OT Security in 2026: From blind spot to strategic priority

Many organisations have significantly strengthened their IT security in recent years. But while attention was focused there, operational technology risked being overlooked: the systems that keep factories, power plants and transport networks running. Those systems are increasingly connected, and increasingly a potential target.

IT and OT are converging. With far-reaching consequences

From isolated to interconnected

Operational technology (OT) has traditionally operated in complete isolation. Industrial control systems (ICS), SCADA platforms and programmable logic controllers (PLCs) were designed for reliability and continuity, not for security in a connected world.

Digitalisation breaks down the barriers

The pressure to work more efficiently, to monitor and maintain systems remotely, and to make data-driven decisions has broken down that isolation. PLCs communicate with cloud platforms. Engineers log in via VPN, often without any form of access control. ERP systems exchange data with production floors.

Third parties frequently have remote access to OT systems for maintenance, patching and support. The result: OT networks are increasingly reachable via the same attack routes as IT environments, such as poorly secured remote access and operating systems without updates, but without the security layers that IT has built up over the past decades.

Attackers are taking advantage

Countries like Russia and China deploy hacker groups to target critical infrastructure. The attacks attributed to the Sandworm group against European energy companies and government organisations are a clear example. Criminal groups have also discovered OT environments as an attractive target. The impact of an attack on an OT environment affects the continuity of business processes and, more importantly, the safety of people.

Why OT security requires a different approach

As a CISO or IT director, you are familiar with the classic security principles. But in OT environments, different rules apply, and underestimating this will lead to problems. In IT, security revolves around confidentiality, integrity and availability. In OT, availability and safety carry extra weight. A production line that goes down costs money immediately and can create dangerous situations. That means updating, restarting or isolating systems is often not an option. Security measures must be chosen with that in mind.

Legacy systems and limited visibility

Many OT environments run on systems that are decades old. Vendors no longer supply updates, but the systems cannot simply be replaced or shut down. They remain vulnerable, and therefore require specific measures such as virtual patching. Organisations must know what is running in their OT environment. PLCs, HMIs, SCADA systems, sensors: there are often dozens or hundreds of them, without a complete overview. That is not a minor issue. You cannot protect what you do not know.

Poor segmentation and third-party access

The separation between IT and OT is often inadequate. Once an attacker gains a foothold in the IT network, the step to OT systems can be a small one. On top of that, OT environments are maintained by external vendors with remote access. Those access points are often insufficiently secured, barely monitored, or sometimes not even known. Striving for Zero Trust is essential here.

Regulation makes waiting no longer an option

From voluntary to mandatory: executives personally liable

Security standards for OT have existed for some time. IEC 62443 provides a solid framework for industrial cybersecurity, and the NIST guidelines for ICS are widely recognised. For a long time, however, compliance was voluntary: organisations decided for themselves whether to adopt these standards. That is now over.

TheNIS2 Directive imposes stricter requirements on organisations in sectors such as energy, water, transport and healthcare. Executives are personally liable for shortcomings. Incidents must be reported within 24 hours, followed by a full notification within 72 hours and a final report within one month. Risk management measures are no longer optional, and that applies to OT as well.

In addition, the Cyber Resilience Act requires manufacturers of OT components to demonstrably secure their products and keep them secure throughout their entire lifecycle. For a CISO or IT director, this means OT security is no longer purely a technical matter. It requires board-level involvement, clear accountability, demonstrable risk decisions and a well-designed process for when things go wrong.

Where to start? A clear order of priorities

The scale of the challenge can feel overwhelming. There is, however, a logical sequence:

1. Create visibility. Know what is running in your network. A current inventory of all assets is the foundation of everything. Without this overview, every subsequent step is built on sand.
2. Strengthen segmentation. Ensure a clear separation between IT and OT, and limit how far an attacker can move within the OT network as well.
3. Secure remote access. Establish centralised access control to critical systems, determining who gets access and under what conditions.
4. Set priorities. Not everything can be addressed at once. Start with the systems where downtime or a breach would have the greatest impact.
5. Establish accountability. Ensure OT security has a permanent place in the boardroom, with clear ownership and a corresponding budget.