How does IT/OT convergence create lateral movement paths?

Why IT/OT Convergence Creates a Wider Attack Surface

Convergence changes the problem from isolated plant security to shared trust between business systems and operational systems. When the same network paths, identity stores, remote access tools, or jump hosts reach both environments, an intrusion that starts in IT can inherit a route into OT. The core issue is not just connectivity, but whether that connectivity preserves strong separation, authentication, and routing boundaries.

In practice, lateral movement becomes easier when organisations treat IT controls as though they automatically protect OT. Shared administration, flat routing, and dual-use jump infrastructure reduce the number of barriers an attacker must cross. The attack path may begin with phishing, stolen credentials, or a compromised endpoint, then progress through the trust relationships that link office networks to engineering or plant networks.

That is why OT guidance focuses so heavily on architecture and segmentation, not just hardening individual assets. NIST’s OT Security Guide and CISA’s Industrial Control Systems resources both reflect the same practical reality: once IT and OT share too much trust, the defender must assume one compromised path can become many.

How Attackers Turn Shared Paths Into Lateral Movement

Attackers usually do not need a direct exploit against a PLC, HMI, or historian first. They often look for the easiest adjacent path, such as a remote support account, an over-permissive VPN, a trusted admin workstation, or an engineering workstation that can reach multiple zones. Once inside, they probe for credential reuse, cached sessions, shared service accounts, and network rules that allow movement without fresh authorisation.

Remote access is especially important because it can collapse geographic distance into logical access. If a vendor tunnel, jump box, or remote desktop path is trusted too broadly, the attacker may only need to compromise one account or endpoint to inherit access to systems that should have been separate. The problem grows when those paths are also used for routine administration, because normal operational use masks abnormal movement until the attacker reaches a sensitive control asset.

The best way to think about this is as a chain of trust, not a single breach point. Each shared route, permissive firewall rule, or common admin credential reduces the number of steps required to pivot. That is why MITRE ATT&CK Enterprise Matrix remains useful for mapping the movement from initial access to privilege escalation and lateral movement across mixed IT/OT estates.

NHIMG’s OT and ICS Identity and Access Guide is also directly relevant here because it treats segmentation, separate admin paths, and vendor access as access-control problems, not just network design choices.

What Reduces Lateral Movement in a Converged Environment

The most effective reductions come from shrinking trust zones and making movement require explicit approval at each boundary. Separate admin paths for IT and OT, dedicated jump hosts, strict allowlisting, and zone-based routing all raise the cost of pivoting. The goal is not to eliminate connectivity, but to ensure that connectivity is narrow, observable, and purpose-built.

Identity controls matter because convergence often fails through credentials before it fails through malware. If a single account can authenticate to both office systems and control systems, the attacker only has to steal one set of secrets. OT programmes therefore need account separation, strong MFA where feasible, tightly scoped privileged access, and removal of shared administrative credentials wherever practical.

Operational monitoring also has to reflect the mixed environment. A normal IT SOC alert model may miss suspicious movement that is technically “allowed” but operationally unusual, such as an engineering workstation reaching a new subnet or a vendor session touching multiple assets in sequence. In converged environments, the question is not simply whether access succeeded, but whether the access path itself matches the expected operational pattern.

Risk and Threat Considerations

IT/OT convergence creates a blast-radius problem: a compromise that starts in a lower-trust IT zone can become a route to systems that were never meant to share the same exposure. The more the environment depends on shared admin paths, flat routing, or broad remote access, the more likely an attacker can move laterally without triggering a clear boundary event.

Failure mechanism: Weak separation between IT and OT lets stolen credentials, remote access channels, or trusted jump hosts become reusable pivot points, so one foothold can reach multiple operational assets.

Impact: Once an attacker crosses that boundary, they can enumerate assets, interfere with control operations, increase privilege, or stage ransomware and sabotage from inside the operational trust zone.

Practitioner Guidance

What to prioritise: Start with the paths that actually connect IT to OT, not with isolated endpoint hardening. If a route can reach both environments, treat it as a high-value control point and review its users, source hosts, and destination scope first.

What to verify: Confirm that remote access into OT is segmented from general corporate access, that jump hosts are dedicated to the function they serve, and that no shared admin account can traverse zones by default. If the same credential works in both domains, the environment is already assuming too much trust.

Decision rule: If you cannot explain why a given workstation, VPN profile, or admin path needs to reach a control asset, remove that path or constrain it until the business need is explicit. In converged environments, convenience is often the hidden cause of lateral movement.

Practitioner takeaway: The safest convergence model is one where IT and OT can exchange only the minimum necessary traffic, and every privileged path is narrow enough that a single compromise cannot become a full cross-domain pivot.

Related resources from NHI Mgmt Group

• IT/OT Convergence
• Why does the convergence of IT and OT increase lateral movement risk in industrial networks?
• Why do connected OT environments create more lateral movement risk?
• Why do trusted OT admin paths increase lateral movement risk?