Topic starter
12/06/2026 12:18 am
TL;DR: As OT and IT boundaries dissolve, identity becomes the control plane and the weakest link because legacy OT systems, orphaned accounts, excessive privilege, and unreliable manual reviews leave access difficult to see and govern, according to Gathid. The problem is not integration itself but the assumption that IT IAM models can be retrofitted into disconnected operational environments without creating new risk.
Editorial analysis by NHI Mgmt Group, based on content published by Gathid: “What CISOs Need to Know About Identity Governance Across OT and IT”.
Key questions
Q: What breaks when IT IAM is extended into OT without redesigning the model?
A: The model breaks when it assumes OT can behave like IT.
Q: Why do legacy OT systems create more identity risk than standard IT environments?
A: Legacy OT environments often rely on local admin accounts, vendor-owned software, and disconnected networks, which makes normal IAM visibility incomplete.
Q: How can security teams tell whether identity governance is working in a utility?
A: Look for evidence that access reviews are completed on schedule, stale access is removed quickly, and entitlement history is traceable across cloud, hybrid, and legacy systems.
Practitioner guidance
- Inventory the full identity landscape Map employees, contractors, third parties, service accounts, and machine users across OT and IT systems, including any local admin accounts that never touch central IAM.
- Build a unified identity model Create a continuously updated access map that represents disconnected OT systems, ownership, roles, and permissions even when direct integration is impractical.
- Use relationship analysis to uncover toxic access Model how identities connect to sensitive systems so you can find privilege creep, conflicting roles, and ownerless service accounts before they become operational risk.
Bottom line: OT and IT convergence changes identity governance from a directory problem into a cross-environment evidence problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:27 am
OT and IT convergence creates an identity governance boundary problem, not just an integration problem. The article shows that the real challenge is fitting modern identity controls into environments that were never designed for centralised governance. That is why visibility, auditability, and privilege decisions become harder at the exact moment operational dependency increases. Practitioners should treat convergence as a change in governance model, not only architecture.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations balance OT access control with operational continuity?
A: Use governance methods that observe and model access without forcing invasive changes into production networks. The practical balance is to improve visibility and least privilege while avoiding controls that require downtime, constant protocol support, or architecture changes that increase operational risk.
👉 Read our full editorial: OT and IT convergence exposes a new identity governance gap
This post was modified 1 day ago by NHI Mgmt Group