IT/OT Convergence: “Organisational Measures are Just as Important as Technical Ones”

IT/OT convergence means that production and control systems are connected to enterprise IT and external services. The drivers behind this are Industrial Ethernet, IIoT, MES/ERP integration, edge and cloud platforms, AI analytics, and remote maintenance. As a result, the system boundaries that were once clear are increasingly blurring.

IT/OT convergence describes the merging of traditional enterprise IT (networks, servers, cloud) with industrial control and automation systems (PLCs, SCADA, field devices). The key drivers are the IIoT, cloud connectivity, and remote maintenance solutions. The increasing adoption of open industrial protocols such as OPC UA, MQTT, and Modbus - which enable OT devices to be widely networked for the first time - also contributes to this convergence. Platforms like Siemens Industrial Edge further bridge the gap between OT environments and IT infrastructure.

The convergence of IT and OT refers to the increasing interconnection and integration of industrial production systems - known as Operational Technology (OT) - with traditional IT systems. This trend is primarily driven by technical developments such as cloud connectivity, the Industrial Internet of Things, remote maintenance access, and the use of machine learning and artificial intelligence for process optimisation.

Today, machines and systems in OT environments generate business-critical data that is increasingly being integrated into ERP, MES, or other enterprise systems. These systems are typically operated and protected within the IT infrastructure. In addition, the data must be accessible from almost anywhere - whether for accessing important business data or for remote maintenance. Data-driven production optimisation and predictive maintenance also play a key role here. Cybersecurity requirements are similarly high and, in some cases, even more critical because availability is of particular importance in production.

The biggest difference is what each environment is designed to protect. Traditional IT security prioritizes protecting data and enabling rapid change and data analytics, while OT security prioritizes safe, reliable production and continuous uptime. Many industrial systems also have long lifecycles, legacy equipment and limited maintenance windows, so security controls that work well in IT can't always be applied the same way or at all in production environments.

While data protection and privacy are the top priorities in IT environments, availability - with uninterrupted control of production facilities - takes centre stage in OT processes. In addition, OT systems are often significantly older and more durable than traditional IT systems because they were typically retrofitted while the facilities were still in operation. These differing priorities and technical starting points make it difficult to implement a unified security strategy across both business areas.

Both worlds require confidentiality, integrity, and availability, but they prioritize them differently. In OT, the focus is on secure, available, and deterministic processes. Long lifecycles, legacy systems, and infrequent maintenance windows prevent traditional IT security measures from being adopted as it is.

OT systems were never designed for networking; security updates and reboots are often simply not possible without jeopardizing production. IT and OT also differ fundamentally in their requirements and operating models. While IT focuses primarily on data confidentiality, system availability is the top priority in OT. Production facilities must run with as little interruption as possible, because even brief outages can result in high costs. There are also significant differences in patch cycles. IT systems are typically updated weekly or monthly. In OT environments, however, years or even decades may pass between updates. When it comes to the protocols used, IT relies primarily on established TCP/IP standards. In OT, on the other hand, both open and proprietary industrial protocols are used, such as Modbus, OPC UA, MQTT, or S7.

Furthermore, fault tolerance in IT is generally higher than in OT. While disruptions in traditional IT systems can often be bypassed or mitigated, fault tolerance in industrial environments is often virtually zero. A system failure there can immediately lead to a production shutdown and result in correspondingly high costs.

IT environments are designed for agility, flexibility, and rapid change, with regular patching and updates being the norm. OT environments, on the other hand, strictly prioritize availability, physical security, and maintaining operations over long lifecycles. As a result, even routine maintenance windows or outages have immediate financial and operational consequences.

The most important difference lies in the security objectives. While IT often focuses on data confidentiality and integrity, OT prioritizes the availability and secure control of physical processes. Production facilities are often in operation for 10 to 20 years or longer and sometimes use operating systems that are no longer supported or proprietary protocols such as Modbus, DNP3, or CAN. Security measures from the IT world therefore cannot be readily adopted because unplanned outages can have a direct impact on production, quality, and workplace safety.

