm
TL;DR: Traditional NAC depends on 802.1X, supplicants, and VLAN-centric enforcement, but industrial devices such as PLCs, HMIs, and sensors often cannot support those assumptions, leaving most OT assets on weaker fallbacks like MAC Authentication Bypass, according to Elisity. The result is an access-control model that looks complete in IT but leaves the plant floor governed by implicit trust.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Best Network Access Control (NAC) for Industrial & OT Networks [2026]”.
Key questions
Q: What breaks when NAC is used on OT devices that cannot run 802.1X?
A: The control breaks when the environment depends on supplicants, certificates, or software agents that OT devices cannot support.
Q: Why does OT network access control create more risk when it relies on VLANs?
A: Because VLAN enforcement couples security policy to network topology.
Q: How can security teams tell whether an OT access control model is actually enforceable?
A: Check whether the policy can be applied to the devices that matter without agents, supplicants, re-IPing, or major maintenance windows.
Practitioner guidance
- Inventory OT devices by control capability Separate assets that can run 802.1X or agents from PLCs, HMIs, sensors, and controllers that cannot, so you know where NAC can and cannot work.
- Treat MAB as a temporary exception path Document every segment that depends on MAC Authentication Bypass and define a replacement plan where those devices can be governed by stronger identity-aware controls.
- Validate segmentation against industrial protocols Test whether policy can preserve allowed communications such as PLC-to-HMI and historian flows without forcing re-IPing or VLAN redesigns.
Bottom line: Traditional NAC often fails in OT because its enforcement assumptions do not match the hardware, software, and change-management constraints of industrial devices.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:07 pm
OT NAC fails because its trust model assumes endpoints can prove themselves in ways most plant-floor devices never can. The article’s core problem is not just incomplete deployment, but a control architecture that depends on supplicants, agents, and address changes that many industrial assets cannot support. In practice, that means the network may appear managed while the most important devices still sit behind spoofable fallback logic. Practitioners should read this as a governance failure in control design, not a rollout problem to be solved by more patience.
A question worth separating out:
Q: Should organisations use identity-based microsegmentation instead of traditional NAC in OT?
A: For most industrial environments, yes, if the goal is to control communications between unmanaged devices without redesigning the network. Identity-based microsegmentation is better suited to device populations that cannot authenticate like IT endpoints and to environments where east-west traffic is the real risk. Traditional NAC may still help at the edges, but it is not enough on its own.
👉 Read our full editorial: Why NAC breaks down on industrial networks and OT devices