The vendor who killed the plant. Third-party remote access is OT's most predictable attack vector.

Every industrial facility has a list of vendors who need remote access to do their jobs: the SCADA integrator, the PLC manufacturer's support team, the historian vendor, the building management contractor. In most plants, that access is granted once and never reviewed again. The engineer who set it up has left. The vendor's own security posture has changed. The credential is still valid, still trusted, and still points directly at the control network.

Claroty's 2026 State of OT Security report puts third-party access involvement at 58% of confirmed OT breaches. The mechanism is consistent: a contractor credential is compromised — through phishing, credential stuffing, or purchase from an access broker — and the attacker inherits whatever level of trust the vendor was given. In OT, vendor trust is often very high: the integrator who commissioned the system has the same access as the engineer who runs it.

IT vendor access is typically scoped: a managed service provider gets access to specific systems, monitored through a privileged access management platform, with session logging and time-limited credentials. OT vendor access is typically scoped by conversation: the vendor calls, someone gives them a VPN credential, and the session is invisible until something goes wrong. The difference is not about technology. It is about whether the organization has ever treated vendor access as a risk category.

The initial access broker market has made this worse. Stolen RDP and VPN credentials for industrial companies are listed on criminal forums with the target sector and region included. A buyer does not need to know which vendor has access or which credential works — they buy a batch and try them. The ones that reach OT networks are worth considerably more than the ones that stop at an IT boundary, which is an incentive to find environments where no such boundary exists.

The architecture is straightforward: all third-party access goes through a dedicated OT access gateway, never through a general-purpose VPN. Every session is time-limited and requires approval before it opens. Every session is recorded. Credentials are rotated after each use, so a stolen credential from a previous session is worth nothing. The vendor's access is scoped to the specific system they support, not the entire network segment it lives on.

The harder part is the process. Someone has to own the vendor access register, review it quarterly, and remove access when a contract ends or a point of contact changes. That is an operational discipline, not a technology purchase. The technology already exists. The question is whether the plant treats vendor access as a standing risk item on the same list as physical security and fire suppression.