The IT→OT Attack Path Everyone Has and Almost No One Tests
Lateral movement from enterprise networks into industrial systems is the attack vector most organizations fail to secure
A single VPN password. No multi-factor authentication. That's all it took to trigger the Colonial Pipeline shutdown in May 2021, cutting fuel supplies across the East Coast and costing the company $4.4 million in ransom. The attackers didn't breach the pipeline's operational technology directly. They walked through IT systems first, then moved laterally into the environments that controlled fuel flow.
The Pattern No One Talks About
This wasn't an anomaly. According to Dragos' 2024 OT Cybersecurity Report, approximately 70% of OT-related incidents originated from within the IT environment. Yet when organizations assess their industrial cybersecurity posture, they focus on OT vulnerabilities while the real shadow current flows unmonitored at the IT-OT boundary.
The Convergence Everyone's Building
IT-OT integration isn't coming. It's here. Zero Networks projects that 70% of OT systems will connect to IT networks within the next year, and the IT-OT convergence market is racing toward $133.7 billion by 2030, growing at 20.83% annually. 52% of organizations now have CISOs responsible for OT security, up from just 16% in 2022, with 80% planning to consolidate OT security under the CISO within the next year, recognizing that these environments can no longer operate in isolation.
This convergence delivers genuine benefits: remote monitoring, predictive maintenance, real-time analytics. But it also creates something else: a highway from your enterprise network straight into production systems. And most organizations have no idea what's traveling that highway.
The Shadow Current No One Maps
In previous blogs, we introduced shadow currents as the unauthorized paths electricity takes through your facility, and revealed that most organizations can't even map their attack paths. Now let's identify the specific shadow current almost everyone has but ignores: the IT-OT boundary.
According to the SANS Institute and Opswat, 58% of respondents identified IT compromises as the leading initial attack vector for ICS and OT incidents. The math is straightforward. Most attacks start in IT. Most industrial environments connect IT to OT. Yet 81% of organizations allocate less than 50% of their security budget to OT.
That's the paradox. Gartner reports global cybersecurity spending will hit $213 billion in 2025, but organizations pour resources into IT perimeter defenses while the IT-OT boundary gets a fraction of the attention and even less visibility.
Attackers Move in 48 Minutes. Detection Takes Days.
Attackers achieve lateral movement in an average of 48 minutes, according to ReliaQuest's 2025 Annual Threat Report. Security teams take an average of 204 days to identify and contain a breach, according to IBM's Cost of a Data Breach Report. In some enterprise networks, Elisity analysis shows average detection time stretches to 95 days.
But detection assumes visibility. Here's the reality: complete OT visibility remains rare, down from just 13% of organizations in 2022. Visibility isn't improving as threats increase. It's deteriorating.
Consider what visibility gaps mean at the IT-OT boundary. You can't detect what you can't see. You can't secure what you don't monitor. And according to SANS research, 64% of organizations lack comprehensive monitoring capabilities for their OT environments. That's not a security posture. That's an open invitation.
Why Two Security Teams Still Leave One Gap
Organizational structure explains much of this blind spot. OT typically reports to the COO, focusing on reliability and uptime. IT reports to the CIO, prioritizing confidentiality and access control. Two separate teams, each securing half the network, often with minimal coordination at the seam where they meet.
The result: Two security teams each protecting half of total network. The boundary between them becomes no one's complete responsibility.
Technical challenges compound the organizational silos. You can't patch OT systems the same way you patch IT. The average OT patch time exceeds 180 days, compared to IT's average patch time of 30-60 days. You can't stop a production line for security updates the way you restart a server. And legacy OT equipment often lacks the instrumentation needed for modern security monitoring.
So the IT-OT boundary becomes the path of least resistance: connected enough to enable business value but monitored poorly enough to enable attacker movement.
Manufacturing: Four Years as the Top Ransomware Target
Manufacturing feels this acutely. The sector has ranked as the top ransomware target for four consecutive years, accounting for 22-26% of all attacks. In Q2 2025 alone, 65% of OT-related ransomware incidents hit manufacturing environments.
The financial impact extends far beyond ransom payments. MKS Instruments reported losses exceeding $200 million. Clorox's total losses reached $356 million. Nucor halted production in 2025. These aren't just IT incidents with OT consequences. They're successful attacks that traveled the IT→OT path organizations failed to secure.
What Carries the Current
Colonial Pipeline demonstrated how a single compromised credential becomes the vehicle for attack. But credentials are just one mechanism. Data historians, sitting at the IT-OT boundary (Purdue Level 3), served as the initial access vector in 10% of OT incidents. Remote access solutions, vendor connections, engineering workstations: each represents another potential pathway.
