Este contenido aún no está disponible en español. A continuación se muestra la versión en inglés.
Ver en inglésWhat Is OT Security? A Practical Framework & Tips to Stay Secure
Written by: Brenda Buckman
Published: 11/13/2026
Operational technology (OT) is the hardware and software that monitors and controls physical equipment, like PLCs on a production line or SCADA systems at a water plant. OT security protects these systems from cyberattacks. Because an OT incident can halt production or put people in danger, OT security puts safety and availability first.
Operational technology security protects the systems that keep physical operations running, from production lines to pipelines and water treatment plants. When those systems go down, production stops, and in the worst cases, workers and communities face real safety risks.
Many OT systems also can’t be patched or rebooted on IT’s schedule because they stay in continuous service for decades. That makes OT hard to protect and raises the stakes of any security incident, even one that starts somewhere else. In fact, an attack doesn’t have to touch OT to disrupt it.
In May 2021, Colonial Pipeline found ransomware on its IT network and shut down all 5,500 miles of pipeline as a precaution. According to CEO Joseph Blount’s Senate testimony, the company couldn’t yet confirm the malware hadn’t spread to the OT network. Limited visibility forced the shutdown on its own.
That’s why OT needs a security approach built for both operational resilience and prevention. Below, we’ll walk through a practical framework for securing OT, plus the best practices that help you spot and contain threats before they force a shutdown.
Most OT security programs rest on six key pillars they share with IT security, but OT applies each one with safety and uptime in mind. These pillars are inspired by the National Institute of Standards and Technology’s Guide to OT Security:
The biggest difference is what each one protects first. IT security centers on data, so confidentiality usually leads the confidentiality, integrity, and availability (CIA) triad. OT security centers on physical processes, where one wrong move can hurt people or stop production. That’s why NIST’s guide puts safety first in OT, with availability close behind.
Those priorities change which security tools are safe to use. Take active network scans, which send test traffic to devices to find weaknesses. They’re routine in IT, but NIST warns they can destabilize OT equipment or interrupt a running process, so it recommends saving them for planned outages.
Operational technology (OT) | Information technology (IT) | |
Priority | Safety and uptime | Protecting data |
System lifespan | Often 15-30 years or more | Typically three to five years |
Patching | Usually during planned outages; may need vendor approval | Regular cycles, often automated |
Downtime tolerance | Often very low | Varies; many systems tolerate planned reboots |
Protocols | Industrial protocols like Modbus, DNP3, PROFINET, and EtherNet/IP; many were designed without authentication or encryption | Standard protocols like HTTPS and SSH, with encryption and authentication built in |
Note: The table shows common patterns from NIST, not fixed rules. Some IT systems need constant uptime, and newer OT equipment supports modern security features. Most IT controls still apply in OT, as long as operations and engineering staff approve how and when each one goes in.
OT risk comes from two places: the ways attackers get in, and the conditions that make OT harder to protect once they do. We’ll start with five common entry points, then cover what makes them hard to close.
Many OT incidents don’t start in OT. Attackers often break into the IT network first, and because plants commonly share networks, accounts, or systems with IT, ransomware can stop production without ever touching a controller.
That’s what happened to aluminum producer Norsk Hydro in March 2019. After a cyberattack, widely reported to be LockerGoga ransomware, hit the company, it isolated all its plants and switched to manual operations where it could. Hydro later estimated the first week’s impact to cost 300-350 million Norwegian kroner (roughly $35-40 million). One IT incident reached production at every site.
Some OT devices are reachable from the open internet, and many still use the password they shipped with. Together, that gives attackers an easy way in.
In late November 2023, a programmable logic controller (PLC) at a booster station operated by the Municipal Water Authority of Aliquippa, Pennsylvania, began displaying a message from attackers. Staff took the station offline and ran it manually. It turned out to be one of several Unitronics PLCs at US water facilities that attackers had broken into.
The Cybersecurity and Infrastructure Security Agency (CISA) said the attackers likely gained access through weak passwords and internet exposure, and urged operators to change the Unitronics default password, “1111.” The attackers didn’t need an exploit, just a PLC on the open internet that still accepted its factory login.
Many OT systems use the same login system as the rest of the business, usually Microsoft Active Directory. That’s convenient, but it means attackers who steal domain credentials on the IT side may be able to use them to log in to OT.
In February 2024, CISA, the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) reported on a threat group known as Volt Typhoon that stole domain credentials from IT networks. The agencies also saw the group testing access to OT systems, including with default vendor passwords. Any OT system that shares the corporate Active Directory shares its risk.
Remote access tools let employees and vendors manage systems from anywhere, and attackers use the same tools to get in quietly. That’s a bigger problem in manufacturing, where office computers and production equipment often sit on connected networks.
We’re spotlighting manufacturing because it runs on OT, and it’s an industry Huntress tracks closely. In our 2025 Cyber Threat Report for Manufacturing, nearly 10% of the attacks we tracked targeted manufacturers. Our Security Operation Center (SOC) analysts saw a high number of remote access trojans (RATs), malware that gives attackers hidden remote control of a computer. AsyncRAT, NetSupport, and NewCoreRAT led the list.
Attackers also abused Windows Remote Desktop more often than in other sectors and focused on stealing domain passwords. For manufacturers, Windows computers on the network are a common starting point for intrusions that could work their way toward OT.
