Topic starter
14/09/2026 10:09 am
TL;DR: OT telemetry and OT security solve different problems, and DataBahn argues that confusing them leaves visibility gaps, mis-sized licenses, and incomplete coverage because collection and normalization are pipeline functions, not detection functions. The practical implication is that plants usually need better telemetry routing before they need another monitoring platform.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “OT telemetry vs. OT security: why the distinction matters”.
Key questions
Q: What breaks when OT telemetry is not fully normalised before security tools use it?
A: Security tools lose context, coverage becomes uneven, and teams pay for detection on an incomplete feed.
Q: Why does unstructured OT telemetry make security controls less effective?
A: Because security tools cannot reason over data they cannot parse consistently.
Q: How do security teams tell whether the problem is coverage or detection?
A: Ask whether the missing evidence is data collection, parsing, or alert logic.
Practitioner guidance
- Map OT telemetry sources separately from OT security tools Inventory PLCs, RTUs, industrial protocols, and any IoT-like sources that generate operational data, then document which ones currently reach a SIEM, data lake, or detection platform in usable form.
- Test whether telemetry is normalized before ingestion Check whether feeds arrive raw, partially parsed, or fully structured, because raw multi-protocol traffic creates separate parsing and routing problems before any detection logic can help.
- Separate coverage decisions from detection decisions Before renewing an OT security platform, identify whether the real failure is missing collection, weak normalization, or weak detection, and fix the earliest failing layer first.
Bottom line: OT telemetry and OT security are different layers of the same environment, and collapsing them leaves detection tools underfed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
OT visibility fails first at the pipeline, not at the alarm: the central governance mistake in this article is assuming that a detection platform can compensate for missing or unstructured telemetry. In OT, the security control is only as effective as the data feed underneath it. Practitioners should treat telemetry routing as part of the control plane, not as an implementation detail.
A question worth separating out:
Q: What should plants do before buying another OT monitoring platform?
A: They should confirm that the existing telemetry pipeline can collect from all relevant sources, normalise multi-protocol traffic, and deliver it without operational disruption. If those steps are incomplete, a new monitoring tool will still see a partial plant floor and simply cost more to operate.
👉 Read our full editorial: OT telemetry vs OT security: why pipeline design matters