How does IT-OT convergence change attack paths in critical infrastructure?

How convergence changes the attack path, not just the architecture

IT-OT convergence removes the old assumption that plant networks are isolated by default. Once business identity, remote access and operational networks are tied together, an attacker no longer needs to target the control environment first, because compromise of email, VPN, federated access or a third-party foothold can become a bridge into engineering and production systems.

That shift matters because the path becomes less about one high-value jump and more about chaining smaller, ordinary-access pathways. A weakly governed account, a reused credential, or a permissive remote session can become the first step in a route that reaches historians, engineering workstations, HMI servers and, in some environments, control logic itself.

Where the new choke points appear

Convergence usually creates a few repeatable choke points: shared authentication between IT and OT, remote administration channels, jump hosts, historians, engineering workstations and supplier access. Those points are useful for operations, but they also become the places where an attacker can pivot, enumerate assets, harvest credentials or move laterally if segmentation and role boundaries are weak.

Flat or semi-flat network design is especially dangerous in converged environments because the attacker does not need to “break out” of a well-built zone model. Instead, they can abuse legitimate trust relationships, over-broad service accounts or shared admin tooling to move from enterprise systems into operational assets with minimal noise.

Identity Attack Paths Guide is useful here because converged environments are best understood as path problems, not just perimeter problems, and the same thinking helps teams identify where trust edges should be broken.

Why identity and segmentation now shape the blast radius

In a converged environment, identity becomes part of the network boundary. If the same authentication path unlocks office systems, remote support tooling and OT-adjacent administration, then a single compromised account can carry disproportionate reach. The practical risk is not only unauthorized access, but also the reuse of that access across systems that were never meant to share the same trust level.

Segmentation still matters, but it has to be paired with access governance. Convergence often exposes a mismatch between network zoning on paper and actual operator behaviour in production, such as shared accounts, emergency access, vendor tunnels and exceptions that last longer than intended. Those exceptions are where attack paths tend to survive.

Critical Infrastructure Identity Security Guide helps frame the access controls that matter most when remote access, privileged identity and supplier pathways span both enterprise and plant environments.

OT and ICS Identity and Access Guide is also relevant because the main attack-path change in convergence is that shared accounts, vendor access and segmentation failures turn identity into a lateral movement mechanism.

How defenders should think about exposure in practice

Defenders should assume that the attacker will follow the easiest legitimate route, not the most dramatic one. In converged environments that usually means starting with the weakest externally reachable control, then collecting credentials, abusing remote support, or using a trusted management path to reach engineering assets that were previously outside the enterprise attack graph.

The defensive question is therefore not only “Can the OT network be reached?” but “Which identities, sessions and pathways can be abused to make that reach look legitimate?” That is why exposure management, attack-path analysis and OT-aware segmentation need to be evaluated together rather than as separate projects.

Exposure Management Maturity Model is a good fit for this problem because converged environments need a repeatable way to discover, prioritise and reduce reachable paths, not just close individual vulnerabilities.

Risk and Threat Considerations

IT-OT convergence increases the chance that a compromise in the enterprise layer becomes an operational incident. The danger is not only malware reaching the plant, but also adversaries abusing legitimate identity paths, remote support trust, and weak segmentation to preserve access and move toward systems that affect safety, uptime or process integrity.

Failure mechanism: Shared authentication, over-permissive remote access and weak zone boundaries let an attacker reuse one compromise across multiple trust domains, often without needing exploit development against the OT stack itself.

Impact: The resulting blast radius can include engineering workstations, historians, supervisory systems and production control, with consequences ranging from downtime to unsafe process disruption and recovery complexity.

Practitioner Guidance

What to prioritise: Start with the paths that cross trust boundaries, especially remote access, supplier connectivity and shared admin identity. If a route from enterprise compromise to plant access exists, treat it as a higher-risk condition even if the OT subnet is otherwise segmented.

What to verify: Confirm which identities can reach which assets, through which jump points, and with what level of privilege. If the answer depends on undocumented exceptions, stale accounts or inherited trust from the IT side, the convergence model is already expanding your attack surface.

Practitioner takeaway: In converged environments, the most important control is not simply keeping IT and OT “separate”, but making every cross-domain path explicit, minimal, monitored and removable when it is no longer operationally necessary.

Related resources from NHI Mgmt Group

• Critical infrastructure
• Infrastructure
• How should critical infrastructure teams secure IT and OT convergence without slowing digital transformation?
• How should critical infrastructure teams implement microsegmentation around OT systems?