Dormant footholds matter because they preserve future access in systems where attackers may wait for the right operational moment. In OT, the danger is often persistence rather than immediate action. A quiet environment can still be compromised if an adversary can keep access available long enough to exploit it later.
Why This Matters for Security Teams
Dormant footholds are dangerous in OT because they turn a one-time intrusion into an operational risk that can sit unnoticed across maintenance cycles, shift handovers, and seasonal downtime. In environments where availability and safety are primary concerns, an attacker does not need constant activity to be effective. They only need a stable path back in at the right moment.
This is why guidance such as the NIST Cybersecurity Framework 2.0 matters here: it pushes teams to think beyond perimeter defense and toward continuous identification, protection, detection, and recovery. The practical issue is that OT networks often contain legacy protocols, shared accounts, remote vendor access, and long-lived trust relationships that are hard to retire cleanly. Attackers exploit that stability. They do not need noisy malware if a valid path already exists.
Security teams often miss dormant footholds because routine checks focus on outages, policy exceptions, or active alerts rather than quiet persistence. In practice, many security teams encounter dormant access only after a safety event, maintenance issue, or third-party review has already exposed the problem.
How It Works in Practice
In OT, a dormant foothold usually means an adversary has established access that can remain idle until conditions are favorable. That access may be a compromised vendor account, a remote access gateway, a misused engineering workstation, a planted scheduled task, or a stolen credential tied to privileged operations. The point is not immediate disruption. The point is durability.
Operationally, this matters because OT environments are often designed around continuity. Systems may remain online for years, patch windows are limited, and authentication patterns can be highly predictable. A foothold can stay dormant if it blends into expected administration behavior, uses legitimate tools, or hides behind approved remote support channels. This is why detection needs to include identity telemetry, session review, and change correlation, not just malware signatures.
A useful way to break the problem down is:
- Inventory all remote paths, vendor accounts, jump servers, and privileged credentials.
- Review whether accounts are tied to named individuals, shared functions, or temporary service access.
- Monitor for unusual logon timing, geography, tool use, and privilege escalation.
- Correlate identity events with engineering changes, controller access, and remote maintenance activity.
- Remove standing access wherever possible and shorten credential lifetimes.
For OT-specific threat modeling, teams can also map persistence and lateral movement patterns using MITRE ATT&CK, which helps distinguish ordinary maintenance behavior from adversary tradecraft. If the environment uses remote service providers or cloud-connected industrial platforms, the attack surface widens further and persistent access may span both IT and OT trust boundaries. These controls tend to break down when legacy equipment depends on shared credentials and always-on vendor pathways because the environment lacks enough identity granularity to distinguish legitimate from hostile use.
Common Variations and Edge Cases
Tighter access control often increases operational friction, requiring organisations to balance resilience against maintenance speed and plant uptime. That tradeoff is especially sharp in OT, where emergency support, safety overrides, and vendor response obligations can make aggressive lock-down impractical.
Current guidance suggests there is no universal standard for how long a foothold must remain idle before it becomes unacceptable risk. The better question is whether the access is still necessary, still attributable, and still monitored. In some plants, a dormant path may be tolerated temporarily during commissioning or outage work. In others, especially critical infrastructure or high-regulation environments, even short-lived standing access can be too much if it is not tightly governed.
Identity controls become more important when OT access is mediated through PAM, jump hosts, or engineering service accounts. If those controls are weak, dormant access can survive credential rotation because the adversary is anchored to a session, token, or trusted relay rather than a single password. That is where detection, removal of standing privilege, and periodic access validation have to work together. For operational resilience and recovery planning, NIS2 is often relevant where critical services and supply chain accountability are in scope. The real edge case is when OT is treated as exempt from identity governance, because that assumption leaves old access alive long after the original compromise should have been eradicated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack surface, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the technical controls, and NIS2 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-01 | Dormant footholds persist when identities and access paths are not continuously governed. |
| MITRE ATT&CK | T1078 | Valid accounts are a common way dormant access remains usable without noisy malware. |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero trust limits implicit trust that lets dormant access survive across OT segments. |
| NIS2 | Critical service resilience and supply-chain accountability are often implicated in OT persistence risk. | |
| NIST AI RMF | GOVERN | Risk governance supports accountable decisions on long-lived access in constrained OT environments. |
Establish identity-aware monitoring and periodic access validation for OT remote paths and privileged accounts.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
