Topic starter
30/07/2026 11:21 pm
TL;DR: Devices that cannot be patched need compensating controls, not exceptions: inventory by device class and patch status, rank by exposure, segment by identity, broker remote access, and document the control date, according to Elisity. The governance problem is not patch failure but service-life reality, where containment and proof become the only durable security model.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “How to Secure Devices That Cannot Be Patched: 10 Compensating Controls for OT, IoMT and End-of-Life Systems”.
Key questions
Q: What breaks when unpatchable OT or IoMT devices are left on flat networks?
A: Flat networks turn a single vulnerable device into a lateral movement path.
Q: Why do unpatchable industrial devices create higher lateral movement risk?
A: They often sit in trusted operational paths and must keep speaking to adjacent systems, historians, or vendor services.
Q: How do security teams decide when to use compensating controls instead of replacement?
A: Use compensating controls when replacement, revalidation, or downtime would break the business or clinical process, and the asset still needs to remain online.
Practitioner guidance
- Inventory by device class and patch status Classify PLCs, imaging systems, medical devices, and end-of-life hosts by function, firmware state, and whether a patch path exists, then maintain that inventory as the basis for control placement.
- Assign each asset to an identity-based segment Create segments around the destinations and protocols the device actually requires, and deny generic east-west access, user VLAN access, and unnecessary internet reachability.
- Broker and record administrative sessions Force remote maintenance through a controlled jump path, time-box the session, record the activity, and retain the record long enough to support incident review and audit proof.
Bottom line: Unpatchable OT and IoMT devices should be governed as persistent exposure zones, not treated as temporary exceptions waiting for a maintenance window.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:23 pm
Compensating controls are now the primary security model for unpatchable assets. In OT and IoMT, the governance question is no longer whether every device can be remediated, but whether the organisation can enforce durable containment around assets that will stay in service for years. That shifts authority from patch management to control design, evidence, and exception discipline. Practitioners should treat containment as the control objective, not as a temporary workaround.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do immediately when an unpatchable device is exposed?
A: Remove unnecessary remote access first, then restrict the device to the smallest possible set of approved destinations and protocols. After that, capture evidence of the enforced policy so the control can be validated during incident review or audit.
👉 Read our full editorial: Compensating controls for unpatchable devices in OT and IoMT