Many OT environments rely on external vendors and integrators who connect remotely to maintain equipment. Those connections often stay open longer than necessary and receive less monitoring than internal accounts, making them an attractive entry point.
OT security principles backed by CISA and partner agencies flag third parties with OT access as a supply chain risk. Their connections need the same scrutiny as your own accounts.
Although controls like multi-factor authentication (MFA), segmentation, and monitoring can address common OT entry points, teams often face practical barriers to implementing them. Several factors make these protections harder to deploy in OT environments.
With the risks and constraints in view, the next step is choosing a framework to organize your program. These five operational technology security standards and guidance documents cover most needs:
What it covers | Who it’s for | |
NIST's 2023 OT security guide, with threats, safeguards, and tailored control baselines | US organizations and anyone who wants a free, detailed reference | |
A series of industrial security standards covering asset owner programs, risk assessment, and secure products | Asset owners, integrators, and suppliers, especially in manufacturing | |
A sector-neutral operational technology security framework, usable for IT too, built on six functions | Organizations of any size that want one risk language for IT and OT | |
Principles of Operational Technology Cyber Security (2024), six principles led by "safety is paramount" | Executives and OT leaders in critical infrastructure | |
EU directive on cybersecurity and incident reporting. Each member state writes its own law, and many missed the 2024 deadline | Organizations operating in the EU in covered sectors, such as energy, transport, and critical manufacturing. Scope depends on size and country |
The CISA principles are a good first hand-off to leadership because they're short and put safety first before any budget conversation starts. NIST SP 800-82 is where the actual engineering work happens, and it's detailed enough to build controls from.
ISA/IEC 62443 usually enters the picture later, either when a customer or auditor asks for it or when you start including security requirements in supplier contracts.
NIS2 is the one that can't wait. If you operate in the EU, it may already apply to you, and because each country writes its own version of the law, it's a question for legal counsel as much as for the security team.
Each practice below answers a risk or challenge covered above. Run any change past operations and engineering first, and check it against your control system vendor's support terms.
Every other control depends on knowing what's on the network. Follow the five steps in CISA's asset inventory guidance, start with passive discovery tools, and save active scans for planned outages.
Segmentation helps prevent IT infections from spreading to industrial controllers. Block direct connections from corporate networks to OT and place shared systems, such as historians, in a demilitarized zone (DMZ) between them, in line with CISA's OT security principles. Use a zero trust model to define which connections are allowed, then test the rules to ensure they don't disrupt critical operations.
Colonial's attackers gained access through a virtual private network (VPN) account with only single-factor authentication. Require MFA on every remote path into OT, using a VPN or gateway in front of devices that can't support it. Change default passwords, route vendors through a monitored jump host, and treat every account that can reach OT as privileged.
PLCs can't run security software, but the Windows computers around them can, and that's where many intrusions first show up.
Use passive network monitoring for controllers and endpoint detection and response (EDR) on HMIs, engineering workstations, and jump hosts where your vendor supports it. Then make sure someone reviews the alerts 24/7.
Patch during planned outages, as NIST recommends. When a system can't be patched, document the compensating controls you're using instead, like tighter firewall rules or turning off unused services.
When Norsk Hydro was hit, plants that could switch to manual operations kept producing. Find out now which of your processes can run by hand, and decide who has the authority to stop production before you’re forced to. Keep offline backups of PLC logic and HMI projects, test a restore every so often, and run at least one tabletop exercise with IT and OT staff together.
OT security requires multiple tools because no single solution covers every system or threat. Most teams combine network monitoring, endpoint protection, and access controls with security orchestration to bring alerts into a single workflow. Key tools include:
To evaluate endpoint security for operational technology, start in a lab or test environment. Confirm with the control-system vendor that the agent is supported, then validate that the protected endpoint continues to operate normally.
Confirm with your control system vendor that the agent is supported. Then install it on your oldest supported HMI and verify that the control software still operates normally.
When you weigh MDR for operational technology security, ask each provider which OT-connected systems they can monitor and which they can't.
Operational technology security comes down to understanding how OT integrates with your broader cyber operations, enabling teams to detect and respond to threats across IT and industrial systems.
Huntress Managed EDR includes human-led AI-centric 24/7 SOC monitoring for supported endpoints, detecting threats like persistent footholds, malicious process behavior, and ransomware. When analysts confirm a threat, they contain it and provide clear remediation steps.
Huntress Managed EDR can help protect supported Windows, macOS, and Linux endpoints connected to business or operational environments. Organizations should pair endpoint protection with separate OT-aware network monitoring for PLCs, controllers, SCADA systems, and industrial protocols.
OT is the work of keeping attackers away from the equipment that runs physical processes, like the controller that opens a valve or the workstation an operator uses to start a production line. The tools overlap with IT security, but the priorities don't. In OT, keeping people safe and the process running comes before protecting data.
OPSEC (operational security) follows five steps to identify sensitive information, assess potential threats and vulnerabilities, and reduce the risk of exposure. Here are the steps:
When ransomware hit Norsk Hydro in 2019, the aluminum producer switched some operations to manual procedures while restoring affected systems. This illustrates OT security in action: responding to a cyberattack while keeping industrial operations running safely.
No. SCADA is one type of OT that lets operators monitor and control equipment across remote sites, such as checking pipeline pressure and closing valves from a central location. OT also includes factory-line controllers and distributed control systems (DCS) that manage refinery operations. A facility can have OT without using SCADA.
