How should organisations contain OT sabotage without shutting down production?

Containing OT sabotage while keeping the plant running

Containment in OT is about shrinking the attacker’s reach, not freezing the whole environment. The response has to cut off external access, stop the specific compromised sessions or accounts, and isolate the affected path without breaking the control loops and operator processes that keep production safe. That is why preplanned segmentation and controlled access termination matter more than improvisation during an incident.

In practice, the containment boundary should be built around what the attacker can reach, not around the entire site. If you can separate operator interfaces, remote access paths, and supervisory layers from the production process, you can often preserve operations while removing the attacker’s ability to move laterally or trigger destructive actions.

Where the response depends on identity and privilege controls, the Schneider Electric Jira breach is a useful reminder that stolen credentials and exposed access paths can become the entry point for broader industrial impact. The containment lesson is to assume that a valid account can be as dangerous as malware if it still has live reach into operational systems.

Why segmentation is the real control boundary in OT

OT sabotage becomes hard to contain when the network is flattened, remote administration is overbroad, or engineering and operations paths are shared more than they should be. Segmentation is not just a routing choice; it is the mechanism that lets defenders block hostile movement while leaving local control intact. Without that boundary, even a narrow compromise can expand into multiple plant functions.

This is also where privileged session control becomes essential. If the attacker is using a remote admin path, the response should target that session first, because it may be the shortest route from compromise to destructive action. Terminating the session, revoking access, and forcing reauthentication can buy time without requiring a full shutdown.

For OT architecture and segmentation baselines, NIST SP 800-82 Rev 3 is the most direct reference, and CISA Industrial Control Systems resources help teams align containment actions with critical infrastructure realities.

What to preserve, and what to cut, during an OT incident

The practical decision is not “keep everything up” or “stop everything.” It is which access paths, accounts, and remote tools can be removed immediately without affecting safe production. The safest sequence usually starts with external access termination, then compromised account suspension, then isolation of the affected segment, then verification that local operations remain stable.

Teams should distinguish between control-plane access and process-plane operation. If the attacker has reach into the supervisory or remote maintenance layer, that path can often be severed while the underlying plant logic continues to run. If the compromise is inside the control path itself, containment must be more conservative and coordinated with operators who understand the process dependencies.

Practitioner guidance: Build incident playbooks around reachability, not just severity. A contained OT compromise is one where the attacker’s path is removed faster than the process can be destabilised, and that usually depends on knowing in advance which sessions, accounts, jump hosts, and remote channels can be cut safely.

What to verify: Before you trust containment, confirm that the affected segment is actually isolated, that the suspended identity cannot reconnect through an alternate path, and that plant monitoring still has visibility into the remaining production estate.

Decision rule: If a control action would interrupt production, prefer targeted account suspension, session termination, and network isolation over broad system shutdown. If you cannot prove the blast radius, escalate to the safer operational boundary rather than guessing.

Practitioner takeaway: In OT, containment succeeds when defenders can remove attacker control without removing process control. The best response plan is one that preserves production by design, because waiting until the incident starts is too late to invent safe segmentation.

Related resources from NHI Mgmt Group

• How should organisations secure shared workstations without slowing production down?
• How should organisations monitor LLM outputs to reduce bias and misinformation without slowing down production use cases?
• What breaks when organisations try to contain a compromised session by shutting down systems?
• How should organisations govern external sharing in SharePoint Online without shutting down collaboration?