Topic starter
02/08/2026 12:20 pm
TL;DR: OT telemetry is increasingly a security priority because it captures the continuous signals that protect physical operations, yet legacy SIEMs were built for discrete logs and often cannot ingest this data at scale, according to DataBahn. The result is an architectural blind spot where enrichment, routing, and retention decisions increasingly determine whether teams detect interference before it becomes operational impact.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “OT Telemetry: The next frontier for security and AI”.
Key questions
Q: How should SOC teams govern OT telemetry without overwhelming the SIEM?
A: Treat OT telemetry as a separate governed stream, not as ordinary log volume.
Q: Why does pre-ingestion enrichment matter for industrial telemetry?
A: Because the security value of OT data depends on context that must be present before retention decisions are made.
Q: What breaks when OT telemetry is down-sampled too aggressively?
A: Teams lose the continuity needed to spot process drift, unsafe changes, and slow-moving intrusion patterns.
Practitioner guidance
- Define OT telemetry as a governed security data class Classify OT signals separately from standard IT logs so ingestion, retention, and cost rules reflect continuous operational data rather than discrete event assumptions.
- Shift enrichment upstream into the collection pipeline Attach asset identity, geolocation, threat intelligence, and ownership context before SIEM ingestion so routing decisions can be made on enriched value.
- Build edge filtering for constrained OT sites Use local collectors to compress, prioritise, and forward security-relevant telemetry when bandwidth and site connectivity vary across plants and utilities.
Bottom line: OT telemetry is no longer just an operations feed because its context now determines whether security teams can detect interference before it reaches physical impact.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:21 pm
OT telemetry has become a security control surface, not a logging problem: once operational signals determine whether a pipeline retains, routes, or suppresses data, they are part of the security architecture. The old view treated telemetry as a cost to absorb after collection. That model fails when the value of the signal depends on context at ingestion time. Practitioners should treat telemetry governance as control design, not storage optimisation.
A question worth separating out:
Q: Should organisations use AI to route telemetry before SIEM ingestion?
A: Yes, but only with auditable policy boundaries. AI can help detect new schemas, classify noise, and prioritise security-relevant signals, yet it must not become an unreviewed decision-maker. The right use is controlled automation that improves scale and consistency while keeping retention and routing accountable.
👉 Read our full editorial: OT telemetry enrichment is becoming a security control, not a cost line