Topic starter
11/07/2026 1:53 pm
TL;DR: 22% of organisations saw an ICS or OT incident in the past year, and 40% caused disruption, according to Elisity's survey. OT networks need containment controls that stop lateral movement before production systems are reached.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “7 Top OT Security Vendors for 2026 [Compared]”.
By the numbers:
- 22% of organisations experienced a cybersecurity incident affecting their ICS or OT systems in the past year.
- 708 ransomware incidents hit industrial entities in Q1 2025 alone, according to Dragos.
Key questions
Q: Why does lateral movement matter so much in industrial environments?
A: Lateral movement is the stage that turns a foothold into operational impact.
Q: What are the signs that an OT segmentation model is too weak?
A: Common warning signs include flat network trust, unmanaged assets sharing the same communication paths as critical controllers, and remote access tools that can reach too many segments.
Q: What fails when OT security relies on detection without enforcement?
A: Detection-only OT programmes can tell you that suspicious traffic exists, but they do not prevent that traffic from reaching production systems.
Practitioner guidance
- Map OT trust zones to actual communication paths Inventory which users, workloads, and devices genuinely need to talk to each other, then translate those flows into enforceable zone and conduit rules across IT and OT.
- Prioritise east-west containment over alert volume Use segmentation to stop lateral movement between plant segments, while keeping detection focused on correlation, investigation, and response rather than containment claims.
- Test enforcement on existing switching infrastructure Validate that segmentation policy can be applied without new inline hardware, agents, or a production shutdown, because brownfield OT cannot tolerate heavy redesign.
Bottom line: OT environments remain exposed because internal trust often allows attackers to move laterally after the first foothold.
Glossary terms: Identity-based Microsegmentation, Lateral Movement, Zones And Conduits, Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
11/07/2026 2:04 pm
Detection is not the same as containment: OT security programmes still too often treat visibility as if it were a control outcome. That works for triage, but not for stopping east-west movement once an intrusion is inside an industrial network. The governance implication is simple: if the programme cannot constrain communication paths, it cannot claim blast-radius control.
A question worth separating out:
Q: What is the difference between OT monitoring and OT enforcement?
A: OT monitoring observes traffic and flags anomalies. OT enforcement decides what is allowed to communicate and blocks the rest. Monitoring is essential for visibility, but enforcement is what contains blast radius. Mature programmes need both, because one tells you what happened and the other stops it from spreading.
👉 Read our full editorial: OT security vendors in 2026: why segmentation decides outcomes