Connecting production environments to ERP systems, cloud platforms, IIoT devices and remote maintenance solutions give manufacturers better visibility and efficiency, but it also creates more pathways into the environment. For example, a compromised remote access tool, cloud identity or integration between ERP and manufacturing execution systems (MES) can provide a route toward production operations and introduce new dependencies on enterprise systems to keep production running. The challenge is securing the entire interconnected ecosystem while maintaining continuous visibility into the devices, systems and connections that support production operations.

One example is the connection of machine controllers to cloud-based maintenance portals, through which attackers can gain direct access to the production level. Remote access for external service providers - which is necessary for maintaining equipment - also often serves as an entry point if it is not adequately secured. Furthermore, the networking of individual, otherwise self-contained IIoT sensors expands the attack surface to include endpoints that are often difficult to monitor.

Typical examples include remote maintenance access points, IIoT gateways, cloud connectors, and the integration of MES and ERP systems. Each access point introduces additional accounts, interfaces, and service providers. A compromised maintenance account or service USB drive/laptop can thus become a direct bridge into production.

A typical example of an expanded attack surface in production environments is remote maintenance access to machine controllers, such as via VPN connections. While these facilitate maintenance and support, they can become direct entry points for attackers if security measures are inadequate. Another risk arises from connecting production data to cloud platforms, for example, for predictive maintenance. Data is often transmitted via MQTT brokers. Without consistent network segmentation or appropriate mechanisms for authentication and encryption, sensitive data can be intercepted or communication channels exploited. OPC UA also expands the potential attack surface as a communication standard between machines and higher-level IT systems. This is particularly true when security functions such as authentication, certificate verification, and encryption are not consistently implemented. Network nodes also play a central role. If these components are not monitored, unusual communication patterns, connection drops, or other anomalies can go undetected for a long time.

Connecting previously isolated OT systems directly to the Internet drastically increases the attack surface. Our studies show a 332 percent increase in Internet-exposed OT devices, bringing the global total to nearly 20 million assets. If these systems - originally designed for local control - are networked without consistent segmentation, they create easily exploitable entry points for lateral movement throughout the entire network.

There are cases where OT networks were protected with traditional IT firewalls. Due to a misconfiguration, for example, a manufacturer’s auto-update function was not disabled via its cloud connection at one facility, and the firewall disconnected the injection molding or painting machine from the network during the update, resulting in an interruption of the production process. The resulting costs for cleanup and repairs were substantial.

Historically, industrial control systems were largely isolated from corporate networks. Today, attackers are just as likely to target identity systems, ERP platforms or IT/OT integration points because disrupting the business systems that manage production schedules, inventory or quality can have the same operational impact as attacking the control environment itself. In addition, older malware can easily find targets in OT environments that are often vulnerable because they are unpatched and still running outdated operating systems and software. As a result, attackers need less and less specialized expertise to disrupt OT.

Attackers can penetrate production networks via IT systems adapted for integration and, once inside, specifically manipulate or disrupt control systems. Ransomware attacks are particularly critical, as they not only encrypt data but can also cause immediate physical and economic damage by bringing production to a standstill.

An attack can begin in the office IT system via phishing or ransomware and make its way into OT through shared identities, insufficiently segmented networks, or administrative access. Once there, it poses the risk of production downtime, manipulated process parameters, quality deviations, and, in extreme cases, dangers to people and the environment.

The increasing interconnection between IT and OT is creating new attack vectors through which threats can spread from traditional corporate networks into industrial production environments. A key scenario involves lateral movement: Attackers first compromise an IT system - such as one in the office network - and then gradually work their way into OT segments. Ransomware is particularly critical in production. If HMI or SCADA systems are encrypted, entire production lines or supply processes can come to a standstill. Incidents such as those involving Colonial Pipeline or Norsk Hydro have shown that cyberattacks can also have significant operational and economic consequences.

Another risk lies in controllable data that can be manipulated. Industrial protocols such as Modbus lack their own authentication mechanisms. If attackers succeed in gaining access to these communication channels, they can alter process parameters. This can have immediate physical effects on machines, equipment, or employee safety. Added to this are supply chain attacks targeting industrial edge platforms, software marketplaces, and OPC UA servers. If trusted components, updates, or third-party solutions are compromised, attackers can infiltrate numerous connected OT environments via central platforms.
 

