Why does IT/OT convergence make cybersecurity workload harder to sustain?

Why IT/OT convergence increases the sustainment burden

IT/OT convergence turns one security programme into two operating models that must stay aligned. The same environment now mixes office IT controls, industrial uptime requirements, legacy devices, and vendor-dependent access paths, so even routine tasks like inventory, access review, exception handling, and segmentation take more coordination than in either domain alone.

The workload does not just grow in volume, it becomes harder to sequence. A control that is straightforward in IT can be disruptive in OT if it affects availability, safety, or maintenance windows, so teams often delay action, negotiate around exceptions, or split the work into multiple approval paths. That makes sustained execution harder even when the policy itself is clear.

Because the boundary is shared, ownership becomes a recurring operational problem. Asset teams, plant teams, network teams, and security teams may each control part of the path, which means remediation is often slowed by handoffs rather than by technical complexity alone. Over time, the burden is less about writing better rules and more about keeping responsibility, timing, and change control consistent across disconnected groups.

Where the hard parts usually show up

The most difficult work is usually not the first deployment of a control but the steady-state maintenance of it. Access paths expand through remote support, contractors, engineering tools, jump hosts, and shared operational accounts, and every one of those paths has to be known, approved, and reviewed. NHIMG’s OT and ICS Identity and Access Guide is useful here because the sustainment problem in converged environments is often really an identity and access problem.

Another recurring pressure point is visibility. When asset discovery is incomplete, teams spend more time confirming what exists, who owns it, and whether a change is safe than they do actually fixing the issue. That uncertainty raises the cost of every control because the control has to be checked against multiple operational realities instead of one standardised environment. For industrial environments, the NIST SP 800-82 Rev 3 OT Security Guide remains a strong reference point for segmentation, architecture, and control baselines.

Remote access is often the clearest example of the burden shift. A vendor connection that is acceptable for maintenance can become a long-term exposure if it is not time-bound, monitored, and tied to a clear owner. Sustaining that discipline across plant operations and enterprise security requires repeatable governance, not one-time approval. CISA’s Industrial Control Systems resources are useful for keeping that operational context anchored to critical-infrastructure realities.

Why sustainment gets worse over time instead of easier

Convergence creates accumulation effects. Each new integration, exception, or shared tool adds another place where someone must remember the control intent, verify the access path, and coordinate change timing. If that knowledge lives in people rather than process, the programme becomes fragile: staffing changes, plant turnover, and vendor churn all erode consistency.

It also creates a mismatch between urgency and cadence. Security teams may want fast remediation, but OT teams often work on maintenance cycles, safety reviews, and production constraints. That gap turns routine remediation into a scheduling problem, and scheduling problems are expensive because they consume attention even when no incident is happening. The practical outcome is that controls can appear to exist while coverage quietly decays.

That is why sustained cyber hygiene in converged environments is often measured less by the existence of a policy and more by whether the organisation can keep its inventory accurate, its privileged access current, and its exceptions short-lived. Where that discipline breaks down, the environment becomes harder to defend without adding more manual oversight, which further increases the workload.

Risk and Threat Considerations

Converged environments expand the attack surface while also making governance slower, which gives attackers more paths to hide inside legitimate remote access, shared accounts, and loosely owned exceptions. The risk is not only that more systems exist, but that defenders have a harder time proving which paths are still active and which ones are truly controlled.

Failure mechanism: Ownership gaps, delayed remediation, and inconsistent approval chains let privileged access persist longer than intended, especially where OT availability concerns cause teams to defer action or approve broad exceptions.

Impact: A compromise can spread farther before detection, and critical assets may remain exposed even when the organisation believes controls are in place. That raises the chance of production disruption, recovery delays, and incomplete containment.

Practitioner Guidance

What to prioritise: Start with the access paths and ownership boundaries that create the most coordination overhead, not with the easiest policy changes. In converged environments, the biggest sustainment gains usually come from tightening who owns each privileged path, how long exceptions last, and who is accountable for closure.

What to verify: Confirm that every remote path, shared account, and maintenance exception has a named owner, a review cadence, and a clear expiry condition. If any of those three are missing, the control is already more expensive to sustain than it appears on paper.

Practitioner takeaway: IT/OT convergence becomes hard to sustain when control ownership and operational timing are misaligned, so the best defence is to reduce handoffs and make every privileged access path explicit, reviewable, and time-bound.

Related resources from NHI Mgmt Group

• Why do legacy OT assets make IT/OT convergence harder to secure?
• How should security teams make NHI best practices usable across the business?
• Why do NHIs make traditional identity governance harder to sustain?
• Why do service accounts and workload identities make exposure management harder?