IT and OT are now one network, but your security model probably isn't. A growing number of CISOs are being handed something they were never trained for: responsibility for the factory floor. A merger brings an industrial subsidiary into scope. A new regulation such as NIS2 pulls operational systems under the same security mandate as the corporate network. An incident on the plant side suddenly lands on the security team's desk. However it happens, the result is the same. Someone who has spent a career securing information technology (IT) now owns the security of operational technology (OT), and quickly discovers that the rules are not the same.
IT and OT security are not the same discipline. IT protects information and prioritises confidentiality; OT keeps physical processes running and prioritises availability above all else. Connecting the two does not merge the rules. It exposes the boundary between them, and that boundary is where the risk now sits.
This guide is for the IT security leader who has inherited OT. It explains why your existing instincts do not transfer cleanly, what the convergence of IT and OT actually changes about your risk, and where to start.
IT and OT: two worlds, two sets of rules
Information technology manages digital information: email, applications, databases, the corporate network. Operational technology runs and monitors physical processes: the programmable logic controllers (PLCs), human-machine interfaces (HMIs) and supervisory control and data acquisition (SCADA) systems that keep a production line, a power substation or a water plant operating.
They were built for opposite priorities. In IT, the guiding order is confidentiality, integrity, availability, in that sequence. Protecting data comes first. In OT, the order is reversed: availability comes first, because a stopped process can mean lost production, ruined material or a safety hazard. The US National Institute of Standards and Technology makes the point explicitly in its Guide to Operational Technology Security (SP 800-82): OT prioritises availability and safety, where IT prioritises confidentiality.
The protocols carry the same history. Many industrial protocols were designed decades ago for closed networks, with no authentication and no encryption, because the network they ran on was assumed to be physically isolated. Exposed to a wider network, they offer an attacker very little resistance, and they cannot simply be upgraded the way a web protocol can.
That single inversion explains most of what follows.
| Dimension | IT | OT |
|---|---|---|
| Top priority | Confidentiality of data | Availability and safety of the process |
| Equipment lifespan | 3 to 5 years | 15 to 25 years, sometimes longer |
| Patching | Frequent, scheduled, often automatic | Rare, risky, sometimes impossible without halting production |
| Downtime tolerance | Maintenance windows are normal | A stoppage can be unacceptable or dangerous |
| Protocols | TCP/IP, HTTP, standard and well understood | Modbus, DNP3, S7 and others, industrial and rarely security-aware |
| Typical failure cost | Data loss, financial loss | Physical damage, safety risk, production loss |
Their environment is fundamentally different, and a control that is routine in IT can be reckless in OT.
Why the two were ever connected
For decades the two worlds barely touched. The plant ran on its own isolated network, the famous air gap, and the corporate network ran separately. That separation is disappearing, for reasons that have nothing to do with security and everything to do with business value.
- Manufacturing execution systems (MES) now read live data from PLCs.
- Enterprise resource planning (ERP) integrations reach down to the shop floor.
- Engineers connect remotely to SCADA systems instead of standing in front of them.
- Predictive maintenance, real-time data flows and the broader push of Industrie 4.0 all depend on operational data leaving the plant and reaching analytics platforms, often in the cloud.
This is the convergence of IT and OT: the deliberate integration of the two technology estates to unlock efficiency and visibility.
The benefits are real. So is the consequence: the air gap that used to protect OT by isolation is gone, and almost nobody removed it on purpose. It eroded one integration at a time.
What convergence breaks on the security side
Here is the shift that matters most for a CISO. The attack surface is no longer the isolated plant. It is the boundary where IT and OT now meet, and every connection that crosses it.
Three things change at once:
- Legacy equipment is now reachable. A PLC designed in an era of physical isolation, with no authentication and no capacity to be patched, is now a few network hops from a phishing-prone corporate inbox.
- Lateral movement runs IT to OT. An attacker who lands in the corporate network through a stolen credential or a malicious email no longer hits a wall at the plant. The path is open.
- Remote and third-party access multiplies. Vendor maintenance, remote engineers and integrations each open a door, and a traditional VPN grants broad network access once a single one of them is compromised.
The threat data has caught up with this. Fortinet's 2024 State of Operational Technology and Cybersecurity Report found that 73% of organisations experienced an intrusion affecting OT systems, or both IT and OT, up from 49% the year before. And manufacturing was the most-attacked industry of all for the fifth consecutive year in IBM's X-Force Threat Intelligence Index 2026, accounting for 27.7% of incidents observed across all sectors in 2025.
