What should critical infrastructure teams prioritise: patching or segmentation?

Why segmentation beats patching first in critical infrastructure

When patch windows are short or unsafe, segmentation is the control that changes the risk profile immediately. It limits reachability, constrains blast radius, and buys time for orderly remediation. In OT, that matters because assets often cannot be rebooted or taken offline on demand, so exposure has to be reduced while the vulnerable system is still running.

Segmentation works best when it is defined around actual trust paths, not just network diagrams. If a controller, engineering workstation, historian, or remote access path can talk broadly across zones, a single unpatched weakness can remain operationally decisive even after other hardening steps are in place.

Effective segmentation for critical infrastructure usually means separating IT and OT, limiting lateral movement between cells or zones, and tightly governing any conduit that must exist for operations or vendor support. NIST SP 800-207 Zero Trust Architecture is useful here because it reinforces least-privilege access and explicit verification for each path.

What patching still has to do, even when it is not first

Patching is still necessary, but in critical infrastructure it is often a scheduling and safety problem as much as a technical one. Some vulnerabilities remain dangerous because they are already known to attackers, and delaying remediation for too long leaves a segmented system protected only by containment, not by elimination of the flaw.

The right operating model is not “segment or patch”, but “segment first so patching can happen safely”. That sequence reduces urgency pressure, lets teams validate dependencies before change, and avoids the common mistake of treating patch backlog as acceptable simply because the network is segmented.

For exposed vulnerabilities with active exploitation, remediation priority should rise quickly. CISA’s Known Exploited Vulnerabilities Catalog helps teams separate theoretical exposure from vulnerabilities that are already being used in the wild, while NIST National Vulnerability Database remains the baseline source for vulnerability context and affected-product detail.

How teams should decide the order of work

The decision turns on operational tolerance, exposure, and reachability. If patching requires downtime that would disrupt a live process, then the first question is whether the asset can be isolated without impairing control or monitoring. If yes, segment it tightly and then plan the patch. If no, reduce exposure through compensating controls and set a remediation date that operations can actually support.

In practice, the strongest prioritisation rule is simple: reduce the paths into and out of the vulnerable asset before you spend change capacity trying to remove the vulnerability itself. That is especially true for remote access, vendor maintenance channels, and flat networks that still allow broad east-west movement.

OT-specific guidance from NIST SP 800-82 Rev 3 and sector advisories from CISA Industrial Control Systems both support this sequence: contain first, then remediate on an operationally safe schedule.

Risk and Threat Considerations

Critical infrastructure is attractive to attackers because a single foothold can create disproportionate operational impact. If an unpatched OT asset remains broadly reachable, an attacker does not need perfect exploitation conditions to cause serious harm, only enough access to move laterally, disrupt availability, or interfere with control paths.

Failure mechanism: Flat or weakly segmented networks let an exploited system communicate beyond its intended zone, turning one vulnerable host into a route to other operational assets. Patching alone does not remove that movement path until the fix is deployed everywhere it matters.

Impact: Segmentation reduces the chance that one exposed weakness becomes a site-wide incident, limits the blast radius of compromise, and gives operators more time to patch without creating unsafe downtime.

Practitioner Guidance

What to prioritise: If the vulnerable asset is safety-critical, difficult to patch quickly, or exposed to remote access, prioritise segmentation and reachability reduction before the patch cycle. If the asset is easily patched without operational risk, do both, but still do not leave broad connectivity in place while waiting for the maintenance window.

What to verify: Verify which paths actually reach the asset, which are required for operations, and which are merely historical convenience. A segmentation control is only real if the allowed conduits are explicitly known, monitored, and testable.

Practitioner takeaway: In critical infrastructure, segmentation is the immediate risk-reduction control and patching is the remediation control; the safest programme is to shrink exposure first, then remove the flaw on an operationally safe timeline.

Related resources from NHI Mgmt Group

• What should critical infrastructure teams prioritise after OT protocol exploit activity is detected?
• How should security teams prioritize patching when multiple unauthenticated critical CVEs land in core infrastructure libraries at once?
• How should security teams use segmentation to contain risk when geopolitical events increase attack pressure on critical infrastructure?
• When should security teams prioritise MFA for internal employee and developer access to critical infrastructure?