Because IT and OT business processes are closely intertwined today, even a single security incident or ransomware attack in traditional corporate IT can force the entire production process to come to a standstill, even if the OT systems themselves were not directly compromised. In critical infrastructure, this poses a risk of serious disruptions to essential utility services.

Security mechanisms that are well-established and effective in IT are often ineffective or insufficient when it comes to OT vulnerabilities and the protocols used there. Malware that has long been forgotten and poses little threat in IT can cause significant damage in OT. IT/OT convergence allows attackers to penetrate production networks from compromised office or ERP environments. In addition to ransomware, lateral movement, supply chain attacks, compromised remote maintenance access, and the manipulation of PLC programs pose significant risks. Unlike in IT, this can result in physical damage, production outages, or safety risks for employees.

The convergence of IT and OT makes collaboration between IT and OT departments essential. IT and OT teams can no longer treat cybersecurity as separate responsibilities because many production processes now depend on shared infrastructure and connected business applications. Security decisions around identity, cloud services or remote access increasingly have operational consequences, which means IT, engineering and plant operations need shared governance, coordinated change management and joint incident response planning. To create security measures that are reliable and safe in OT environments, OT departments need to provide operational expertise and context, while IT teams contribute the latest security know-how.

IT and OT teams must work together more closely and develop joint security strategies, rather than operating separately. IT managers must understand the specific requirements of the production environment, while OT managers must familiarize themselves with traditional IT security concepts. In many companies, new, interdisciplinary teams or roles - such as OT security managers - are being created for this purpose. To achieve this, active communication between both disciplines must be ensured.

OT security is becoming a shared responsibility. IT contributes expertise in identities, networks, and monitoring; production and automation teams understand the processes, safety requirements, and permissible maintenance windows. What is needed are shared asset inventories, risk analyses, emergency procedures, and decision-making processes.

The traditional division of labor - where IT is responsible for the network and security, and OT controls production - no longer works. Instead, joint teams, shared tools, and a common language are necessary. A unified monitoring platform like Paessler PRTG, which monitors both the IT infrastructure and OT devices, makes a tangible contribution here.

Cyber resilience is evolving from a purely IT task into a shared responsibility among IT, production managers, and senior management. IT and OT teams must bridge cultural divides and develop a shared understanding of risk that seamlessly integrates cybersecurity with operational availability, productivity, and safety.

While IT focuses on the security of data, applications, and users, OT focuses on uninterrupted operation. Only experienced production and operations specialists can make the appropriate assessment, which makes collaboration with experts from both fields essential for success. Successful OT security today requires shared leadership structures, coordinated risk assessments, and a common understanding of respective priorities. The separation of IT and production into organisational silos is increasingly becoming a security risk.

The most effective strategy is a layered approach that combines network segmentation, dedicated security boundaries between IT and OT, tightly controlled remote access and continuous monitoring. Organisations should also limit communications between IT and OT to only what production requires and enforce strong identity and privileged access controls. The goal is to prevent an issue in the enterprise network from affecting or propagating to production systems.

The most effective approach is network segmentation, which immediately isolates IT and OT networks from one another following an attack and contains the spread of the threat. Firewalls at the boundaries between IT and OT zones can specifically control and monitor data traffic. This is also recommended within OT zones, provided the systems must be capable of understanding both OT and IT protocols. In addition, today’s next-generation firewalls are capable of detecting, reporting, and even blocking the exploitation of vulnerabilities in IT and OT systems within network traffic. The establishment of secure remote maintenance should also be mentioned here. Increasingly, companies are also adopting zero-trust principles, under which every access attempt must be continuously verified regardless of location or network.

A multi-layered approach to protection has proven effective: robust asset visibility, clearly segmented zones, controlled connections, industrial firewalls, and an OT DMZ (Demilitarized Zone). This is complemented by secure remote access with MFA (Multi-Factor Authentication), time-limited permissions, and logging, as well as system hardening, backups, and vulnerability management tailored to OT environments. Zero Trust is a principle, not a single product.

