Topic starter
25/06/2026 2:50 pm
TL;DR: Manufacturers integrating IT and OT still cite security as the main barrier, with 46% naming it the top concern, 50% relying on OT assets older than 15 years, and only 15% reporting mature cybersecurity practices, according to IDC InfoBrief sponsored by Imprivata. Legacy access, poor visibility, and misaligned priorities show that convergence fails when identity controls are bolted onto systems that were never designed for shared governance.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Top 5 security concerns for IT/OT integrations”.
By the numbers:
- 46% of manufacturers cite security concerns as the top barrier to IT/OT convergence.
- 50% still rely on OT assets that are 15+ years old.
- Only 15% have mature cybersecurity practices.
Key questions
Q: Where do shared logins fail in IT/OT environments?
A: Shared logins fail when organisations need to prove who performed an action, because the same credential may be used by multiple operators, shifts, or vendors.
Q: Why do legacy OT assets make IT/OT convergence harder to secure?
A: Older OT systems were not designed for modern identity governance, so they often lack individual attribution, central logging, or flexible access controls.
Q: What breaks when IT and OT teams do not align on access policy?
A: When IT prioritises tighter security and OT prioritises uptime, organisations often default to broader access, inconsistent approvals, and exception-driven workarounds.
Practitioner guidance
- Replace shared operator accounts Move plant and support access to individually attributable identities, using badge plus PIN or equivalent methods where legacy systems cannot support modern authentication natively.
- Unify access logging across OT and IT Collect who accessed what, when, and where across operational systems so investigations and reviews have consistent evidence from both environments.
- Extend vendor oversight to operational access Track third-party sessions and contractor pathways separately from internal user access so maintenance and support activity does not blur accountability.
Bottom line: IT/OT convergence fails when identity controls cannot preserve accountability across legacy operational systems and shared workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:00 pm
Shared login environments create an accountability gap, not just an authentication gap. When one credential is used by multiple operators, the governance model can no longer distinguish ownership, timing, or intent. That breaks recertification, auditability, and incident attribution at the same time. The practitioner implication is that identity must remain individually attributable even when operations are shared.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should manufacturers govern third-party access in converged IT/OT environments?
A: Treat vendor access as task-scoped access, not a standing support pathway. Limit it to the specific system, short duration and approved session needed for the job, then monitor activity and remove access when the task ends. This reduces the chance that remote support becomes an uncontrolled route into production.
👉 Read our full editorial: IT/OT convergence exposes old access assumptions in manufacturing