TL;DR
- IT/OT convergence connects plant-floor systems built for decades of uptime and safety, not for the patch cycles and endpoint agents IT security assumes, and new industry data shows 96% of OT security incidents now originate as IT-level compromises.
- Attackers increasingly treat operational technology as the primary target rather than a side effect of an IT breach, since stopping production is the fastest way to force a payout.
- Segmentation built on IEC 62443 zones and conduits, OT-aware monitoring, and a tracked “convergence debt” ratio matter more than deploying standard IT security tools directly onto the plant floor.
On August 31, 2025, Jaguar Land Rover detected a cyberattack against its IT infrastructure and immediately shut down every connected system it operated, including the production lines at its Solihull, Halewood, and Wolverhampton plants. JLR could not confirm its manufacturing environment was isolated from the compromised IT network, so it chose to stop building cars rather than risk finding out the hard way.
Production stayed offline for nearly six weeks, with normal output not restored until October 8. UK vehicle production for September fell to its lowest level since 1952, and the direct cost to JLR reached £196 million in a single quarter. The UK government stepped in with a £1.5 billion loan guarantee to keep JLR’s suppliers solvent through the shutdown.
The UK’s Cyber Monitoring Centre, an independent body whose members include former National Cyber Security Centre officials, later classified the incident as a Category 3 Systemic Event, its third-highest severity rating on a five-point scale, and put the total cost to the UK economy at roughly £1.9 billion, calling it the most economically damaging cyberattack in British history.
The attack was claimed by a collective known as Scattered Lapsus$ Hunters, drawing members from Scattered Spider, Lapsus$, and ShinyHunters, groups better known for identity-based intrusion techniques such as social engineering and SIM-swapping than for exploiting software vulnerabilities.
No public evidence has emerged that malware reached a robot arm or a PLC on the assembly line. The plant floor stopped anyway, because nobody could prove where the compromised IT network ended and the operational environment began.
What Is IT/OT Convergence, and Why Does It Create a Security Gap?
IT/OT convergence is the connection of operational technology, the PLCs, SCADA systems, and industrial controllers that run physical processes, to the same IT networks, cloud platforms, and remote access tools that run everything else in the business.Manufacturers adopted this connectivity for sound reasons: predictive maintenance, remote monitoring, and real-time production data all require OT systems to communicate with IT systems.
That connectivity has broken an assumption security teams relied on for years, and the data now confirms it at scale. TXOne Networks’ 2026 Annual OT/ICS Cybersecurity Report, based on a survey of 200 C-level OT security decision-makers, found that 96% of OT security incidents in 2025 stemmed from IT-level compromises, either through direct penetration or as collateral damage from an IT-side attack.
Why Do IT Security Controls Fail on the Plant Floor?
IT security controls fail on the plant floor because OT environments were not built for the assumptions IT security depends on. Four structural differences explain why, and 60% of organizations in the TXOne survey experienced an OT security incident in the past year, with half of those facing more than one.
- Uptime outranks patching: A production line generating revenue every hour cannot take a Tuesday-night patch window the way an office laptop can. Many OT systems run for years between maintenance shutdowns, which is often the only point when patches get applied.
- Legacy protocols were not built with authentication: Protocols such as Modbus and DNP3 were designed decades ago for isolated networks, not for a world where those networks reach the internet. Many will accept commands from any device that can reach them.
- Standard IT agents can crash industrial equipment: An endpoint agent or vulnerability scan that is routine on a Windows laptop can overload a programmable logic controller never designed for that kind of traffic, turning a routine scan into an unplanned outage.
- Visibility gaps hide the incident, not just the attacker: Dragos found that 30% of its 2025 incident response cases began as unexplained operational anomalies, and 82% of organizations had no defined criteria for when an anomaly should trigger investigation at all.
These are structural mismatches between a security model built for confidentiality and an environment built for safety and continuous operation, and no amount of IT security budget closes that gap alone.
What Does an Effective IT/OT Security Framework Look Like?
An effective IT/OT security framework treats the plant floor as its own environment with its own rules, connected to IT through deliberately controlled paths rather than a flat network. Two standards anchor this in practice, and each serves a different purpose.
ISA/IEC 62443, the international standard for industrial automation and control system security, is where the zones and conduits model comes from. A zone groups assets that share the same security requirements and criticality level. A conduit is the only permitted path of communication between zones, and it is where firewalls, industrial data diodes, or monitored gateways belong.
