Why do undocumented cellular modems create so much OT risk?

Why undocumented cellular modems are such a dangerous hidden path

An undocumented modem is risky because it creates a parallel access route that bypasses the organisation’s normal asset inventory, approval, and monitoring path. In OT, that matters more than in ordinary IT because the bridge is not just “internet access”, it can become a quiet path into a PLC, HMI, or engineering workstation without the visibility needed to govern it.

That hidden route undermines basic assurance: you cannot easily tell who installed it, who uses it, what it reaches, or whether it is still active. If the modem exists outside inventory, it is already outside most of the controls that would normally constrain remote access, making it an unmanaged access channel rather than a simple connectivity add-on.

What makes the risk worse in OT environments

OT risk rises when the modem crosses a trust boundary into a system that can affect physical processes. Cellular links are often deployed for convenience, temporary maintenance, or shadow support arrangements, but once they are present they can persist long after the original need has passed. That creates a durable exception that security teams may never see during standard review cycles.

The exposure is amplified when the modem is attached to a safety, control, or engineering segment that was designed around tightly bounded connectivity. In those cases, the modem does not just widen the network, it can bypass segmentation assumptions and weaken incident response, because responders may not know the access path exists until they are already investigating abnormal behaviour.

Why discovery, governance, and revocation all fail when the modem is hidden

The core problem is not the modem hardware itself, but the governance gap around it. If the device is missing from discovery and change control, there is no reliable way to enforce policy, assess whether it is authorised, or confirm that its access has been removed when no longer needed. That leaves the organisation unable to prove whether the pathway is legitimate or simply an untracked exception.

This is why undocumented modem use often turns into a lifecycle problem as well as a security problem. Without ownership, documented purpose, and review, the organisation cannot rotate or disable associated access cleanly, cannot verify the destination systems, and cannot restore a known-good state after an incident. The hidden access path becomes part of the attack surface even if no one actively uses it.

Risk and Threat Considerations

Undocumented cellular modems are risky because they create stealthy remote-entry points that can sit outside perimeter monitoring, asset governance, and access review. In OT, that hidden connectivity can give an attacker or insider a route to reach control equipment without tripping the controls that were built around managed remote access.

Failure mechanism: The modem is not in inventory, so it is excluded from standard discovery, logging, approval, and revocation processes; that makes the access path hard to detect, constrain, or remove.

Impact: A hidden modem can extend compromise into the control environment, weaken segmentation, delay incident response, and leave the organisation unable to prove which systems were reachable through the path.

Practitioner Guidance

What to verify: Confirm whether any cellular modem, router, or embedded wireless uplink exists on or near OT assets, and verify its owner, business purpose, upstream carrier or SIM, and reachable destination systems. If you cannot identify all four, treat the device as an unmanaged remote-access pathway until proven otherwise.

Decision rule: If the modem can reach a PLC, HMI, historian, engineering workstation, or other control asset, prioritise containment and removal of that path before arguing about whether it is “approved” in practice. In OT, unknown reachability is the security problem, not just undocumented presence.

What practitioners underestimate: These devices are often introduced for maintenance convenience and then forgotten, but forgotten connectivity ages into persistent exposure. The right question is not whether the modem is currently being used, it is whether the organisation can discover it, govern it, and revoke it on demand.

Practitioner takeaway: A hidden cellular modem is dangerous because it converts remote access from a controlled exception into an unmanaged dependency, and OT teams should judge it by reachable blast radius, not by whether it was installed for a legitimate reason.

Related resources from NHI Mgmt Group

• Why do persistent credentials create so much OT compliance risk?
• Why do shared credentials and static authentication create so much risk in brownfield OT networks?
• Why do undocumented APIs create so much risk in healthcare environments?
• Why does remote access create so much operational risk in OT and ICS environments?