Why IT security stops at the factory floor

For most cyber-security professionals, the fundamentals remain the same regardless of the environment. Asset discovery, vulnerability management, identity, segmentation and incident response all matter. But once those principles cross into operational technology (OT), the priorities change.

 

That’s becoming increasingly important as organisations connect manufacturing plants, utilities and critical infrastructure to wider enterprise networks.

 

The biggest mistake IT security teams make is assuming OT can be secured in the same way as corporate infrastructure. In enterprise IT, taking a server offline to apply a critical patch is often an acceptable trade-off. In OT, shutting down a production line or interrupting a control system may halt manufacturing, disrupt essential services or even create safety risks.

 

That is why availability and safety typically take precedence over confidentiality in industrial environments. The National Institute of Standards and Technology (NIST) notes that while traditional IT security focuses on protecting information, industrial control systems must first maintain safe and reliable operations, even during a cyber incident.

 

The growing convergence of IT and OT has also changed the threat landscape. Industrial control systems that once operated in isolation are increasingly connected to cloud platforms, remote maintenance tools and corporate networks. While this improves visibility and operational efficiency, it also expands the attack surface. Guidance from the Cybersecurity and Infrastructure Security Agency (CISA) highlights that poor segmentation between IT and OT remains one of the most common pathways for attackers to reach critical systems.

 

For cyber-security professionals moving into OT, the challenge is often less about learning new security concepts and more about understanding operational constraints. Vulnerability scans may overwhelm legacy devices, endpoint agents are frequently unsupported, and patching windows may only occur during planned maintenance outages several times a year.

 

Instead, many OT security programmes focus on reducing exposure rather than eliminating every vulnerability. Network segmentation, passive asset discovery, secure remote access and continuous monitoring often deliver greater risk reduction than aggressive patching programmes.

 

As ransomware groups and state-backed actors continue to target critical infrastructure, organisations increasingly need security teams that understand both worlds. The future of cyber-security is no longer simply IT or OT, it is securing the space where the two now overlap.