Topic starter
12/07/2026 12:18 pm
TL;DR: OT teams are facing a security transformation deficit as IT/OT convergence, hybrid environments, and legacy industrial systems expand the attack surface, with 58% of organisations hit by cyberattacks reporting operational stoppages, according to Illumio. Static perimeters and air-gapped assumptions no longer match modern OT reality, making continuous validation and segmentation the practical baseline.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “How Illumio + Armis Secure Modern OT Environments”.
By the numbers:
- 58% of organisations hit by a cyberattack in the last year reported having to halt operations.
- 40% of organisations losing a significant amount of revenue after an attack.
- 35% of organisations experiencing brand damage after an attack.
Key questions
Q: What breaks when air-gapped assumptions no longer match OT reality?
A: Air-gapped assumptions fail when industrial environments connect to cloud services, gateways, and enterprise systems that share data and control paths.
Q: Why do legacy OT perimeters increase lateral movement risk?
A: Legacy OT perimeters assume that internal network location is a proxy for trust.
Q: How do teams know whether IT/OT segmentation is actually working?
A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations.
Practitioner guidance
- Map real OT communication paths Document traffic between SCADA, DCS, MES, ERP, gateways, and remote access paths before changing control design.
- Replace implicit trust with task-scoped access Require validation for every user, device, and workload that touches OT-adjacent services, and limit access to the minimum pathway needed for the task.
- Use agentless controls for fragile assets Avoid endpoint agents on PLCs, RTUs, and controllers that could be destabilized by software changes.
Bottom line: Modern OT environments are no longer protected by air gaps and static perimeters once IT, cloud, IoT, and industrial systems converge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:32 pm
Zero trust has become an OT governance requirement, not a design preference. Once industrial operations depend on hybrid connectivity, air gaps and static perimeters stop functioning as real trust boundaries. The governance problem is no longer whether OT should be connected, but how access is constrained when it is. Practitioners should treat continuous validation and segmentation as baseline controls for modern industrial identity and access management.
A question worth separating out:
Q: When should organisations prioritise Zero Trust for OT over perimeter upgrades?
A: Organisations should prioritise Zero Trust when OT access is still mediated by persistent tunnels, shared paths, or third-party connections. Perimeter upgrades do not fix broad trust once an attacker is inside. If the goal is to reduce blast radius without disrupting operations, explicit access policy and segmentation should come before another VPN refresh.
👉 Read our full editorial: Zero trust for OT environments is now an operational need