Topic starter
11/07/2026 8:27 pm
TL;DR: VPNs and static perimeters over-provision access and leave persistent tunnels open in OT, Appgate says. Legacy operations then inherit broad trust that is hard to confine to the task at hand.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Zero Trust for Operational Technology: A Practical Path Forward”.
Key questions
Q: Why do VPNs and static perimeters create risk in OT networks?
A: They create risk because they optimise for connectivity, not authorisation.
Q: How do organisations know if zero trust controls are actually working?
A: They know the controls are working when they can inventory privileged identities, prove access is time-bound, and show that rotation and revocation happen on schedule.
Q: What breaks when VPN-based remote access is the default for OT?
A: VPN-based access often grants broader network reach than the task requires, which expands the attack surface and makes lateral movement easier.
Practitioner guidance
- Define OT access around tasks, not tunnels Replace broad VPN reach with access rules tied to a specific user, device, workflow, and time-bounded maintenance window.
- Segment OT by protocol and asset criticality Build policy around industrial protocol behaviour and critical assets so BACnet, Modbus, and similar traffic only reaches approved endpoints.
- Use monitor-before-enforce for policy changes Run policy simulations before blocking traffic so you can identify hidden dependencies, remote support paths, and safety impacts.
Bottom line: OT environments need Zero Trust designs that understand identity, protocol behaviour, and operational constraints rather than assuming enterprise perimeter logic will transfer cleanly.
Glossary terms: Identity-Aware Enforcement, Protocol-aware segmentation, Monitor-before-enforce, Over-Provisioned Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 13 hours ago by NHI Mgmt Group
11/07/2026 8:57 pm
OT Zero Trust fails when identity is treated as an overlay instead of the control plane. In operational environments, the main problem is not simply network reachability, but who is allowed to reach which device, under what workflow, and with what operational context. The article makes clear that VPN-style access models are too coarse for that job. Practitioners should treat identity-aware enforcement as the core of OT Zero Trust, not an add-on.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: When should organisations move from perimeter security to identity-aware access in OT?
A: They should move when remote access, third-party support, or mixed legacy protocols make broad trust zones too risky to defend. The tipping point is usually when static perimeters no longer match how work is actually performed, especially across plants, facilities, and vendors. At that stage, identity-aware access becomes a governance requirement, not an optional enhancement.
👉 Read our full editorial: Zero trust for OT security needs identity-aware enforcement