Operational technology environments are under growing pressure from sophisticated cyber threats, yet many industrial organizations still rely on legacy defenses that were never designed for today’s connected factories and utilities. In this IIoT World strategy guide, we examine practical, forward-looking approaches to OT security, covering network segmentation, asset visibility, zero-trust architectures, and cross-functional IT/OT governance. Whether you manage a single plant or oversee critical infrastructure across multiple sites, these frameworks will help you build a security posture that adapts as threat landscapes shift, regulatory requirements tighten, and digital transformation accelerates.
Cyber threats are evolving at an unprecedented pace, and regulations are tightening across industries. In a recent conversation at the S4 conference, Vivek Ponnada, SVP of Growth & Strategy at Frenos, shared valuable insights on how organizations can bolster their Operational Technology (OT) security posture. Frenos, a startup backed by recent seed funding, focuses on prioritizing risks and delivering immediate value to its customers.
The Need to Act Before Regulations Demand It
Vivek emphasized the importance of proactive action rather than waiting for regulatory mandates. “Waiting for regulations is like waiting for the doctor to tell you to stop eating fries because you’re at risk of a heart attack,” he said. Organizations must recognize that OT security has long been an underserved segment, often overshadowed by IT security. With increased attention from companies like Moody’s and insurance providers, now is the time to address OT security vulnerabilities.
Common Mistakes in OT Security Implementation
One of the most critical mistakes Vivek highlighted is treating OT security as a “science project.” Many companies delay action by embarking on lengthy, complex assessments that take months to complete. “There’s already 15+ years of experience and proven solutions in the industry,” he said. Rather than trying to “boil the ocean,” organizations should focus on quick wins to build momentum and demonstrate value.
Shifting the Value Proposition Beyond Insurance
Security tools are often seen as an insurance policy—essential but non-revenue-generating. Vivek advised vendors to showcase value beyond risk mitigation. For instance, upgrading infrastructure not only enhances security but can also improve reliability, uptime, and operational efficiency. “If security investments align with revenue goals, decision-makers are more likely to prioritize them,” he noted.
Addressing the Skilled Labor Shortage with Automation
The OT security industry faces a significant skills gap. With limited talent available, automation becomes a key enabler of resilience. “We can’t solve the labor shortage overnight,” Vivek said, “but we can use AI and automation to empower existing teams.” By implementing policies that streamline processes and facilitate knowledge sharing, companies can extend the capabilities of their workforce across multiple sites.
Frenos’s Approach: Faster, Continuous OT Security Assessments
Vivek explained that one of the biggest challenges in OT security is the delayed realization of value. Traditional approaches often require 12 to 24 months before tangible results emerge. Frenos aims to address this by offering repeatable, consistent, and continuous assessments. This approach allows organizations to identify and address high-priority risks immediately rather than waiting for extensive assessments to conclude.
The Low-Hanging Fruit: Security Awareness Training
When asked about the easiest immediate action organizations can take, Vivek pointed to employee training. “The biggest risk often comes from a lack of security awareness,” he said. By educating employees about security best practices, companies can significantly reduce insider threats, whether malicious or accidental. Awareness programs are cost-effective and yield quick, substantial benefits.
Using Safety as a Model for Security
Drawing from his experience at S4’s metrics challenge, Vivek advocated for leveraging safety protocols as a model for security initiatives. “Many OT professionals already understand the importance of safety training, regular checks, and protective equipment,” he said. Organizations can use familiar safety metrics, like near-misses, and apply similar concepts to track and manage cybersecurity incidents.
Looking Ahead
The conversation with Vivek underscores the urgent need for proactive, practical, and people-focused strategies in OT security. As cyber threats grow more sophisticated, companies must prioritize risk, invest in automation, and build a culture of security awareness.
About the author
Lucian Fogoros is the Co-founder of IIoT World.
Related articles:
- Strengthening OT Supply Chain Security: Key Insights from S4 Conference
- Fortinet’s Approach to OT Security: Bridging IT and Industrial Worlds with Ruggedized Solutions
FAQ Section
1. Why is OT security harder to manage than traditional IT security?
OT networks often run legacy protocols such as Modbus and DNP3 that lack built-in authentication or encryption. Patching cycles in OT are far longer because downtime directly affects production; many ICS devices operate on 15 to 20 year lifecycles. The convergence of IT and OT has expanded the attack surface, and a 2024 SANS ICS survey found that 70% of organizations experienced at least one OT security incident in the prior 12 months. These factors demand purpose-built strategies rather than simply extending IT security tools into the plant floor.
2. What does a zero-trust approach look like in an industrial environment?
In an industrial context, zero trust means verifying every device, user, and data flow before granting access to any network segment. Micro-segmentation is applied at the cell or zone level following the IEC 62443 framework, so a compromised HMI cannot laterally reach safety controllers. Continuous monitoring of east-west traffic inside the OT network replaces the older perimeter-only model. Multi-factor authentication is enforced for remote maintenance sessions, and least-privilege policies ensure that vendor laptops can only reach the specific assets they need to service.
3. How should organizations prioritize OT security investments?
Start with a comprehensive asset inventory, because you cannot protect what you cannot see; many plants discover 30% to 40% more connected devices than documented. Next, invest in network segmentation and passive monitoring tools that do not disrupt real-time processes. Finally, build an incident response plan that includes both IT and OT stakeholders, with tabletop exercises run at least twice a year. Aligning spending with risk-ranked assets, such as safety instrumented systems first, ensures limited budgets deliver the highest reduction in residual risk.
Related from IIoT World:
