Segmentation breaks when it assumes every asset can host an agent, reboot safely, or tolerate frequent policy changes. OT and IoT systems often cannot meet those conditions, so teams end up with controls that look consistent on paper but fail in operational reality. The better approach is to enforce at the network layer and reserve agents for the assets that can support them.
Why This Matters for Security Teams
In OT, segmentation is not just a design choice. It is a safety and availability control that has to survive long device lifecycles, vendor constraints, and change freezes. When teams depend on endpoint agents to enforce policy, they often assume every controller, sensor, and embedded host can support software installation, routine updates, and telemetry. That assumption collapses fast in brownfield environments.
The practical risk is not only coverage gaps. Agent-first segmentation can create a false sense of isolation while unmanaged assets remain reachable on the same flat industrial network, or while policy drift leaves exceptions in place for critical systems. That is why NHI Management Group’s research on the Ultimate Guide to NHIs matters here: if organisations struggle to maintain visibility and lifecycle control for non-human identities, they usually struggle even more with endpoint-based enforcement on machines that were never built for it. In practice, many security teams discover the failure only after a maintenance window, vendor remote access event, or incident response exercise exposes what the agent never covered.
How It Works in Practice
Effective OT segmentation starts with the network, not the host. In mixed industrial environments, that usually means zoning and conduits, industrial firewalls, allowlisted protocols, and strict routing between cell/area zones. Endpoint agents can still add value on engineering workstations, historians, jump hosts, and other systems that can tolerate them, but they should complement network control rather than define it.
Current guidance from the NIST AI Risk Management Framework and the CISA Industrial Control Systems cybersecurity recommendations reinforces a broader principle that applies well beyond AI: controls must fit the operational context. For OT segmentation, that means validating what can be monitored at the host layer and what must be enforced externally. NHIMG’s research on the OWASP Agentic AI Top 10 is relevant at the boundary where agentic systems interact with industrial tools, because those systems often introduce new identity and tool-access paths even when the underlying plant is unchanged.
- Use passive asset discovery to map OT devices before introducing any control dependency.
- Enforce segmentation with firewalls, ACLs, VLANs, and industrial demilitarised zones.
- Reserve agents for supported endpoints with stable OS baselines and restart tolerance.
- Test vendor access, remote support, and emergency override paths separately from normal policy.
These controls tend to break down when legacy PLCs, safety systems, or vendor-managed appliances cannot host agents and still require uninterrupted communication across tightly coupled production workflows.
Common Variations and Edge Cases
Tighter segmentation often increases operational overhead, requiring organisations to balance containment against uptime, maintenance access, and safety certification constraints. That tradeoff is especially sharp in plants with mixed generations of equipment, third-party support contracts, or flat networks that have never been formally segmented.
There is no universal standard for agent coverage in OT yet, so best practice is evolving. In highly regulated environments, the safer pattern is usually to treat agents as optional telemetry on a small subset of systems while making segmentation independent of host health. The opposite approach can fail when reboot windows are rare, when patch baselines differ across vendors, or when a device cannot accept new software without voiding support. It also becomes brittle when teams use agent status as the sole proof of compliance, because a silent agent outage can look like a secure state even when the network is wide open.
The NHI angle matters when OT is increasingly tied to service accounts, API keys, and remote orchestration. If a control plane, remote maintenance platform, or AI-enabled operations tool can issue commands into the plant, then that non-human identity becomes part of the segmentation problem. NHIMG’s CoPhish OAuth Token Theft via Copilot Studio analysis and the broader OWASP Top 10 for Agentic Applications 2026 both reinforce the same lesson: when tools can act, their access must be constrained at the network and identity layers together, not by endpoint software alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-5 | OT segmentation needs network access enforcement that does not rely on host agents. |
| MITRE ATT&CK | T1021 | Remote services and vendor access often bypass weak segmentation in OT. |
| OWASP Agentic AI Top 10 | Agentic systems can expand command paths into OT if their access is not constrained. | |
| NIST AI RMF | Risk governance is needed when automated systems touch industrial environments. |
Define network-bound access rules and verify they still hold when endpoints are offline or unsupported.
Related resources from NHI Mgmt Group
- What breaks when OT segmentation depends on static network rules?
- What breaks when agents can create and destroy their own work environments?
- What breaks when AI agents are added to fragmented identity environments?
- What breaks when privileged access still depends on standing secrets in cloud environments?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
