Topic starter
11/11/2026 6:00 pm
TL;DR: Only 5.7% of organisations have full visibility into their service accounts, according to Crytica Security's survey evidence on operational blind spots. OT and IoT security programmes need controls that verify device state and alert locally, because remote telemetry can be spoofed or interrupted.
Editorial analysis by NHI Mgmt Group, based on content published by Crytica Security: “3 Cybersecurity Blind Spots Putting You at Risk”.
Key questions
Q: Why does a single monitoring agent create a bigger OT risk?
A: A single monitoring agent creates a bigger OT risk because one failure, compromise, or outage can blind visibility across many assets at once.
Q: What should teams do first when OT alerts depend on back-end review?
A: Teams should first map which OT alerts require back-end connectivity for analysis, then decide whether those checks can run locally at the edge instead.
Q: How do OT security tools fail when devices can falsify telemetry?
A: OT security tools fail when they rely on logs, traffic, or self-reported status that a compromised device can manipulate.
Practitioner guidance
- Map monitoring trust boundaries to device reality Identify where your OT stack relies on logs, traffic, or device self-reporting instead of direct verification, then classify those paths as inference-based rather than authoritative.
- Separate detection components across the environment Avoid concentrating all visibility and response logic on one device or one agent, because a single compromise can remove the control plane and the evidence stream at the same time.
- Test local alerting without back-end connectivity Simulate loss of cloud, SOC, or review-system access and confirm that the control still detects, alerts, and supports containment in segmented OT networks.
Bottom line: OT blind spots persist when defenders rely on indirect evidence that compromised devices can fake or suppress.
Glossary terms: Operational Technology, Device-Level Telemetry, Distributed Detection Architecture, Hunter-Killer Malware
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
OT visibility is a control problem, not a tooling preference. External telemetry, logs, and self-reported status are all second-order evidence, so they fail when a compromised device can lie. In OT, that means defenders need assurance that does not depend on the device’s cooperation. Practitioners should treat inside-the-device verification as the baseline for critical assets.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can embedded probes improve visibility in IoT and OT systems?
A: Embedded probes improve visibility by collecting local telemetry from devices and controllers rather than relying only on central polling. By observing execution and integrity, they can capture process state, command paths, and tamper signals closer to the asset, which helps detect drift, unauthorised changes, and short-lived attacks in IoT and OT environments.
👉 Read our full editorial: Malware can hide OT blind spots from remote monitoring tools