How should teams monitor unmanaged and OT devices differently from laptops?

Why unmanaged and OT devices need a different monitoring model

Laptops are usually monitored as managed endpoints: you can expect EDR, device compliance, local logging, and policy enforcement. Unmanaged and OT devices often break that assumption. The practical question is not whether they look like laptops, but what telemetry they can realistically produce and which network behaviours should be considered normal for that asset class.

That difference matters because visibility gaps are part of the operating condition. If the device cannot host an agent, cannot support modern logging, or is too sensitive to instrument directly, the monitoring model must shift to network and protocol observation. For OT environments, CISA Industrial Control Systems and the NIST SP 800-82 Rev 3 OT Security Guide both reinforce that passive visibility, segmentation, and asset understanding are central when endpoint-style controls are limited.

For teams that need a practical starting point, Device Trust and Posture Guide explains why posture-based assumptions work for managed laptops but become weaker for unmanaged devices, and why device trust signals must be matched to the access model rather than assumed from the form factor.

What behavioural baselining should actually look for

The useful baseline is communication pattern, not just event count. Teams should learn which hosts talk to which internal services, at what times, over which ports or industrial protocols, and whether those relationships are stable or opportunistic. A device that suddenly reaches new internet destinations, new administrative endpoints, or unfamiliar peer devices deserves attention even if no local agent ever reports a problem.

For OT assets, protocol-aware observation is especially important because a quiet device can still be critical. Monitoring should distinguish expected control traffic from scanning, unexpected management sessions, firmware activity, or remote access that does not fit the normal operating window. The point is not to turn every deviation into an incident, but to make unexplained deviation visible enough to triage.

That is why an OT Asset Visibility Guide is a natural companion to behavioural monitoring: it focuses on passive discovery, protocol-aware inventory, and baseline building for assets that cannot always be treated as standard endpoints.

How to operationalise monitoring when endpoint telemetry is weak or absent

When an unmanaged or OT device cannot provide rich local logs, the network becomes the control plane for observation. Teams should rely on span ports, taps, passive sensors, DNS and proxy telemetry where available, plus asset inventory and segmentation context to interpret what “normal” means for each device class. In practice, that means monitoring should be anchored to identity of the asset and its expected peers, not to a generic endpoint policy.

Unknown external destinations are a high-value signal because they often indicate either compromise, hidden update mechanisms, or an unmanaged workflow that was never documented. Unknown destinations are even more important when they come from devices that should have a fixed communications envelope, such as controllers, kiosks, lab systems, or appliances. A stable baseline makes these exceptions stand out without needing full endpoint instrumentation.

The same logic underpins the Top 10 OT Security Risks: legacy systems, insecure remote access, and flat networks increase the value of passive detection because direct instrumentation is often not practical or trustworthy.

Risk and Threat Considerations

Unmanaged and OT devices create a detection blind spot if teams rely on the same controls they use for laptops. The main risk is not just missed malware, but missed abnormal communications, unauthorised remote access, and lateral movement that never appears in endpoint logs.

Failure mechanism: The device cannot host reliable telemetry, so defenders over-interpret the absence of logs as the absence of activity. Attackers can then abuse permissive network paths, hidden management interfaces, or trusted industrial protocols without triggering laptop-style alerts.

Impact: Compromise can persist longer, be harder to attribute, and spread farther before anyone sees a trustworthy signal. In OT, the consequence can extend beyond data exposure to process disruption, unsafe state changes, or loss of operational confidence.

Practitioner Guidance

What to prioritise: Build separate monitoring standards for managed laptops, unmanaged IT devices, and OT assets. If the device class cannot produce endpoint telemetry, treat network baselining and protocol visibility as primary controls rather than compensating afterthoughts.

What to verify: Confirm that each device has an agreed communication baseline, a known set of peers, and a documented exception path for maintenance or vendor access. If you cannot explain a destination or session in business terms, treat it as an investigation candidate even when the host itself looks healthy.

Practitioner takeaway: The key judgement is to monitor by expected behaviour and asset role, not by the telemetry you wish the device had. For unmanaged and OT assets, visibility design is part of the control, not a post-incident luxury.

Related resources from NHI Mgmt Group

• How should security teams secure connected OT devices without relying on the old air gap?
• Why do unmanaged devices create a governance gap for IAM and compliance teams?
• How should K-12 teams enforce CIPA controls across managed and unmanaged devices?
• How should security teams enforce zero trust across managed and unmanaged devices?