OT Security: Protecting Operational Technology

Quick Summary

• OT security protects the systems that run physical processes. Downtime there stops production, not just email. 

• IT and OT invert the same three priorities, which is why IT playbooks fail on a plant floor. 

• Most OT equipment cannot be patched on an IT cadence, and some cannot be patched at all. 

• Segmentation and monitoring are the controls that work when patching is unavailable.

Why Is OT Security Different from IT Security?

Both disciplines use the same three priorities. They rank them in opposite orders, and that single fact explains most of the friction when an IT team takes responsibility for a plant floor. 

The consequence is practical. An IT team will patch a vulnerable server on a Tuesday evening. Doing the equivalent to a controller mid-run can halt a production line, spoil a batch, or trip a safety system. 

In IT, the worst case is data loss. In OT, the worst case involves physical harm. 

So the answer is rarely to apply the IT playbook harder. It is to accept different constraints and reach for different controls. 

Where Does IT/OT Convergence Actually Create the Risk? 

OT used to be genuinely isolated. Separate cabling, separate protocols, no route to anything else. That air gap is now largely historical, and the numbers reflect what that’s costing manufacturers specifically: IBM’s 2026 X-Force Threat Intelligence Index found manufacturing was the most targeted sector for cyberattacks for a fifth consecutive year, accounting for 27.7% of all tracked attacks in 2025. Dragos’s 2026 Annual OT Cybersecurity Year in Review tracked a 49% rise in ransomware groups targeting industrial organizations year over year, with manufacturing the most targeted sector. 

• Production data is pulled into ERP and reporting systems on the corporate network 

• Vendors expect remote access for diagnostics and support 

• Building management, CCTV, and access control share infrastructure with plant systems 

• Engineering workstations sit on the corporate domain and also talk to controllers 

• Wireless coverage extends across areas that were previously wired and separate 

Each of these is a legitimate business requirement. Collectively they create a path from a phishing email on the corporate side to a controller on the plant side. This isn’t theoretical: Dragos’s own research found shared, unsegmented IT and OT domains in nearly half of the manufacturing environments they assessed. And the mechanism doesn’t require the attacker to know anything about industrial protocols. In 2025, Dragos observed ransomware affiliates using stolen credentials and compromised remote access to reach VMware ESXi hypervisors hosting SCADA, HMI, and engineering workloads directly, encrypting the virtualization layer and knocking out operator visibility and control without touching a single PLC. 

IT/OT convergence:

The merging of corporate information networks with operational technology networks, usually driven by a need for production data, remote vendor support, or centralized management. It delivers real value and removes the isolation OT security historically depended on. 

The uncomfortable part is that convergence is rarely a decision anyone recorded. It happens incrementally, one integration at a time, and nobody owns the resulting attack path. 

CISA maintains dedicated guidance for small and medium businesses on securing their operations, and its Cyber Essentials baseline is a reasonable floor to measure a converged environment against. 

What Do You Do When the Equipment Cannot Be Patched? 

This is the question that defines OT security in practice. A controller may be running software the vendor stopped supporting years ago, or a system whose warranty is void if modified. 

Replacing it is often a capital project measured in years. So the control has to compensate rather than remediate. 

• Inventory it. You cannot protect or isolate equipment nobody has enumerated, and OT inventories are frequently incomplete or years out of date. 

• Segment it. Put unpatchable equipment on its own network segment with tightly controlled routes in and out. 

• Restrict access to named accounts with strong authentication, and remove shared logins entirely. 

• Monitor it more closely than anything else, because it is now your most predictable target. This is where the payoff shows up most clearly: Dragos found organizations with comprehensive OT visibility contained ransomware incidents in an average of 5 days in 2025, against a 42-day industry-wide average for those without it. 

• Control vendor remote access explicitly: time-boxed, logged, and disabled by default rather than standing. 

• Document the compensating controls, because this is what an auditor or an insurer will ask to see. 

• Set a review date rather than treating the exception as permanent. 

None of that removes the underlying vulnerability. It reduces who can reach it and increases the chance you notice when someone tries. 

How Should OT Security Be Governed? 

The recurring failure is not a missing control. It is that nobody owns the boundary. IT assumes the plant team handles it. The plant team assumes IT does. 

The NIST Cybersecurity Framework organizes security work into Identify, Protect, Detect, Respond, and Recover, and added a Govern function in version 2.0 precisely because governance was the commonly missing piece. 

• Name one accountable owner for the IT/OT boundary, not two 

• Maintain a single asset inventory covering both sides 

• Agree a change process that respects production windows rather than fighting them 

• Define who may grant vendor remote access, and for how long 

• Rehearse an incident that crosses the boundary, because that is the one nobody has practiced 

Governance sounds like paperwork until an incident, at which point it is the difference between a coordinated response and two teams discovering they had different assumptions. 

Where Does a Managed Provider Fit? 

Most mid-size manufacturers do not have a dedicated OT security function, and hiring one is a long project. The realistic options are to extend the IT team’s remit or to bring in a provider. 

What a provider should take is the continuous work: monitoring across both zones, access and identity management, inventory maintenance, and the evidence trail. 

What should stay with you is process knowledge. Nobody outside your plant knows which system cannot be interrupted mid-run, and that knowledge is what makes any of the controls safe to apply. 

• Continuous monitoring across the IT and OT zones, and specifically across the paths between them 

• Identity and access management, including vendor access that expires by default 

• Asset inventory kept current rather than rebuilt annually 

• Documented evidence of compensating controls for anything unpatchable 

Our Security as a Service covers the monitoring and detection layer, and Managed IT 360 covers the wider estate the OT zone now connects to. Where production data flows into cloud reporting, Managed Hosting and Cloud covers that path. Eligible critical infrastructure organizations, a category that includes manufacturing, can also use CISA’s no-cost vulnerability scanning for an independent external view. CISA reports that enrolled organizations typically reduce their risk exposure by 40% within the first 12 months, most within the first 90 days. 

Case Study: Manufacturing IT Cycle-Time Improvement 

Client environment: a leading German hydraulics manufacturer. 

Problem: service management turnaround of 9 hours across a manufacturing estate. 

Solution: process mapped, then automated. 

Result: turnaround reduced to 47 minutes without adding resources. 

This evidences manufacturing IT operations capability and cycle-time improvement. It does not evidence an OT security deployment, and no OT security engagement is claimed. No sector-matched case study currently exists for this specific topic, worth confirming this figure with the client and sourcing a matched OT reference before this goes live. 

Frequently Asked Questions 

1 What is the difference between OT security and ICS security? 

ICS security refers specifically to industrial control systems. OT security is the broader term, covering ICS plus building management, physical access systems, and other operational equipment. In practice the terms overlap heavily and buyers use them interchangeably. 

2 Can we just air-gap our OT network? 

Rarely, and the ones that claim to usually haven’t tested the assumption. Production reporting, vendor diagnostics, and shared building systems almost always create a path. A tested segmentation boundary is more honest and more defensible than an assumed air gap. 

3 How do we secure equipment the vendor no longer supports? 

You compensate rather than remediate: inventory it, segment it, restrict access to named accounts, monitor it more closely than anything else, and document the compensating controls. Then set a review date so the exception doesn’t become permanent. 

4 Does our cyber insurance cover OT? 

Check the policy wording rather than assuming. Coverage for physical damage or business interruption arising from a cyber event is treated differently from data breach coverage, and OT exposure is where that distinction usually bites. 

Not sure what is actually reachable from your corporate network? A free IT assessment inventories every server, switch, appliance, and application and flags end-of-life systems and unsupported versions, which in a converged environment is usually where the exposure sits. 

Get your free assessment →