Topic starter
02/08/2026 12:20 pm
TL;DR: OT telemetry now matters for security because its context can determine whether interference is detected before physical impact, according to DataBahn. Routing and retention choices now shape what OT data security teams can actually see and act on.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “OT Telemetry: The next frontier for security and AI”.
Key questions
Q: Why does pre-ingestion enrichment matter for industrial telemetry?
A: Because the security value of OT data depends on context that must be present before retention decisions are made.
Q: What breaks when OT telemetry is down-sampled too aggressively?
A: Teams lose the continuity needed to spot process drift, unsafe changes, and slow-moving intrusion patterns.
Q: How should SOC teams govern OT telemetry without overwhelming the SIEM?
A: Treat OT telemetry as a separate governed stream, not as ordinary log volume.
Practitioner guidance
- Define OT telemetry as a governed security data class Classify OT signals separately from standard IT logs so ingestion, retention, and cost rules reflect continuous operational data rather than discrete event assumptions.
- Shift enrichment upstream into the collection pipeline Attach asset identity, geolocation, threat intelligence, and ownership context before SIEM ingestion so routing decisions can be made on enriched value.
- Build edge filtering for constrained OT sites Use local collectors to compress, prioritise, and forward security-relevant telemetry when bandwidth and site connectivity vary across plants and utilities.
Bottom line: OT telemetry is no longer just an operations feed because its context now determines whether security teams can detect interference before it reaches physical impact.
Glossary terms: Operational Telemetry, Pre-SIEM Enrichment, Telemetry routing, Agentic AI Pipeline Control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
02/08/2026 1:21 pm
OT telemetry has become a security control surface, not a logging problem: once operational signals determine whether a pipeline retains, routes, or suppresses data, they are part of the security architecture. The old view treated telemetry as a cost to absorb after collection. That model fails when the value of the signal depends on context at ingestion time. Practitioners should treat telemetry governance as control design, not storage optimisation.
A question worth separating out:
Q: Should organisations use AI to route telemetry before SIEM ingestion?
A: Yes, but only with auditable policy boundaries. AI can help detect new schemas, classify noise, and prioritise security-relevant signals, yet it must not become an unreviewed decision-maker. The right use is controlled automation that improves scale and consistency while keeping retention and routing accountable.
👉 Read our full editorial: OT telemetry enrichment is becoming a security control, not a cost line