How critical infrastructure organizations can secure identities, privileged access, and legacy assets across OT, IT, and cloud environments

Why Is Identity Security Harder in OT?

Identity security is especially challenging in operational technology because these environments combine long-lived assets, segmented networks, safety-critical processes, third-party access, and intermittent connectivity. Security controls must reduce cyber risk, preserve availability, and allow technicians to act quickly when physical operations are at stake.

The threat is significant. Credential-based attacks accounted for 80% of initial-access cases involving access brokers, according to Microsoft’s 2025 Digital Defense Report. In enterprise IT, organizations can often apply identity and access management across a relatively standardized technology environment. Operational environments are far more varied, bringing together modern systems, legacy assets, site-specific infrastructure, and vendor-managed equipment. As a result, they may depend on multiple identity providers, local accounts, shared credentials, and devices that do not support authentication methods.

Critical infrastructure organizations must also maintain separation among IT systems, demilitarized zones (DMZs), and operational sites. Guidance such as NIST SP 800-82 and the CISA Cross-Sector Cybersecurity Performance Goals emphasizes segmentation, strong authentication, and controlled remote access. The challenge is applying these principles without burdening users with dozens of credentials or making secure access dependent on continuous cloud or enterprise connectivity.

These conditions create five recurring identity security challenges: friction caused by multiple identities across environments, legacy assets that lack modern access controls, shared accounts that weaken accountability, privileged accounts that remain active too long, and identity services that must continue operating when remote sites lose connectivity.

1. Multiple Identities Create User Friction

Maintaining separate identity domains helps contain risk. A compromised IT credential should not automatically provide access to operational assets, and a breach at one site should not expose every other location. This separation is essential for security, but it can create significant friction for users and identity administrators.

The impact becomes operational when a technician needs to reach a faulty controller quickly. Unclear account ownership and inconsistent access paths can delay maintenance and encourage insecure workarounds.

Organizations can preserve identity boundaries while simplifying access through centralized policy orchestration. A policy layer can map each authorized user to the appropriate identity provider, role, asset, application, location, and time window. Users gain one governed access experience, while the underlying directories, credentials, and local policies remain separated and protected.

2. Legacy OT Assets Lack Modern Identity Control Support

Many operational assets were designed for reliability and long service life rather than compatibility with Active Directory (AD), single sign-on (SSO), or modern multifactor authentication (MFA). Installing security agents directly on these devices may be unsupported, operationally risky, or simply impossible.

As remote support, cloud analytics, AI, and IT-OT convergence expand, the protection once provided by isolation continues to erode. Each new connection creates another potential path to systems that were never built to defend themselves against modern identity-based attacks.

Organizations can address this gap by placing identity-aware enforcement in front of legacy assets. Access gateways and security overlays can authenticate users with MFA before a session reaches the device, apply authorization policies, restrict access to approved applications or commands, and record each interaction. This adds modern identity controls without requiring firmware changes, equipment replacement, or production downtime.

The access model must also support remote and hard-to-reach environments. For assets on offshore sites, remote wind farms, and similar sites, authentication workflows need secure alternatives when users cannot physically interact with the device.

3. Shared Accounts Eliminate Accountability

Shared accounts often emerge when a device cannot support individual user identities or when contractors need temporary access. Although convenient, they create a serious accountability gap: teams may be able to identify the account used during an incident without knowing who actually used it.

A safer approach is to authenticate every person with an individual, attributable identity while brokering access to devices that still depend on a shared local credential. The access platform can verify the user, enforce policy, inject or rotate the device password, and record the session without exposing the underlying credential.

Granular logging strengthens both security and operations. Teams can trace actions to a named user, distinguish malicious activity from an honest mistake, and investigate incidents with greater confidence. This reduces uncertainty, speeds recovery, and makes temporary third-party access easier to govern.

4. Privileged Accounts Remain Active Too Long

Critical infrastructure organizations often grant elevated access to vendors, integrators, contractors, and administrators for specific tasks. When deprovisioning depends on manual follow-up across multiple sites and identity systems, those accounts can remain active long after the work is complete.

Dormant privileged accounts create an attractive target because they retain broad permissions while receiving little day-to-day scrutiny. If compromised, they can give attackers a direct path to sensitive systems and operational assets.

Privileged access should be temporary, task-specific, and automatically removed when the approved window ends. An effective PAM process ties access to a ticket or authorized task, limits the assets and applications a user can reach, enforces MFA, and expires access automatically.

Just-in-time (JIT) provisioning, approval workflows, and credential rotation further reduce exposure. For standing privileges that cannot yet be eliminated, periodic entitlement reviews help confirm that access is still necessary and appropriately scoped.

5. Connectivity Outages Disrupt Centralized IAM

Remote industrial sites often depend on satellite links or other wide-area network connections that are less reliable than those in populated areas. Mines, offshore platforms, pipelines, and wind farms must continue operating safely even when connectivity is unavailable for hours, days, or longer.

A centralized enterprise IAM architecture can create two unacceptable outcomes when connectivity is disrupted: authorized users lose access to critical systems, or administrators weaken controls to keep work moving. Either response increases operational risk.

Access controls should therefore continue enforcing policy locally when a site is disconnected. Offline-capable enforcement keeps authentication, authorization data, and least-privilege policies close to the assets, allowing approved users to work without relying on a live cloud connection.

The system should also preserve audit continuity by recording activity locally, queuing logs, and synchronizing policy changes and session data when connectivity returns. This maintains secure access and accountability without making operational availability dependent on the network.

What Should an OT IAM and PAM Solution Include?

An OT-ready IAM and PAM solution should unify policy across identity domains, manage and secure credentials, enforce MFA down to individual assets, operate offline, log every interaction, control machine identities, and restrict users to approved applications. These capabilities support Zero Trust without requiring organizations to replace functioning OT assets.

Key Takeaways

• Identity segmentation limits blast radius, while orchestration reduces user friction.
• Automated machine-to-machine segmentation restricts lateral movement and continuously enforces least-privilege communications between assets.
• Legacy OT devices need compensating controls that do not require direct IAM integration.
• Individual identity attribution and credential brokering are safer than shared accounts.
• Privileged access should be just-in-time, limited, logged, and automatically expired.
• Remote sites require local, offline-capable enforcement and audit continuity.
• Effective OT Zero Trust controls users, devices, applications, and machine-to-machine access.

OT identity security succeeds when strong controls fit operational reality. The goal is to enforce least privilege and accountability across every layer while keeping critical processes available and giving authorized users a fast, reliable path to the assets they need.

About the Author

Roman Arutyunov is the Co-Founder and Chief Product Officer at Xage Security. Roman leads the product vision and go-to-market with experience in security, networking, and industrial applications. Prior to Xage, led Product and Engineering at ABB, Tropos Networks, and Blue Coat Systems solving security, networking and data analytics challenges for industrial and commercial enterprises enabling millions of IoT devices in production today. Earlier in his career, Roman worked on the first generation of Content Distribution Networks (CDN) and Proxy Servers at Blue Coat Systems (Symantec). Roman holds a Bachelor’s in Applied Mathematics with an emphasis in Computer Science from the University of California, Berkeley and an MBA from Columbia University.

More Blogs by Roman Arutyunov

LinkedIn