IT-to-OT Lateral Movement

Expanded Definition

IT-to-OT lateral movement describes the transition from a compromised enterprise environment into systems that supervise or control physical processes. In practice, the attacker does not need to “break into OT” first. They often inherit that reach through shared credentials, remote access tooling, legacy trust relationships, or flat network paths that bridge office IT and plant-floor systems.

Definitions vary across vendors because some teams treat this as a network segmentation issue, while others frame it as an identity and remote-access problem. NHI Management Group treats the term as a cross-domain movement pattern where service accounts, API keys, privileged sessions, and remote administration paths become the bridge. The MITRE ATT&CK Enterprise Matrix is useful for mapping the broader technique set, but OT-specific impact depends on the privileges that survive from IT into the industrial layer.

The most common misapplication is assuming OT is safe because it uses different equipment, which occurs when shared identity paths and remote administration channels are left intact between environments.

Examples and Use Cases

Implementing separation rigorously often introduces operational friction, requiring organisations to weigh maintenance speed against the cost of tighter access controls and network change windows.

• A compromised VPN account is reused to reach a jump host, then administrative access is used to enumerate engineering workstations and historians.
• A service account with broad file-share access is harvested in IT and later used to reach OT support systems that trust the same directory.
• Remote vendor access is left always-on for convenience, creating a path from a business laptop into a supervisory control segment.
• Credential theft in cloud or SaaS tooling is pivoted into on-prem administration, then into production scheduling or PLC management interfaces.
• The Storm-2949 Azure Breach shows how one identity compromise can expand across environments, while ATT&CK’s Lateral Movement technique family helps defenders model the sequence.

These patterns also appear in incidents discussed in 52 NHI Breaches Analysis and in cases where stolen credentials became the durable bridge between business systems and higher-value operational assets.

Why It Matters in NHI Security

IT-to-OT lateral movement is rarely just a network problem. It becomes an NHI governance issue whenever service accounts, tokens, certificates, and remote admin credentials are allowed to operate across trust boundaries without scoped privilege, rotation, or strong segmentation. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts, which means many environments cannot reliably tell which machine identities can reach operational assets.

This matters because OT incidents carry safety, availability, and recovery consequences that exceed ordinary IT disruption. The Schneider Electric credentials breach and similar cases illustrate how access paths can become more dangerous than the initial intrusion itself. The same control failures that allow broad NHI privilege in IT often become the bridge into production networks, especially when remote support, shared passwords, or weak zone boundaries persist.

Practitioners typically encounter the business impact only after production has slowed, alarms have fired, or remote access has been abused, at which point IT-to-OT lateral movement becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do shared VPNs and jump boxes increase lateral movement risk in OT networks?
• Why do legacy and OT environments make lateral movement harder to stop?
• Why do living off the land attacks in OT increase lateral movement risk so sharply?
• How should security teams run tabletop exercises for lateral movement prevention in IoT and OT environments?