Topic starter
25/06/2026 2:50 pm
TL;DR: Shared logins, 15-plus-year-old OT assets and weak cybersecurity maturity make accountability hard to sustain in converged plants, according to Imprivata. Access governance now has to preserve attribution and visibility without slowing operational work.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Top 5 security concerns for IT/OT integrations”.
By the numbers:
- 46% of manufacturers cite security concerns as the top barrier to IT/OT convergence.
- 50% still rely on OT assets that are 15+ years old.
- Only 15% have mature cybersecurity practices.
Key questions
Q: Why do legacy OT assets make IT/OT convergence harder to secure?
A: Older OT systems were not designed for modern identity governance, so they often lack individual attribution, central logging, or flexible access controls.
Q: What breaks when IT and OT teams do not align on access policy?
A: When IT prioritises tighter security and OT prioritises uptime, organisations often default to broader access, inconsistent approvals, and exception-driven workarounds.
Q: Where do shared logins fail in IT/OT environments?
A: Shared logins fail when organisations need to prove who performed an action, because the same credential may be used by multiple operators, shifts, or vendors.
Practitioner guidance
- Replace shared operator accounts Move plant and support access to individually attributable identities, using badge plus PIN or equivalent methods where legacy systems cannot support modern authentication natively.
- Unify access logging across OT and IT Collect who accessed what, when, and where across operational systems so investigations and reviews have consistent evidence from both environments.
- Extend vendor oversight to operational access Track third-party sessions and contractor pathways separately from internal user access so maintenance and support activity does not blur accountability.
Bottom line: IT/OT convergence fails when identity controls cannot preserve accountability across legacy operational systems and shared workflows.
Glossary terms: IT/OT Convergence, Shared login, Access Visibility, Least Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 4:00 pm
Shared login environments create an accountability gap, not just an authentication gap. When one credential is used by multiple operators, the governance model can no longer distinguish ownership, timing, or intent. That breaks recertification, auditability, and incident attribution at the same time. The practitioner implication is that identity must remain individually attributable even when operations are shared.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should manufacturers govern third-party access in converged IT/OT environments?
A: Treat vendor access as task-scoped access, not a standing support pathway. Limit it to the specific system, short duration and approved session needed for the job, then monitor activity and remove access when the task ends. This reduces the chance that remote support becomes an uncontrolled route into production.
👉 Read our full editorial: IT/OT convergence exposes old access assumptions in manufacturing