IT/OT convergence connects business networks to the systems that run physical processes, so a flaw in an office laptop or cloud account can now reach a pump, a conveyor or a substation. It brings data and efficiency, and it forces security teams to protect systems where safety comes first.
What is the difference between IT and OT?
Information technology handles data. Operational technology, in the words of NIST SP 800-82 Rev. 3, covers programmable systems and devices that interact with the physical environment or manage devices that do. They detect or cause a direct change through monitoring or control.
That difference sets the priorities. In IT the usual order is confidentiality, integrity, availability. In OT, safety and availability come first, because a stopped process can hurt people or equipment. NIST's OT guide says securing these systems has to account for their performance, reliability and safety requirements.
What changes when the two connect?
Before convergence, many plants relied on isolation. The control network had no path to the internet, so weak passwords and old software were tolerated. Convergence removes that isolation, usually for good reasons: remote monitoring, production analytics, vendor support, a single view of inventory.
Four things follow:
- Larger attack surface. Anything reachable from IT becomes a possible stepping stone toward OT.
- Old software meets new threats. Equipment designed to run for decades may run operating systems that no longer get updates.
- Different change rules. You cannot reboot a controller for a patch on a Tuesday afternoon. Updates wait for planned outages, and some are never applied.
- Split ownership. Engineers own the plant, the IT team owns the network, and each may assume the other has handled security.
Which controls matter most?
CISA's guidance on reducing cyber threats to operational technology (published with partner agencies) puts weight on a short list of fundamentals. In plain terms:
- Know what you have. An asset inventory of OT devices, with how each connects.
- Separate the networks. Limit connections between IT and OT to a few controlled, monitored paths.
- Remove direct internet exposure from OT devices and remote access that bypasses controls.
- Use strong authentication on remote access, with logging.
- Plan for loss of the network: practise running manually and restoring from known good backups.
NIST SP 800-82 adds detail on architecture, such as using a demilitarized zone between enterprise and control networks, and on risk management that includes safety.
A constructed example
A food plant adds a link so the head office can read production counts from a historian server. The historian sits in the control network and also accepts logins from the office network with a shared service account. An attacker who phishes one office user finds the shared credentials in a script, logs in to the historian, and from there reaches a programmable controller on the same subnet. Nothing was "hacked" in the controller. The convergence path simply allowed it.
The fix is not exotic. Put the historian in a separate zone, replicate data one way to an office copy, give each person their own account, and alert on any login from a new source.
How to check or apply this
- Walk the plant with an engineer and mark every link between office and control networks on a drawing. Count them.
- For each link, answer who uses it, why, and what is logged.
- Check for devices reachable from the internet with a search of your own address ranges.
- Review who can reach OT through a vendor tunnel, and when it was last used.
- Agree a patch policy with operations: what is applied, what is compensated by isolation, and who signs off.
- Test your backups by restoring one controller configuration.
Quick check
Why not patch OT systems as fast as IT systems?
Because downtime can affect safety and production, and updates may need vendor testing. Teams schedule patches in planned outages and use isolation where patching is not possible.
Is air gapping still realistic?
Rarely, once remote monitoring, vendor support and data sharing exist. Plan for controlled, monitored connections instead.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, Industrial Control Systems
Last reviewed: 18 October 2026.
