How should security teams improve IoT device visibility in segmented OT and healthcare environments?

Why This Matters for Security Teams

IoT visibility in segmented OT and healthcare environments is not just an inventory problem. It is a control problem. If teams cannot reliably identify medical devices, controllers, gateways, and unmanaged sensors, they cannot segment them correctly, detect drift, or confirm that communications align with approved workflows. NIST SP 800-53 Rev 5 Security and Privacy Controls emphasizes continuous monitoring and asset accountability, but in these environments the challenge is making that visibility safe enough to use during live operations.

NHIMG research on the State of Non-Human Identity Security shows how visibility gaps compound into security gaps: 85% of organisations lack full visibility into third-party vendors connected via OAuth apps. The same pattern appears with OT and healthcare devices when discovery depends on assumptions, spreadsheets, or active scans that are too disruptive to run. Security teams need a view of device identity, function, ownership, location, and communication paths before they can trust any policy decision.

Without that foundation, segmentation becomes guesswork and incident response slows because responders cannot quickly separate normal telemetry from suspicious activity. In practice, many security teams discover their device blind spots only after an outage, a compliance review, or a compromise has already exposed them.

How It Works in Practice

The most reliable approach combines passive discovery, safe protocol-aware queries, and multi-source correlation. Passive tools observe traffic on network taps, span ports, or log pipelines to infer which devices are present and how they behave. Safe queries then enrich that picture using OT- and healthcare-aware protocols where supported, without forcing aggressive probing that could interrupt fragile systems. Security teams should treat active scanning as an exception, not a default, because many embedded or legacy devices respond poorly to generic scans.

From there, teams correlate what they see with configuration management databases, endpoint inventories, EHR asset lists, switch tables, wireless controllers, NAC logs, and maintenance records. This is where identity becomes useful: device type, hostname, MAC address, certificate data, firmware version, owner, physical location, and peer communications all help distinguish one asset from another. The NHI Lifecycle Management Guide is useful here because lifecycle thinking applies to device identities as well: onboarding, approval, monitoring, and retirement should be explicit, not ad hoc.

• Build an authoritative asset baseline from passive observation first.
• Use protocol-aware enrichment only when the device and environment can tolerate it.
• Tag devices by clinical function or OT role, not just by IP address.
• Map communications to approved peers and alert on drift.
• Feed the results into segmentation rules, EDR exclusions, and change control.

Current guidance suggests pairing visibility with policy enforcement so that unknown or misclassified devices can be isolated quickly. NIST SP 800-53 Rev 5 supports this through monitoring, access control, and system inventory expectations, while NHIMG’s Top 10 NHI Issues highlights why unmanaged identities, including device identities, are frequently overlooked until they are abused. These controls tend to break down in flat legacy networks because there is no trustworthy source of truth and no safe way to validate device behavior at scale.

Common Variations and Edge Cases

Tighter visibility often increases operational overhead, requiring organisations to balance richer telemetry against device fragility, privacy constraints, and clinical uptime. That tradeoff is real in intensive care units, radiology, manufacturing cells, and remote OT sites where even “safe” queries can create noise or trigger support issues. Best practice is evolving, and there is no universal standard for how much interrogation is appropriate for every device class.

Some devices are effectively opaque and can only be identified indirectly through switchport data, DHCP logs, or application dependencies. Others present deceptive signals: shared IPs, virtual gateways, proxying middleware, or vendor-managed tunnels can make one device look like many, or many look like one. In those cases, the question is not whether the asset is fully interrogated, but whether its role, trust level, and communication path are understood well enough to enforce segmentation.

The 2024 ESG Report: Managing Non-Human Identities is a useful reminder that visibility gaps often coexist with broader identity weaknesses, not just in servers and applications but in the unmanaged devices that support them. For segment design, the practical goal is to classify uncertain assets conservatively, then refine them as evidence improves. In highly constrained environments, that guidance breaks down when legacy equipment cannot support any telemetry at all and no external correlation source exists.

Related resources from NHI Mgmt Group

• How should security teams run tabletop exercises for lateral movement prevention in IoT and OT environments?
• How should security teams govern IoT device access in large environments?
• How should security teams implement device identity certificates in IoT environments without creating onboarding bottlenecks?
• Why do IoT and ot environments create different security risks from standard IT systems?