What Is OT Security? Operational Technology Cybersecurity Explained
OT security protects industrial control systems from cyberattacks with physical consequences. What PE firms with industrial portfolios should know.
What Makes OT Security Different from IT Security
OT environments present security challenges that are fundamentally different from conventional IT environments, and applying IT security practices directly to OT systems often fails or causes harm.
Availability over confidentiality. IT security prioritizes the CIA triad in order: Confidentiality, Integrity, Availability. OT security inverts this. A manufacturing line that stops because a security patch caused a compatibility issue costs thousands or hundreds of thousands of dollars per hour. A power grid that goes offline because a firewall rule change disrupted communication between substations can affect hundreds of thousands of people. In OT environments, availability is the primary security objective — a dead plant is a catastrophic security failure regardless of whether data was exposed.
Legacy systems with no patch path. OT environments routinely run industrial control systems with 20-30 year operational lifespans. A programmable logic controller (PLC) installed in 2005 controlling a production line may be running firmware that has not been updated since installation, cannot be updated without equipment downtime or vendor involvement, and runs protocols that predate modern security considerations. IT patch management practices cannot be applied to systems that cannot be patched.
Air gap erosion. OT environments were historically air-gapped — physically isolated from corporate IT networks and the internet. Digital transformation, remote monitoring requirements, supply chain integrations, and operational efficiency initiatives have eroded these air gaps. Most OT environments now have some connectivity to corporate IT networks and, through them, to external systems. The connectivity that enables remote monitoring and supply chain integration also provides an attack path from a compromised IT environment into OT systems — exactly the path the Colonial Pipeline attackers would have exploited if they had reached OT systems rather than stopping at IT.
The OT Threat Landscape
OT cyberattacks are no longer rare events. The ICS-CERT and CISA document incidents across every critical infrastructure sector. The most significant documented OT attacks demonstrate the range of attacker capability and objective.
TRITON/TRISIS (2017) targeted safety instrumented systems at a petrochemical plant in Saudi Arabia — attempting to disable safety systems designed to prevent catastrophic equipment failures and explosions. This was the first documented attack specifically targeting safety systems rather than operational disruption or data theft. The intent was not ransomware. It was physical harm.
Ukraine power grid attacks (2015, 2016) used BlackEnergy and Industroyer malware to manipulate operational technology systems controlling power distribution, causing blackouts affecting hundreds of thousands of civilians. These were nation-state attacks demonstrating capability to use OT compromise as geopolitical leverage.
Colonial Pipeline (2021) did not breach OT systems — the IT compromise caused the company to proactively shut down OT systems as a precautionary measure because they lacked confidence in the IT/OT network boundary. The lesson: OT and IT are interdependent. A significant IT compromise forces OT decisions even when OT systems themselves are not directly compromised.
OT Security for PE Due Diligence
For PE due diligence on industrial, manufacturing, energy, utilities, or critical infrastructure companies, OT security is a distinct risk domain that requires specialized assessment. The questions are different from IT security: What is the network segmentation between IT and OT environments? Are OT systems patched or patchable? What is the detection capability in the OT environment? Does the organization have an OT-specific incident response plan? Has the OT environment been assessed by specialists in ICS/SCADA security?
OT security findings can be material to investment thesis. A manufacturing company where the OT environment is fully accessible from the corporate IT network, where OT systems run unpatched firmware, and where there is no detection capability in the OT environment has an attack surface that directly threatens production continuity — the asset the PE firm is acquiring. An OT ransomware event that shuts down production for weeks is an existential event for many manufacturing businesses.
Related Reading
What is OT security?
OT (Operational Technology) security is the cybersecurity of systems that monitor and control physical processes — manufacturing equipment, power grids, pipelines, water treatment systems, and industrial control systems. Unlike IT security, which primarily protects data and business operations, OT security protects physical processes where failures can cause production shutdowns, equipment damage, or physical harm.
What is the difference between OT and IT security?
IT security prioritizes confidentiality, integrity, then availability. OT security inverts this: availability is paramount because an OT system outage means production stops, physical processes fail, or public services are disrupted. OT systems also have much longer operational lifespans (20-30 years), run legacy software that often cannot be patched, and historically relied on physical isolation (air gaps) for security rather than active defense controls.
What is ICS/SCADA security?
ICS (Industrial Control Systems) and SCADA (Supervisory Control and Data Acquisition) are the specific technologies used to monitor and control industrial processes. ICS security and SCADA security are subsets of OT security focusing on these specific system types. They require specialized knowledge of industrial protocols (Modbus, DNP3, IEC 61850), vendor-specific platforms, and the engineering context of the physical processes being controlled.
Why is the IT/OT network boundary important?
The IT/OT network boundary determines whether a compromise of corporate IT systems can propagate into OT systems controlling physical processes. Organizations with well-segmented IT/OT boundaries can contain IT compromises before they affect production. Organizations with eroded boundaries — where corporate IT networks have direct connectivity to OT systems — risk OT compromise through IT attack paths. Colonial Pipeline shut down OT systems proactively during an IT compromise because they lacked confidence in their IT/OT boundary integrity.
What OT security questions should PE due diligence ask?
Key OT due diligence questions: What is the network segmentation between IT and OT environments? Are OT systems patched or patchable, and on what schedule? What detection and monitoring capability exists in the OT environment? Is there an OT-specific incident response plan? Has an ICS/SCADA security specialist assessed the OT environment? What is the consequence of OT system outage to production continuity?
Colonial Pipeline: The IT/OT Boundary Decision Under Pressure
When DarkSide ransomware encrypted Colonial Pipeline's IT systems in May 2021, the company made the decision to shut down its OT pipeline management systems proactively — not because those systems were compromised, but because the company lacked confidence that its IT/OT network segmentation was sufficient to prevent the ransomware from propagating from IT into OT. The result was 17 days of disrupted fuel delivery across the US East Coast, fuel shortages, panic buying, and $4.4M in ransom payment. The OT systems themselves were not attacked. The IT compromise forced an OT decision because the boundary between them was insufficiently trusted. This is the OT security lesson PE operating partners most need to internalize: OT risk is not limited to direct OT attack. IT compromise forces OT decisions, and those decisions — made under pressure, without confidence in network boundaries — can be more disruptive than the IT incident itself.
of industrial organizations experienced a cyberattack on their OT environment in the past year, according to Claroty's Global State of Industrial Cybersecurity report. The convergence of IT and OT networks driven by digital transformation has made OT environments accessible attack targets — with physical consequences that IT-only breach economics dramatically understate.