A key foundation is consistent network segmentation between IT and OT. The Purdue model often serves as a reference here; it divides industrial networks into clearly separated layers, thereby limiting the spread of attacks. For particularly sensitive control environments, unidirectional gateways - known as data diodes - are also used. They allow data to flow in only one direction and prevent connections from less trustworthy networks from directly impacting critical systems. Remote access to OT systems should also be secured according to zero-trust principles. Every access attempt must be clearly authenticated, authorised, and, as far as possible, limited to the time actually needed and the required systems.

In addition, securing open protocols is crucial. OPC UA should always be operated with authentication and encryption. MQTT brokers must be consistently hardened, and access must be strictly controlled. For Modbus, it is recommended to limit communication to authorised sources and clearly defined network paths. Continuous monitoring is another fundamental measure, as only known systems can be effectively protected.

Consistent, risk-based OT segmentation and strict zero-trust principles - in which every human and machine identity is continuously verified - have proven effective. In addition, “red button” capabilities are essential, as they enable the rapid, controlled isolation of critical production areas during IT security incidents to limit the spread of damage.

First and foremost, Layer 2 microsegmentation, because it eliminates the need to modify the configuration of IP addresses, NAT parameters, and the default gateway. On very old machines, this is often not even possible. On top of that, OT security edge gateways also understand the typical protocols and can implement so-called virtual patching. This is important for machines that cannot or are not allowed to have their own endpoint protection. So-called portable inspectors have also proven effective; they can analyze even unnetworked machines, check them for malware, and remove it if an infection is found. This is because such machines are often still vulnerable, for example through USB ports. Furthermore, OT endpoint protection has long been established and can protect both current and older operating systems - such as Windows XP or 2000, as well as Linux - from cyberattacks.

Unlike traditional IT environments, OT networks can't always tolerate active scanning or frequent updates and changes. Passive network monitoring, anomaly detection and integrating OT telemetry into an existing SIEM or SOC allow organisations to identify suspicious activity while minimizing risk to production. The emphasis should be on gaining visibility and understanding device behavior without disrupting operations. When patching isn’t possible, network monitoring and anomaly detection serves as the compensating control.

It is important to use passive monitoring technologies that continuously analyze network traffic without actively intervening or placing a burden on control systems. Anomaly detection based on behavioral patterns also helps identify unusual activity at an early stage. Integrating OT security data into a central SIEM or SOC also provides a holistic view of threats across the entire security infrastructure. Working together, these measures within the OT infrastructure ensure that attacks on production processes are prevented and detected early.

OT monitoring should be log-aware. An anomaly detection system must understand normal plant operations and forward qualified events with process context to SIEM or SOC. Joint response plans involving IT security and automation teams prevent false alarms and risky interventions.

Low-impact, protocol-based queries are the key: Instead of relying on active vulnerability scans, which can destabilize OT devices, platforms like PRTG use standardized queries via SNMP, OPC UA, MQTT, and Modbus that do not interfere with ongoing operations. The PRTG Multi-Platform Probe on Siemens Industrial Edge, for example, enables monitoring directly on-site at the OT network edge without unnecessarily routing data traffic over WAN links. This allows threshold violations and connection failures to be detected early on, so that teams can respond before they result in a production outage.

Effective detection relies on complete visibility across all networked assets and data flows. By combining passive asset detection with AI-powered anomaly detection, unusual network patterns and threats can be identified early and analised in the integrated SOC without disrupting ongoing production operations.

This requires systems that can analyze network traffic and its specific protocols, but that - in the event of a failure - also ensure, via a physical bypass, that the connection is never interrupted. This makes it possible to achieve OT protection without having to wait for the next maintenance windows. In industrial and critical infrastructure environments, these often occur only every 18 months or at even longer intervals. Similarly, the use of portable inspectors requires neither a shutdown nor a reboot of the systems being analised and has no negative impact on ongoing operations - in other words, it is non-intrusive. The same applies to OT endpoint protection, which, while requiring installation, is very lightweight, typically places no burden on the system, and likewise does not require a reboot. All of these systems can transfer the insights they gather to central SIEM or SOC instances so that IT and OT incidents can be jointly assessed and coordinated. A separate OT SOC is also a common option these days.

