Topic starter
10/07/2026 9:09 pm
TL;DR: Industrial environments now depend on remote access, but VPN-centric trust still exposes broad network reach in systems built for reliability and flat connectivity, according to Appgate. Identity-based Zero Trust changes the access layer without re-architecting the plant, and network-level trust is no longer a safe assumption for OT security.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Securing Industrial OT Access Without Disrupting Operations”.
Key questions
Q: What breaks when VPN-based remote access is the default for OT?
A: VPN-based access often grants broader network reach than the task requires, which expands the attack surface and makes lateral movement easier.
Q: Why does identity-based Zero Trust reduce OT lateral movement risk?
A: It reduces risk because access is granted to specific resources instead of the whole network.
Q: How do security teams know VPN access is too broad for OT?
A: The warning signs are broad network visibility after login, shared access paths for multiple roles, and remote sessions that can browse systems unrelated to the current task.
Practitioner guidance
- Map remote OT access to explicit resources Replace subnet-wide VPN access with resource-scoped authorization so each role reaches only the systems, ports, and services needed for the task.
- Separate third-party vendor access from operator access Define different policy paths for vendors, contractors, and internal engineers so vendor maintenance does not inherit broad visibility into production networks.
- Create identity-defined micro-perimeters around critical systems Bind access decisions to user identity, device posture, and context, then hide non-authorized OT assets from remote sessions.
Bottom line: VPN-based remote access still embeds network trust into OT environments, which can widen exposure after authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
VPN trust is now a governance failure, not just an access design choice. OT environments were never built for broad network exposure after authentication, yet that is exactly what VPN-centric remote access still does. When the environment is flat or only lightly segmented, the trust boundary moves from the task to the tunnel. Practitioners should treat the access model as a control plane decision, not a connectivity convenience.
A question worth separating out:
Q: Should organisations keep VPNs or move to identity-based OT access?
A: Organisations should move remote OT access toward identity-based controls when the current VPN model creates broad reach across flat or lightly segmented networks. VPNs may still encrypt traffic, but they do not solve the governance problem of who can reach which industrial resource. The decision is about containment, not connectivity alone.
👉 Read our full editorial: Why identity-based Zero Trust is replacing VPNs in OT access