Topic starter
06/06/2026 11:34 am
TL;DR: Manufacturing IT/OT convergence is widening the attack surface because legacy OT assets, shared accounts, vendor access and poor visibility still block consistent identity control, according to an IDC InfoBrief sponsored by Imprivata. Identity-first governance is now the deciding factor between operational efficiency and a larger blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “IT/OT convergence in manufacturing: Barriers, risks, and what leaders need to know”.
By the numbers:
- 46% cite security concerns as the #1 issue in IT/OT convergence, according to IDC research cited by Imprivata.
- Legacy OT assets are 15+ years old in ~50% of manufacturers, according to IDC research cited by Imprivata.
- Only 30% of manufacturers can deliver real-time data to frontline workers, according to IDC research cited by Imprivata.
Key questions
Q: Why does IT/OT convergence increase identity risk in manufacturing?
A: IT/OT convergence increases identity risk because it connects environments that were never built around the same authentication, authorization or audit model.
Q: Why do shared accounts increase risk in retail and manufacturing systems?
A: Shared accounts increase risk because multiple people use the same credentials across fast handovers, so security teams cannot reliably attribute activity or enforce per-user controls.
Q: How should manufacturers govern third-party access in converged IT/OT environments?
A: Treat vendor access as task-scoped access, not a standing support pathway.
Practitioner guidance
- Map OT systems that cannot enforce modern identity controls Identify PLCs, robotics platforms and plant applications that do not support central authentication or policy inheritance.
- Replace shared credentials with named operator access Move away from generic accounts on shared workstations and plant endpoints.
- Segment third-party access by system and task Limit vendor connectivity to the exact assets and time window needed for maintenance or diagnostics.
Bottom line: Manufacturing IT/OT convergence creates identity risk when old OT systems, shared accounts and third-party access are connected without a unified governance model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 12:27 pm
Identity fragmentation is the real convergence risk. IT/OT convergence does not fail because systems connect. It fails because identity control remains split between enterprise governance and plant-floor exception handling. When access policy differs by environment, security teams lose a single source of truth for who can enter, what they can do and when that permission ends. The practical conclusion is that convergence requires one governed identity model, not two loosely coupled ones.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What does identity-driven access control change for manufacturing security teams?
A: It shifts convergence from a networking question to a governance question. Security teams must decide how access is issued, reviewed, monitored and revoked across IT, OT and third parties, rather than assuming one corporate IAM model can simply be extended everywhere without adjustment.
👉 Read our full editorial: IT/OT convergence is exposing identity gaps in manufacturing