Notifications
Clear all
Topic starter
11/07/2026 1:53 pm
TL;DR: OT security incidents affected 22% of organisations in the past year, and 40% of those incidents caused operational disruption, according to SANS, while Dragos reported 708 ransomware incidents against industrial entities in Q1 2025. The decisive control is identity-based segmentation that contains lateral movement before it reaches production systems.
NHIMG editorial — based on content published by Elisity: 7 Top OT Security Vendors for 2026 [Compared]
By the numbers:
- 22% of organizations experienced a cybersecurity incident affecting their ICS or OT systems in the past year.
- 40% of those incidents caused operational disruption.
- 708 ransomware incidents hitting industrial entities in Q1 2025 alone.
Questions worth separating out
Q: How should security teams segment OT networks without disrupting production?
A: Start with identity-based policy over existing infrastructure, not a forklift redesign.
Q: Why do OT environments need both visibility and enforcement?
A: Visibility tells you what exists and what is happening.
Q: What breaks when OT security relies only on detection tools?
A: The programme can see intrusions but still fail to contain them.
Practitioner guidance
- Separate detection from enforcement in your OT architecture Map which controls only observe and which ones can actually block communication.
- Inventory remote access paths before designing segmentation List every vendor, support, and operator pathway into OT, including temporary and emergency channels.
- Prioritise identity over IP when defining OT policy Build allowlists around device identity, user identity, and workload identity where possible, because OT assets move slowly and network addresses do not capture operational trust relationships.
What's in the full article
Elisity's full guide covers the operational detail this post intentionally leaves for the source:
- Vendor-by-vendor deployment considerations for OT segmentation in brownfield networks
- Analyst comparison tables showing which products map to detection, visibility, or enforcement
- Architectural examples for combining microsegmentation with OT monitoring and incident response
- Implementation notes for teams standardising across IT, OT, and IoT environments
👉 Read Elisity's OT security vendor comparison for 2026 →
OT security vendor comparisons in 2026: what matters most?
Explore further
11/07/2026 2:04 pm
OT segmentation has become the governance control that decides whether intrusion becomes outage. Detection platforms remain essential, but in industrial environments they do not change the attacker’s path. When lateral movement is the stage that matters most, identity-based enforcement is the control that turns observability into containment, and that is the real decision point for OT and IAM teams.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI, according to the same survey, which shows how quickly governance lags behind adoption.
A question worth separating out:
Q: What should organisations do first when building OT zero trust controls?
A: Define the trust boundaries around devices, users, workloads, and remote access paths before choosing tooling. Then align those boundaries with least privilege and segmentation rules. Zero trust in OT is less about broad policy language and more about making allowed communication explicit and enforceable.
👉 Read our full editorial: OT security vendors in 2026: why segmentation decides outcomes
