OT security incidents: are your segmentation controls keeping up?

TL;DR: OT security incidents keep bypassing sophisticated malware and instead exploit exposed HMIs, weak passwords, and flat IT and OT networks, according to Asimily. The pattern shows that inventory, authentication, and segmentation failures matter more than custom ICS exploits when remote access is reachable from the internet.

Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “Attackers Don’t Need ICS Malware: Lessons from High-Profile OT Security Incidents in 2026”.

Key questions

Q: What breaks when OT remote access still relies on reusable passwords or SSH keys?

A: Reusable secrets create a durable entry path that survives the job they were meant to secure.

Q: Why do flat IT and OT networks create such high operational risk?

A: Flat networks let a low-value entry point reach high-value control systems.

Q: What are the signs that OT segmentation is failing in practice?

A: Look for maintenance paths that can reach more than one zone, credentials that remain usable after the job ends, and limited visibility into what the session actually touched.

Practitioner guidance

• Map every internet-reachable OT and IoT interface Inventory HMIs, remote access tools, PLC-adjacent services, and SCADA-exposed systems, then verify which ones can still be reached from external or poorly separated internal networks.
• Eliminate shared and default credentials Replace any shared login protecting operational interfaces with unique accounts and stronger authentication, and revoke legacy access paths that still depend on password convention rather than governed identity.
• Enforce segmentation from observed traffic Build network policy from actual device communications so billing, portal, and remote access systems cannot laterally reach operational controls without an explicit business requirement.

Bottom line: OT incidents in this article were enabled by exposed interfaces, weak credentials, and poor internal separation rather than by specialised ICS malware.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →