OT identity security: are your controls keeping up across legacy sites?

TL;DR: Critical infrastructure identity security is harder because OT combines legacy assets, shared accounts, intermittent connectivity, and privileged access that must work without disrupting operations, making offline-capable IAM and PAM essential for accountability and least privilege, according to Xage Security. The real test is whether governance can preserve segmentation, attribution, and temporary access when the network or device cannot support modern identity controls.

Editorial analysis by NHI Mgmt Group, based on content published by Xage Security: “5 OT Identity and Access Management Security Challenges”.

By the numbers:

• Credential-based attacks accounted for 80% of initial-access cases involving access brokers, according to Microsoft’s 2025 Digital Defense Report.

Key questions

Q: What breaks when OT privileged access is left in shared accounts and exceptions?

A: What breaks is accountability.

Q: Why do legacy OT assets make modern IAM controls harder to apply?

A: Legacy OT assets often cannot support modern authentication methods, agents, or directory integration.

Q: How should organisations prioritise JIT access over standing privileged access in OT?

A: Organisations should prioritise just-in-time access whenever elevation is tied to a specific task or maintenance window.

Practitioner guidance

• Map OT access paths by identity domain Document which users, vendors, controllers, and services authenticate through each OT, IT, DMZ, and cloud path before rationalising controls.
• Broker access for legacy assets Place an identity-aware access layer in front of devices that cannot support modern authentication, then enforce MFA, command scoping, and session logging at the gateway.
• Convert standing elevation to JIT access Tie privileged OT access to approved tasks, set explicit expiry, and remove dormant vendor and contractor elevation automatically when work is complete.

Bottom line: OT identity security fails when legacy assets, shared credentials, and intermittent connectivity are treated as edge cases instead of design constraints.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →