Topic starter
11/07/2026 8:42 pm
TL;DR: Energy organisations are replacing broad VPN access with zero trust network access as IT and OT converge, remote work expands and legacy systems stay exposed, according to Appgate. Access decisions now depend on identity, device posture and policy context, so network location matters less than request-time verification.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Insights from the Field: How AppGate ZTNA Empowers the Energy Sector”.
Key questions
Q: Why does zero trust reduce risk in energy remote access programmes?
A: Zero trust reduces risk because it shifts the access decision from location to verified identity, device posture and policy context.
Q: What are the signs that access controls are too permissive in IT and OT?
A: Common signs include one remote connection reaching multiple systems, contractors using the same pathway as internal staff, and legacy assets remaining reachable from general enterprise networks.
Q: What fails when energy teams keep broad VPN access in converged IT and OT environments?
A: Broad VPN access fails because it treats network membership as proof of trust, which is too coarse for environments where contractors, remote staff and operational systems share access paths.
Practitioner guidance
- Map remote access paths to critical IT and OT resources Inventory every workforce, contractor and vendor path into energy systems, then identify where a single connection currently reaches multiple systems that should be isolated.
- Enforce device posture checks before session creation Require managed, compliant endpoints for access to sensitive operational resources, and block sessions from unsecured or unknown devices even when credentials are valid.
- Replace broad VPN reach with resource-scoped policies Define access by named application or system rather than by subnet or network zone so that authenticated users only see the resources required for their role.
Bottom line: Energy security teams can no longer rely on VPNs and flat network trust when IT, OT, remote work and third parties all share the same access surface.
Glossary terms: Zero Trust, Microsegmentation, Context-aware access mapping, IT/OT Convergence
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 47 minutes ago by NHI Mgmt Group
11/07/2026 9:09 pm
Zero trust is now an access governance model for converged operations, not just a network architecture. The article shows why energy organisations cannot rely on perimeter controls when IT, OT, remote workforce access and third-party connectivity all overlap. The security question is no longer whether a user is on the right network, but whether the current request deserves any reach at all. For identity teams, that makes policy precision the control that matters.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should energy organisations balance compliance and least privilege?
A: Compliance and least privilege work best when auditability is built into the access model, not bolted on afterwards. Energy teams should tie access to identity, device trust and resource scope so they can prove who reached what, while still limiting exposure for remote staff and third parties.
👉 Read our full editorial: Zero trust access is redefining energy security across IT and OT