Topic starter
11/07/2026 8:42 pm
TL;DR: Air-gapped OT models no longer hold as IT and OT converge, according to Appgate, and zero trust for critical infrastructure only works when teams sequence assessment, strategy, roadmap and execution around uptime, latency and legacy identity constraints. The key shift is from buying ZTNA to governing OT access as a phased programme.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Securing the Grid: A Practical Zero Trust Blueprint for Energy Infrastructure”.
Key questions
Q: How should security teams apply zero trust to OT without disrupting operations?
A: Start with identity inventory, least privilege, and segmentation that respects safety and uptime.
Q: Why do standard IT access controls often fail in OT environments?
A: Standard IT access controls often assume modern identity systems, flexible routing, and maintenance windows that OT does not have.
Q: What are the signs that Zero Trust is being misapplied in a university environment?
A: Common warning signs include overly broad user access, weak authentication, manual provisioning that cannot keep up with turnover, and identity controls that do not reflect specific user tasks.
Practitioner guidance
- Map the OT protect surface Identify the critical OT assets, control systems and remote access paths that must be governed first, then tie each to an access policy owner.
- Build a phased zero trust roadmap Separate assessment, strategy, policy enforcement and technology enablement so that each stage can be measured against operational resilience and uptime.
- Validate legacy identity integration Check how siloed OT identities, proprietary authentication and long-lived operational accounts will be integrated without forcing a disruptive migration.
Bottom line: OT zero trust is a governance programme, not a single product choice, because operational environments have latency, uptime and legacy identity constraints that enterprise tools do not automatically solve.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:08 pm
Air gaps have become a governance assumption, not a control. Once OT and IT networks converge, physical isolation no longer guarantees meaningful segmentation or trustworthy access decisions. The article is right to frame zero trust as the replacement for a fading operating assumption rather than as an overlay control. For practitioners, the implication is that OT security planning has to start with where trust is still implicit, not where a perimeter used to exist.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What should critical infrastructure teams prioritise before enforcing OT zero trust?
A: They should prioritise asset scoping, identity mapping and a phased execution plan that separates policy design from enforcement. That sequence lets teams protect the most important systems first while avoiding the operational disruption that comes from forcing a full access redesign too quickly.
👉 Read our full editorial: Zero trust for OT security needs a programmatic rollout