Topic starter
30/07/2026 11:21 pm
TL;DR: Water utilities evaluating OT segmentation are being asked to compare seven approaches, 14 vendor questions, and a proof-of-value protocol that prices licensing, prerequisites, and staff effort against real site conditions, according to Elisity. The deciding issue is no longer whether segmentation is worthwhile, but whether a chosen method can enforce reliably across mixed OT assets and remote sites.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Water Utility OT Security: How to Evaluate Segmentation Approaches, Vendors, and a Proof of Value”.
Key questions
Q: What breaks when OT segmentation only covers part of a water utility estate?
A: Partial coverage creates a governance gap, not just a technical one.
Q: Why does OT segmentation in water utilities need to be evaluated site by site?
A: Because enforcement depends on local conditions such as firmware, network gear, topology, remote connectivity, and whether the asset can support an agent or admission control.
Q: How do teams know whether IT/OT segmentation is actually working?
A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations.
Practitioner guidance
- Define enforcement by site, not by product Build your evaluation around the exact plants, pump stations, lift stations, and tank sites you run.
- Require simulated policy before enforcement Do not accept a live cutover as the first proof.
- Price the full operational burden Compare three-year cost across licensing, hardware, support, integration work, and the staff time needed to maintain rules across multiple sites.
Bottom line: OT segmentation in water utilities fails when enforcement does not reach the devices and sites that actually carry operational risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:24 pm
OT segmentation is a control-selection problem, not a category choice. The article shows that utilities do not need another abstract debate about whether segmentation is worthwhile. They need to know which enforcement model can survive embedded devices, remote backhaul, and mixed plant architecture. That is a procurement discipline problem as much as a security one, and the winning control is the one that matches operational reality rather than the cleanest diagram.
A question worth separating out:
Q: Should utilities prioritise enforcement coverage or lower licensing cost when buying segmentation?
A: Coverage comes first when the goal is risk reduction. A lower-cost option that cannot govern remote sites, embedded devices, or mixed plant assets leaves the most exposed parts of the estate untouched, while a more expensive control that actually enforces can replace hidden operational risk with measurable containment.
👉 Read our full editorial: Water utility OT segmentation evaluation: what teams should ask