OT security: why detection still outruns protection in plants

TL;DR: Detection now works in many OT environments, but enforcement still lags by 30 to 45 minutes or longer, according to TXOne Networks, because legacy systems, inline risk concerns and slow segmentation processes make stopping attacks harder than seeing them. Operational protection has to move at machine speed, not approval speed.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “Detection Isn’t the Problem. Stopping the Threat Is.”.

By the numbers:

• In many environments, the gap between detection and enforcement can take 30 to 45 minutes or longer.

Key questions

Q: Why do OT environments often stop reacting faster than they detect threats?

A: OT teams often detect threats quickly but cannot enforce changes just as fast because production systems are fragile, change windows are narrow, and approvals add delay.

Q: What should security teams do first when OT enforcement lags behind detection?

A: Start by measuring the time from alert to blocked action across people, tools, and approval steps.

Q: What breaks when OT security depends on manual approval before blocking?

A: Manual approval breaks the assumption that defenders can intervene before the attacker finishes.

Practitioner guidance

• Measure enforcement latency against incident impact Track the time between detection, approval, and actual blocking in OT environments.
• Deploy survivable inline prevention Use controls that can block known exploit paths while preserving uptime through hardware bypass or equivalent fail-open design.
• Prioritise protections by asset criticality Build asset-centric vulnerability decisions around process importance, exposure, and operational tolerance instead of raw CVE counts.

Bottom line: The core problem is not a lack of detection. It is the delay between seeing an OT threat and stopping it safely.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →