Notifications
Clear all
Topic starter
24/06/2026 6:58 pm
TL;DR: OT environments are stretching across production systems, industrial networks, robotics, edge systems, cloud platforms, and modern applications, while static firewall rules, VLANs, IP addresses, and manual policy updates are increasingly brittle, according to Corsha. The governance shift is toward identity-driven verification for machine-to-machine communication, where access is continuously checked before traffic is allowed.
NHIMG editorial — based on content published by Corsha: INFOGRAPHIC: Modernize OT Segmentation and Access
Questions worth separating out
Q: What breaks when OT segmentation depends on static network rules?
A: Static OT segmentation breaks when network location is no longer a reliable proxy for trust.
Q: Why does machine identity matter more in connected OT environments?
A: Machine identity matters because OT access decisions increasingly need to answer who or what is communicating, not just where the traffic came from.
Q: How do teams know if OT segmentation is still working?
A: OT segmentation is working only if access decisions remain accurate when systems move, scale, or connect to new platforms.
Practitioner guidance
- Map machine communication to identity, not just subnet Inventory the systems that exchange OT traffic and document which connections are currently allowed only because they share a network segment or IP range.
- Review static firewall and VLAN dependencies Identify where segmentation still depends on manual policy updates, brittle allowlists, or fixed topology assumptions.
- Introduce continuous verification for machine-to-machine access Require a verification step before communication is allowed, especially for connections that bridge legacy OT systems and modern applications.
What's in the full article
Corsha's full article covers the operational detail this post intentionally leaves for the source:
- A closer look at the infographic's traditional segmentation model, including the specific differences between firewall, VLAN, and identity-driven policy.
- The operational use cases behind Corsha's OT access model for machine-to-machine communication across legacy and modern systems.
- How the approach supports Zero Trust principles in environments where production stability and change control are operational constraints.
- The vendor's own framing of how identity-driven controls are intended to reduce disruption while modernising OT segmentation.
👉 Read Corsha's infographic on modernising OT segmentation and access →
OT segmentation and machine identity: are static rules enough?
Explore further
25/06/2026 4:01 am
Static OT segmentation is now an assumption problem, not just a control problem. The old model assumes that network location is a reliable proxy for trust, but that assumption fails when production, robotics, edge, and cloud systems all exchange traffic dynamically. Corsha's framing shows why OT security can no longer rely on firewall shape alone. Practitioners should treat identity as the trust primitive for machine communication.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: Who should own identity-driven access decisions in OT?
A: Ownership should be shared across OT security, IAM, and platform teams because machine communication policy spans network behaviour, identity assurance, and operational uptime. If those decisions sit only with network teams, identity governance is usually too weak to handle modern machine-to-machine access safely.
👉 Read our full editorial: Identity-driven OT segmentation is replacing static firewall controls