IST SP 800-82 complements this with a broader, risk-based approach to threat identification and control selection across the full ICS lifecycle and remains the primary reference for US federal and federally adjacent organizations.
Both standards map onto the Purdue Enterprise Reference Architecture, the layered model most OT engineers already think in.
- Level 0: Covers the physical process itself, the sensors and actuators.
- Level 1: Covers basic control, the PLCs and RTUs that read those sensors and issue commands.
- Level 2: Covers area supervisory control, the HMI and SCADA systems operators watch.
- Level 3: Covers site operations, including manufacturing execution systems and historians.
- Level 3.5: Explains the industrial DMZ, a buffer zone IEC 62443 recommends specifically so IT and OT never connect directly.
- Levels 4 and 5: Cover business systems and the enterprise network, where standard IT security already operates.
Segmentation work almost always starts by building or hardening that Level 3.5 DMZ, since it is the single conduit most convergence risk flows through
Four elements make this practical rather than theoretical.
- Zone and conduit segmentation: Group OT assets by function and safety criticality, then place a monitored boundary at every point where one zone connects to another or to IT, rather than relying on a single firewall rule.
- Passive monitoring before active controls: Deploy monitoring that reads network traffic without injecting traffic into the OT environment, since active scanning risks disrupting fragile industrial equipment.
- Governed remote access: Every VPN, vendor connection, and jump host into OT should require multi-factor authentication, session logging, and a defined expiration, since remote access is now the most common path attackers use to reach the plant floor.
- Shared visibility across IT and OT telemetry: Feed OT-aware signals into the same SIEM and XDR platforms your SOC already uses for IT, so an analyst reviewing a Windows alert can see whether it touches an engineering workstation before dismissing it as routine noise.
How Do You Implement IT/OT Segmentation Without Disrupting Operations?
Implementing segmentation without disrupting operations starts with the asset visibility work above, not a firewall change. Once you can see what you have, run implementation in five steps.
- Confirm your asset inventory is current before touching any configuration: If the visibility work above is not done, do that first. Segmentation built on an incomplete inventory recreates the same blind spots in a different shape.
- Define zones and conduits: Group assets by safety criticality and production function, then map precisely which conduits need to exist between zones, using the IEC 62443 model as the template.
- Deploy passive monitoring first: Establish visibility into OT traffic before any segmentation change, so you have a baseline to compare against once controls go live.
- Test changes in a planned maintenance window with OT engineers present: Segmentation changes made unilaterally by IT, without plant engineers in the room, remain a common cause of unplanned production stoppages during OT security projects.
- Govern remote access as a production-critical system: Dragos recommends this exact shift: treat every vendor VPN and jump host into OT with the same seriousness as the equipment it connects to.
| Ready to close the gap between your IT and OT environments? Talk to Ampcus Cyber’s ICS Security team about a segmentation, visibility, and convergence debt assessment built around your production environment. |
People Also Ask:
What is the difference between IT security and OT security?
IT security protects data confidentiality across networks, applications, and endpoints. OT security protects the safe, continuous operation of physical processes, so availability and safety typically outrank confidentiality as the top priority.
Can a cyberattack physically damage plant equipment?
In some documented cases, attackers have manipulated industrial control logic to cause physical damage. More commonly, the risk is production stoppage, since many organizations shut down operational systems as a precaution the moment an IT breach is confirmed, exactly as JLR did in 2025.
Does air-gapping still protect OT networks?
True air-gapping rarely exists in practice anymore. Most operational environments now have some form of remote access, vendor connection, or cloud link for maintenance and analytics, which makes segmentation and governed access more important than assuming isolation.
Do I need IEC 62443 or NIST SP 800-82 for OT security?
Most organizations benefit from both. IEC 62443 provides the zones and conduits segmentation model and is the standard referenced internationally and increasingly by regulators outside the United States. NIST SP 800-82 provides broader risk assessment and control guidance and remains the primary reference for US federal and federally adjacent organizations. Neither replaces the other.
How often should IT/OT segmentation be reassessed?
Segmentation should be reviewed whenever a new vendor connection, remote access path, or IT integration is added, and formally reassessed at least once a year through a tabletop exercise or penetration test focused on the IT/OT boundary.
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