Organisations need clear ownership across IT and OT, joint risk assessments and incident response plans that address both cyber recovery and production continuity. Just as important is regularly testing those plans with tabletop exercises that include both IT and plant operations, since many organisations don't discover critical dependencies between ERP and production until an actual outage occurs.

Clear responsibilities and defined interfaces between IT and OT teams are the prerequisites for a coordinated security strategy. Contingency plans for IT and OT scenarios must be regularly tested and optimised. In addition, continuous risk analyses are necessary to identify new vulnerabilities early on and adapt protective measures accordingly.

Clear responsibilities, a shared understanding, IT/OT governance, and regular risk analyses based on potential process impacts are required. Emergency plans must cover isolation, restart procedures, communication, and - if necessary - manual operation, and they must be practiced in real-world scenarios. For NIS-2-regulated companies, this is also a legal responsibility of senior management.

Securing OT environments requires not only technical precautions but also clear organisational structures. First and foremost, responsibilities must be clearly defined. Equally important is an established incident response plan that takes into account the specific characteristics of industrial environments. This includes scenarios such as the failure of a production line, the disruption of safety-critical processes, or potential physical damage to equipment. Regular risk analyses, such as those based on IEC 62443, help systematically assess protection needs, prioritize vulnerabilities, and determine appropriate measures. Complete transparency regarding assets is also an essential foundation. For more in-depth, passive OT asset discovery, it is recommended to combine this with specialized OT security solutions. This creates a robust overall picture of the environment that serves as the basis for risk management, incident response, and continuous improvement.

Clear governance structures with well-defined responsibilities at the executive board level are required, as well as regularly rehearsed emergency and recovery plans. In addition, security and cyber resilience must be integrated as a core principle into digital transformation projects and risk analyses from the very beginning, in accordance with the “security-by-design” approach.

The first step is to identify and manage OT assets, as well as to define and classify them according to their criticality. Next, the most critical scenarios that could occur and cause the greatest possible damage and outages should be identified and documented. Contingency plans should be developed based on these scenarios and tested for effectiveness and feasibility through training and exercises. Because both IT and OT are dynamic and subject to constant change, analyses and exercises should be conducted at regular intervals, and emergency plans should be revised. Documenting errors and continuous improvement are essential in this process. Equally important are clearly defined responsibilities among IT, production, and engineering, as well as structured supplier and change management.

Production teams often come from engineering and automation backgrounds rather than networking and security, which is why awareness training is so important. It helps people understand the risks that can come from OT practices that seem harmless, such as giving third-party vendors access to diagnose a faulty system, using default credentials, or sharing accounts. That training should also work in the other direction, helping IT and security teams understand safety requirements and the need to maintain production uptime. I’ve seen manufacturers spend heavily on security risk assessments across IT and OT systems, only for the findings to recommend automatic screen locks on every system. Applied to control room systems, that would of course interfere with safety and production management.

Targeted training helps establish a basic level of security awareness even outside the traditional IT department. This is particularly important because human error - such as when using USB drives or remote access - remains one of the most common causes of security incidents in OT environments.

Production employees serve as an important "sensor". Training should therefore be tailored to specific roles and equipment, addressing phishing, USB drives, remote maintenance, service provider access, and the reporting of unusual incidents. Short, regular drills are more effective than a general annual IT training session.

A central role. Production employees are often not aware of cyber risks. USB drives connected to machines, insecure passwords on HMIs, or carelessly granted remote maintenance access are real attack vectors. Security awareness must be brought into the OT world - tailored to the language and daily routines of shift supervisors and machine operators, not disguised as IT training.

