Should OT teams prioritise segmentation or endpoint protection against ransomware?

Why Segmentation Usually Comes First in OT Ransomware Defence

Ransomware is a propagation problem as much as an endpoint problem. In OT, the systems that matter most are often legacy, fragile, difficult to reimage, and tightly coupled to process availability, so the control that most reliably changes the outcome is limiting how far an intrusion can move. That is why separating IT from OT, tightening remote access, and constraining lateral paths usually deliver more immediate risk reduction than endpoint-only detection.

Segmentation changes the blast radius. If ransomware reaches a historian, engineering workstation, or shared file service, network boundaries and conduit restrictions determine whether it becomes an isolated incident or a plant-wide disruption. Endpoint protection still matters, but in OT it is rarely sufficient on its own because you cannot assume every asset can run the same agent, update cadence, or behavioural policy as a modern office endpoint.

For that reason, a useful practical test is whether the control protects the part of the environment that can still be changed safely. If the answer is yes, start there. OT Security Guide is the right place to anchor the zone-and-conduit model, because the question is really about how to reduce exposure without interrupting control functions.

What Endpoint Protection Can and Cannot Do in OT

Endpoint protection is valuable when OT hosts are permitted to run it, especially on engineering workstations, jump hosts, historians, and other Windows-based assets that are more exposed to initial execution than PLCs or controllers. It helps with malicious attachment detonation, script control, tamper protection, host isolation, and telemetry that can confirm suspicious behaviour before it spreads.

Its limitation is that ransomware is often already inside the trust boundary by the time endpoint tools become decisive. In OT, operators may also face compatibility constraints, vendor support restrictions, or uptime windows that make aggressive endpoint changes slower than the threat. That means endpoint controls should be treated as a containment and detection layer, not as the primary line of defence against propagation.

That is also why endpoint controls need to be paired with operationally safe rollback options. Endpoint Security Guide covers the controls that matter on the hosts you can harden, while Backup Security and Immutable Backup Guide addresses what remains essential when prevention fails and recovery becomes the real control objective.

How to Sequence the Work Without Creating New Operational Risk

Begin with the boundaries that reduce spread: separate business IT from OT, restrict vendor and remote maintenance access, and review any flat networks that allow unnecessary east-west movement. Then harden the high-value endpoints that sit closest to OT operations, especially remote access gateways, engineering workstations, and administrative jump points. The sequencing matters because a stronger endpoint on a flat network still leaves the plant exposed to rapid replay, credential abuse, or shared-service propagation.

Where asset refresh is slow, compensating controls become part of the plan. That can include application allowlisting, removable media controls, network containment, host isolation, and tighter privileged access for the users and service accounts that can reach OT-adjacent systems. Ransomware Prevention Guide is useful here because it ties prevention to the actual kill chain, not just to antivirus-style blocking.

Risk and Threat Considerations

OT ransomware risk is driven by propagation, not just execution. Once an attacker or worm-like payload reaches a shared workstation, jump host, or remote-access path, the main danger is uncontrolled spread into systems that are hard to take offline and harder to restore safely.

Failure mechanism: Flat or weakly segmented networks let ransomware reuse existing trust relationships, credentials, and shared services to move from an ordinary endpoint into OT-adjacent assets and then across operational zones.

Impact: Loss of visibility, loss of control availability, and potentially unsafe manual workarounds if critical systems or supporting servers are encrypted or taken offline at the wrong time.

Practitioner Guidance

What to prioritise: Treat segmentation and remote-access restriction as the first risk-reduction step, then use endpoint protection to harden the assets that cannot be isolated as aggressively. In OT, the most important question is not whether an agent can detect every variant, but whether the network design prevents one compromised host from becoming a plant-wide event.

What to verify: Validate that IT and OT are actually separated at the traffic level, that vendor access is brokered and time-bound, and that the systems with the most operational privilege are the ones receiving the strongest telemetry and hardening. If a single compromised user path can still reach multiple zones, endpoint protection has not solved the highest-value problem.

Practitioner takeaway: In OT, prevention is won first by shrinking the blast radius, then by hardening the hosts inside that smaller boundary, because containment is more dependable than endpoint detection under real plant constraints.

Related resources from NHI Mgmt Group

• How should security teams use endpoint segmentation to limit ransomware spread before an incident starts?
• What should security teams do when endpoint ransomware tests show that standard anti-ransomware tools fail against a new technique?
• How should security teams evaluate endpoint protection claims against MITRE ATT&CK results?
• When should OT teams prioritise segmentation over more detection tooling?