Is your OT network really air gapped? Myth versus fact

For most plants, a fully air gapped OT network is a belief, not a verified fact. CISA's April 2026 zero trust guidance says systems once isolated or manually operated are now networked, digitally monitored and remotely controlled. Test the claim by looking for connections, then design as if some exist.

Myth: our control network is isolated

Fact: connections accumulate. The agencies' May 2025 alert says threat actors are targeting internet connected OT and ICS, and that the tools are simple enough to run from a browser. That finding exists because devices were found reachable. The Siemens S7 alert describes actors using internet scanning services to find exposed or poorly segmented PLCs.

Myth: if nothing is plugged into the internet, we are safe

Fact: attackers can arrive through the enterprise network. The Volt Typhoon advisory describes pre-positioning on IT networks to move laterally to OT, and the Ukraine alert describes remote access over VPN with valid credentials. A path through IT counts, even if no cable goes outside.

Myth: air gap or nothing

Fact: isolation comes in degrees. The agencies recommend segmenting IT and OT with a DMZ, denying connections into OT by default, and using data diodes where one way communication is enough. These give most of the benefit while letting the business receive production data.

How to test the claim

1. List every device that could cross the boundary: cellular routers, vendor modems, dual homed laptops, USB drives, wireless access points.
2. Review firewall rules for any path from IT to OT, and check who approved it.
3. Search for your own public addresses for anything industrial.
4. Ask each vendor and integrator how they connect for support.
5. Walk the site. Physical inspection finds what diagrams miss, as CISA's inventory guidance suggests when it pairs physical and logical surveys.

What to do when the answer is not isolated

• Treat the connections you find as conduits, with owners, justification and monitoring.
• Remove the ones with no owner.
• Put a DMZ between IT and OT for shared data.
• Require MFA and named accounts for remote access.
• Plan for operating manually if you must cut the links in an emergency, and practise it.

A word on USB and removable media

Even a tightly separated network receives files: configuration updates, firmware, logic. Define one controlled route for those, with scanning and a record, so the exception does not become the rule.

Quick check

Sources

• CISA, Adapting Zero Trust Principles to Operational Technology
• CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
• CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A
• CISA, Volt Typhoon advisory AA24-038A
• CISA, Ukraine Power Grid Cyber-Attack alert
• CISA, Foundations for OT Cybersecurity: Asset Inventory Guidance

Last reviewed: 19 October 2026.