Digital transformation flattened your OT network. Here's how to rebuild the boundary.

Ten years ago, the typical industrial network had a clear boundary: a DMZ between the IT and OT sides, a historian in the middle, and a firewall that allowed data out but nothing in. That boundary has been eroding since the first remote monitoring dashboard was deployed. Each new connectivity project — a cloud-connected sensor platform, a vendor remote support portal, an ERP integration that pulls production data in real time — opens a path that was not there before.

The Dragos 2026 Year in Review finds 68% of OT environments assessed have no meaningful IT/OT boundary: the network is flat enough that a foothold in the IT environment translates to reachability of the OT environment without traversing a security control. This is not a finding that surprises the people who run those networks. What surprises them is that nobody treats those integrations as a security boundary that requires protection.

Digital transformation in manufacturing and critical infrastructure generates real operational value: better visibility, faster response to process deviations, data-driven maintenance scheduling, and supply chain integration. None of that value goes away when you add security controls. But it does require acknowledging that every integration between the IT and OT environments is a potential path for lateral movement, and that each path needs to be designed, monitored, and reviewed.

The convergence tax is the security debt that accumulates when integrations are built for operational value without security review. A data historian that was read-only when it was installed now has a write-back interface because a vendor needed it for calibration. A remote access VPN that was vendor-only is now also used by the operations team because it was convenient. Neither change was malicious. Both change the attack surface in ways that were not assessed at the time.

You cannot take a production network offline to re-segment it. The approach has to be additive: map what exists, identify the highest-risk paths, and close them one at a time in maintenance windows. The map comes first. Most organizations discover integrations during the mapping exercise that nobody on the current team installed or knew about. Every unknown path is a risk that exists regardless of whether it is on the diagram.

The priority order is almost always the same: close direct IT-to-OT paths at the network layer first, then address application-layer integrations, then deal with remote access. The firewall that should exist between the plant floor and the corporate network is the highest-leverage control, because it constrains everything above it. Once that boundary exists and is monitored, the integrations that cross it become manageable — you know what they are, you can see their traffic, and you can evaluate whether each one is worth the risk it introduces.