Topic starter
10/06/2026 11:39 pm
TL;DR: Industrial IT/OT convergence is creating a single identity problem across air-gapped environments, siloed data structures, and toxic role combinations that can leave critical systems overexposed, according to Gathid. Identity governance now has to reconcile operational safety, compliance, and access visibility across both physical and digital systems.
Editorial analysis by NHI Mgmt Group, based on content published by Gathid: “Bridging OT and IT: Identity Governance Solutions for Industrial Companies”.
Key questions
Q: How should industrial firms govern access across IT and OT systems?
A: They should govern effective access across both environments as one model, even if the systems stay separate operationally.
Q: Why do toxic role combinations matter in converged environments?
A: They matter because access that is safe in one domain can become dangerous when combined with another domain’s privileges.
Q: What are the signs that cross-domain identity governance is failing in industrial firms?
A: The warning signs are fragmented identity records, inconsistent role definitions, and review processes that never evaluate OT and IT access together.
Practitioner guidance
- Map OT and IT identity sources into one governance view Inventory the identity repositories, approval paths, and role models that exist separately in industrial and enterprise environments, then reconcile them into one access catalogue for review.
- Identify toxic role combinations across domains Review users who hold both operational and administrative access and test whether the combined permissions create an unacceptable path to critical systems.
- Align recertification to cross-domain access paths Run access reviews on the full access chain, including physical security, OT engineering, and IT entitlements, so domain-specific approvals do not hide aggregate risk.
Bottom line: Industrial convergence turns identity governance into a cross-domain problem because OT and IT controls were never designed to share the same access model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 5:56 am
IT/OT convergence creates an identity governance problem before it creates a technology integration problem. The article shows that industrial firms are not only linking systems, they are merging control domains that were previously governed differently. That changes the unit of analysis from a single application or plant network to a shared access estate. Practitioners should treat convergence as an identity architecture issue, not a reporting issue.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What is the difference between a knowledge graph and a digital twin in identity governance for AI?
A: A knowledge graph provides the connected view of identities, roles, systems, and permissions, so teams can see where access risk exists. A digital twin simulates those policies and access paths in a safe environment before changes go live. Used together, they support both visibility and testing, which is essential when AI needs access across multiple business functions.
👉 Read our full editorial: IT/OT convergence exposes identity governance gaps in industrial firms
This post was modified 1 day ago by NHI Mgmt Group