According to IDC research, nearly 70% of successful breaches involve lateral movement techniques, which MITRE ATT&CK documents as a critical tactic used by adversaries. In industrial environments, that lateral movement crosses from IT into OT through every connection point organizations create for operational efficiency.
The question isn't whether your organization has this shadow current. The statistics make clear that if you've integrated IT and OT, you have it. The question is whether you know where it flows, what protections exist at each crossing point and how quickly you'd detect movement along it.
Beyond the Audit
Compliance frameworks validate that controls exist. They don't verify that those controls would stop a determined attacker who's already inside your IT network. They can't test whether your segmentation would hold, whether your monitoring would catch lateral movement or whether your incident response would work when production systems are at stake.
By 2027, Gartner predicts 75% of security teams will have onboarded at least five tools to manage cyber-physical systems security. That's recognition of OT security's complexity, but it's also an admission: most organizations currently lack adequate tooling for the environments they're trying to protect.
Testing What Matters
You've passed audits. Your compliance documentation looks good. But have you tested what happens when someone gets VPN access? Have you mapped how far a compromised credential could travel? Have you verified whether lateral movement from IT into OT would trigger alerts before damage occurs?
The shadow current at your IT-OT boundary exists. The only questions are whether you've mapped it, whether you've measured it and whether you can control it.
In our next blog, we'll explore what carries this shadow current from IT into OT: credentials. Those invisible flows of trust and authentication that make operations possible also make attack paths inevitable.
Ready to Map Your IT-OT Attack Path?
The IT→OT Attack Path at a Glance
The Entry Point
How attackers gain access to your network
Most attacks start with compromised IT credentials. A VPN password, email account, or vendor access becomes the entry point. From there, attackers have months to map the network before moving laterally into OT systems.
The Crossing Points
Where IT and OT actually connect
Data historians, historian servers, remote access gateways, engineering workstations, and historian applications sit at the IT-OT boundary. These systems handle operational data and often have elevated privileges in OT environments.
The Lateral Movement
How attacks propagate into OT
Once on the boundary system, attackers use legitimate protocols and credentials to move into OT networks. They exploit the trust between IT and OT systems, using shared credentials or inherited access to spread laterally through your production environment.
The Impact
What happens when they reach OT
Production systems go offline. Manufacturing halts. Pipelines shut down. Costs skyrocket. Once an attacker reaches critical OT systems, the damage is measured in millions per day of downtime, not thousands in ransom payments.
Your Control Points
Where you can stop the attack
Segmentation at the IT-OT boundary, monitoring of crossing points, credential controls, and rapid detection of lateral movement are your defense. But these require unified visibility and coordinated response between IT and OT teams.
The Statistics That Matter
How Attackers Cross the Boundary
| Attack Vector | Location | Exploitation Method |
|---|---|---|
| Compromised VPN Credentials | Network entry point | No MFA enforcement allows direct IT access; lateral movement to boundary systems follows |
| Data Historians | IT-OT boundary (Purdue Level 3) | 10% of OT incidents use historian servers as initial access; elevated privileges enable OT penetration |
| Remote Access Gateways | IT-OT boundary | Vendor and support access creates standing backdoors; weak segmentation allows privilege escalation |
| Engineering Workstations | Dual-homed systems | Systems connected to both IT and OT networks bypass segmentation; malware spreads bidirectionally |
| Shared Credentials | Everywhere | Service accounts and shared logins enable lateral movement; inherited access privileges persist |
What You Must Know
⚡ The Entry Point
Most attacks don't breach OT directly. They compromise IT first, then move laterally. Your strongest defense is detecting that lateral movement before it reaches production systems.
⚠️ The Time Gap
Attackers move in 48 minutes. Detection takes months. Your visibility at the IT-OT boundary is likely your biggest gap. Close that gap and you close the attack path.
🎯 The Responsibility Gap
Two teams (IT and OT), one unguarded boundary. Organizational silos explain why IT-OT defenses fail. Unified visibility and coordinated response are non-negotiable.
💰 The Cost Reality
Downtime in manufacturing costs millions per day. Ransom payments are rounding errors. The real cost is halted production, lost customers, regulatory penalties, and reputation damage.
🔍 The Audit Lie
Passing compliance audits doesn't mean you'd stop an attacker inside your IT network. Have you actually tested whether your segmentation, monitoring, and incident response would work when production is at stake?
🛡️ Your Control Points
You can't eliminate the IT-OT boundary. But you can segment it, monitor it, and respond to threats crossing it. The question is whether you have the unified visibility to do any of those things.