Employee training forms the foundation of OT security because, as OT becomes increasingly interconnected with IT, production staff are increasingly acting as the first line of defense against cyber risks in OT. Training raises awareness of specific threats, such as tampered maintenance access points, and transforms a historically ingrained sense of IT as an “outsider” into an operational security culture. In this way, manufacturing teams learn to identify unusual events early on as potential security incidents and report them in accordance with regulations.

Appropriate training is very important, as is assessing and documenting its results in order to identify and demonstrate improvements. Equally important - if not more so - is familiarizing IT staff with the requirements and challenges of OT so that the company’s strategic objectives, including business success, product quality, and availability, can be taken into account. In practice, experience shows that this challenge is often greater than raising awareness of cyber risks among production staff. In addition to cyber risks, however, aspects such as incident response and emergency drills must also be addressed in training programs.

I recommend starting with a simple framework like NIST CSF and then moving to IEC 62443 as the OT security organisation matures. Both frameworks are designed for industrial environments. NIST CSF offers a practical structure for identifying risks, protecting critical assets, detecting threats, responding effectively, and recovering from incidents. IEC 62443 goes further into OT-specific design principles such as zones and conduits, segmentation, and security levels.

While NIS-2 is an important directive for building cyber resilience across Europe, emphasizing proactive risk management, accountability, incident response, and supply chain risk, it is implemented differently across European countries. As a result, it is often more of a compliance and legal challenge to determine the actual requirements that companies operating across several countries need to meet. Manufacturers often get caught up in meeting regulatory requirements and lose sight of the bigger picture: making IT and OT security run efficiently, supporting business outcomes and ensuring security projects go beyond a simple box-ticking exercise. Real-time asset visibility and network monitoring deliver value beyond cybersecurity and help strengthen a company’s overall operational resilience.

The IEC 62443 standard is considered the key standard and provides concrete guidelines for securing OT systems. In addition, ISO 27001 provides a proven framework for enterprise-wide IT management. The NIS-2 Directive also establishes a general regulatory framework that requires companies to implement appropriate security measures and demonstrate compliance.

ISO/IEC 27001 establishes the overarching information security management system, while IEC 62443 specifies the requirements for industrial automation and control systems. NIS-2 and the BSI Act define the legal framework for affected companies. Manufacturers of networked products and machines should also take into account the Cyber Resilience Act and the EU Machinery Directive.

Several standards and regulatory requirements provide important guidance for securing industrial environments. IEC 62443 is considered the key standard for industrial cybersecurity and covers technical and organisational requirements for OT environments. Among other things, the standard addresses the secure design of industrial communication protocols such as OPC UA. The European NIS-2 Directive is also highly relevant. It directly affects operators of critical infrastructure and their suppliers and requires many industrial companies to systematically expand their cybersecurity measures and implement them in a verifiable manner. ISO 27001, as an established framework for information security management, serves as a suitable foundation for OT-related areas. In addition, the NIST Cybersecurity Framework can be particularly helpful for companies operating internationally.

For European industrial companies, the combination of IEC 62443 and NIS-2 is currently of primary relevance. While IEC 62443 specifies the OT-specific technical and organisational requirements, NIS-2 provides the overarching regulatory framework.

For industrial companies, we recommend a combination of regulatory guidance, a management system, and technical standards: NIS-2 serves as a regulatory guideline, ISO/IEC 27001 as a framework for the information security management system, and IEC 62443 as a technical foundation for OT and Industrial Automation and Control System (IACS) environments. Together, these guidelines help establish IT/OT security in a structured manner, systematically address risks, and ensure that the measures taken are verifiable.

Compliance with IEC 62443 and NIS-2 already provides a very solid foundation. The Cyber Resilience Act (CRA) and the new EU Machinery Regulation (EU) 2023/1230, which takes effect on January 20, 2027, are also becoming increasingly important. The latter applies in particular to companies that manufacture machinery themselves and are subject to the regulation. Compliance is a prerequisite for being allowed to place the machinery on the market in the EU. In addition, ISO 27001 offers an established approach to information security management. This is often underestimated because personal data is processed less frequently. Nevertheless, the data collected and processed is of high and critical importance - for example, production recipes, design data, quality metrics, supply chain and production information, or other trade secrets.