Topic starter
25/10/2026 11:01 am
TL;DR: OT segmentation can leave the plant boundary exposed when VPNs, shared vendor accounts and remote tools are still loosely governed, Forescout says. OT access needs identity-aware entry and session control so operators can limit who gets in and what they can reach.
Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “Segmentation and Identity: The Two Halves of Zero Trust in OT”.
Key questions
Q: Why do remote access paths create more risk than network zones in OT?
A: Remote access paths define who enters, what they can reach and how much accountability exists once the session starts.
Q: What are the signs that remote access to OT controllers is being misapplied?
A: Look for management interfaces that are internet-facing, contractor connections that are not documented, sessions from sources outside the approved allowlist, bulk setpoint or defrost changes across many devices, and controllers still running plain HTTP management access.
Q: What breaks when zero trust segmentation is applied without device context?
A: Security teams often block legitimate communications because they cannot see the dependencies behind a device’s normal operation.
Practitioner guidance
- Map every remote access path Inventory VPNs, remote desktop tools, vendor portals, jump hosts, modem links and embedded vendor accounts before trying to tighten policy.
- Bind OT access to named identities Require per-user authentication, role-based authorization and session-scoped connectivity for any person or third party reaching critical assets.
- Separate entry control from movement control Use identity-aware access to manage who enters and segmentation to constrain what they can reach after entry.
Bottom line: OT segmentation reduces lateral movement, but it does not solve the identity and access problem at the plant boundary.
Glossary terms: North-south access, East-West Segmentation, Identity-Aware Access, Session-scoped connectivity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
OT zero trust is an identity problem before it is a segmentation problem. Segmentation matters, but it only contains movement after access already exists. In industrial environments, the higher-order control is deciding who may enter, by what path, and under what session terms. Practitioners should stop treating network zoning as the primary trust boundary and start treating remote access governance as the first control surface.
A few things that frame the scale:
- 74% of organizations report identity-related breaches, and privileged access is a leading cause of lateral movement.
A question worth separating out:
Q: Should OT teams replace VPNs or keep them alongside segmentation?
A: VPNs can remain part of a transition plan, but they should not be the governance model. If a VPN extends broad trust into the plant, it should be replaced or tightly constrained by identity-aware access, per-session authorization and segmentation that limits post-entry movement.
👉 Read our full editorial: Micro-segmentation alone leaves OT zero trust incomplete
This post was modified 7 days ago by NHI Mgmt Group