The pattern is not hypothetical. In the 2021 Colonial Pipeline attack, ransomware hit the company's IT and billing systems, not the pipeline controls themselves. The operator still shut the pipeline down, because it could no longer be confident the two sides were safely separated, and fuel supply to much of the US east coast stopped for several days. An IT compromise forced an OT shutdown across a boundary that had never been designed to contain it.
The risk of IT/OT convergence does not come from the machines. It comes from the connections nobody designed to be secure: the path from a corporate inbox to a controller that was never meant to be reachable.
Why your IT reflexes do not transfer
This is where an experienced IT security leader can do real harm with good intentions.
You cannot run an aggressive vulnerability scan against an OT network. Active probing that a corporate server shrugs off can crash a fragile controller and stop a line. You cannot force a patch on a schedule, because the patch may not exist, may void a safety certification, or may require a production halt that the business will not grant. You cannot simply isolate a suspicious device if that device is controlling a physical process that must keep running.
The lesson is not that OT cannot be secured. It is that OT is secured differently. You do not harden it from the inside the way you harden a laptop fleet. You secure what reaches it. The defensive work moves to the network around the operational environment, not the equipment within it.
So what does a CISO actually secure?
If you cannot patch the controllers and you cannot scan the plant, the controllable surface is the boundary and the traffic that crosses it. In practice that means a small number of network-level questions:
- Access. Who and what can reach OT systems, and is each connection verified per request and limited to a single system rather than the whole network? This is the Zero Trust principle applied to industrial access, and it is the direct replacement for broad VPN trust.
- Segmentation. Are IT and OT separated into zones, so that a compromise on the corporate side cannot move laterally into production?
- Filtering. Is traffic to and from OT-adjacent systems inspected and filtered, so known-bad destinations and exploits are blocked before they arrive?
- Resilience. Can the connections that keep the plant reachable absorb a volumetric attack without going down?
The practical first move is to see the boundary clearly. List every point where IT and OT connect today, including the remote-access and vendor links that tend to accumulate quietly over the years, and mark which connections are genuinely verified and which are simply trusted. That inventory usually reveals more exposure than any single control removes, and it tells you where to apply the four points above first.
These are network and access controls, and they sit at the IT/OT connection points precisely because that is where you can act without touching the operational equipment. This is the approach Brixio takes: we secure the boundary between IT and OT using Cloudflare, without modifying the controllers, the protocols or the production process. The full picture is in our pillar on securing IT/OT convergence.
From there, five companion articles go deeper:
- what the 2026 threat data really says about the risks of IT/OT convergence
- modernising network segmentation with the Purdue model and Zero Trust
- the five Cloudflare features that secure the IT/OT boundary in practice
- how this maps to IEC 62443, the reference standard for industrial cybersecurity
- and why network boundary security and OT-native platforms such as Claroty or Dragos are complementary rather than competing.
You do not need another tool inside the plant. You need to secure the network that now connects IT and OT.
Frequently asked questions
IT security protects digital information and prioritises confidentiality. OT security keeps physical processes running and prioritises availability and safety above all else. The priorities are effectively inverted, which is why controls that are routine in IT, such as forced patching or aggressive scanning, can be unacceptable in OT.
Because it removes the isolation that used to protect OT. When manufacturing systems, remote access and cloud integrations connect the plant to the corporate network, an attacker who reaches IT can potentially move toward OT, and legacy industrial equipment that was never built to be secured becomes reachable.
Partly, and carefully. Some IT disciplines transfer, but many do not: you generally cannot scan, patch or isolate OT equipment the way you would IT assets without risking the process. The most transferable controls are network-level ones applied at the IT/OT connection points, such as identity-based access, segmentation and traffic filtering.
Start at the boundary, not inside the plant. Map every point where IT and OT connect, including remote and third-party access, then verify and limit those connections and segment the two environments. Securing the connections is achievable without touching the operational equipment, which is the part you cannot safely change.
Secure the boundary, not the machines.
If you have inherited OT and are not sure what to put in place on the IT side to protect it, that is exactly what we help you work out: where your IT and OT connect, and which of those connections to secure first. Map your IT/OT boundary with Brixio.
