Topic starter
11/07/2026 8:42 pm
TL;DR: Energy organisations are using zero trust network access to replace broad VPN access with dynamic, least-privilege connections as IT and OT converge, remote work expands, and legacy systems remain exposed, according to Appgate. The security shift matters because identity, device posture, and context now determine who can reach critical systems, not network location.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Insights from the Field: How AppGate ZTNA Empowers the Energy Sector”.
Key questions
Q: What fails when energy teams keep broad VPN access in converged IT and OT environments?
A: Broad VPN access fails because it treats network membership as proof of trust, which is too coarse for environments where contractors, remote staff and operational systems share access paths.
Q: Why does zero trust reduce risk in energy remote access programmes?
A: Zero trust reduces risk because it shifts the access decision from location to verified identity, device posture and policy context.
Q: What are the signs that access controls are too permissive in IT and OT?
A: Common signs include one remote connection reaching multiple systems, contractors using the same pathway as internal staff, and legacy assets remaining reachable from general enterprise networks.
Practitioner guidance
- Map remote access paths to critical IT and OT resources Inventory every workforce, contractor and vendor path into energy systems, then identify where a single connection currently reaches multiple systems that should be isolated.
- Enforce device posture checks before session creation Require managed, compliant endpoints for access to sensitive operational resources, and block sessions from unsecured or unknown devices even when credentials are valid.
- Replace broad VPN reach with resource-scoped policies Define access by named application or system rather than by subnet or network zone so that authenticated users only see the resources required for their role.
Bottom line: Energy security teams can no longer rely on VPNs and flat network trust when IT, OT, remote work and third parties all share the same access surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:09 pm
Zero trust is now an access governance model for converged operations, not just a network architecture. The article shows why energy organisations cannot rely on perimeter controls when IT, OT, remote workforce access and third-party connectivity all overlap. The security question is no longer whether a user is on the right network, but whether the current request deserves any reach at all. For identity teams, that makes policy precision the control that matters.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should energy organisations balance compliance and least privilege?
A: Compliance and least privilege work best when auditability is built into the access model, not bolted on afterwards. Energy teams should tie access to identity, device trust and resource scope so they can prove who reached what, while still limiting exposure for remote staff and third parties.
👉 Read our full editorial: Zero trust access is redefining energy security across IT and OT