IT and OT are converging fast, but security often lags behind. Modern enterprises are connecting corporate IT networks, industrial control systems, building management systems, access control, CCTV, and cloud platforms to improve efficiency, visibility, and uptime. This convergence creates real business value, but it also creates new attack paths where a weakness in one domain becomes a pivot into another. Many incidents now start with something that looks small, a vendor remote session, a default password on a camera, an unpatched Windows host running an engineering tool, then escalate into outages, safety risks, data loss, or physical compromise.
Convergence security, as practiced by Bio-Cognitive Solutions Pte Ltd, unifies physical, cyber, operations technology, and human risk protection into one program. When you treat IT, OT, and physical systems as one risk landscape, the most common gaps become easier to spot and fix. Below are 12 common IT OT convergence security gaps, why they happen, and practical ways to close them.
1. Split ownership and unclear accountability across IT, OT, and physical security
The gap: IT owns firewalls and identity, OT owns PLCs and HMIs, facilities owns building systems, and physical security owns access control and CCTV. Each team optimizes for its own goals, uptime, safety, compliance, or response time. Without a single accountable model, risks between domains fall through the cracks, especially at integration points like badge systems connected to HR directories, or OT data flowing to cloud analytics.
How to fix it: Establish a convergence security governance model with defined decision rights. Create a cross functional steering group and a single risk register that includes cyber, physical, and OT hazards. Assign system owners for every integrated workflow, for example, badge provisioning, remote vendor access, and incident response. Define who approves exceptions, who funds remediation, and who signs off on residual risk.
- Publish a RACI for core processes, patching, access, logging, and emergency changes.
- Use shared KPIs, for example, critical vulnerabilities aged over 30 days, mean time to revoke access, remote access sessions monitored.
- Align policies to operational realities, including maintenance windows and safety constraints.
2. Incomplete asset inventory for OT, IoT, and physical security devices
The gap: You cannot protect what you cannot see. Many organizations have strong IT asset inventories but weak visibility for PLCs, RTUs, engineering workstations, IP cameras, NVRs, door controllers, intercoms, sensors, and unmanaged switches. Shadow integrations, legacy devices, and contractor installed equipment add unknown exposure.
How to fix it: Build a single asset inventory that spans IT, OT, and physical security. Combine passive network discovery for OT, configuration exports from access control and video systems, and procurement records. Classify assets by criticality, safety impact, network zone, vendor support status, and known vulnerabilities. Track firmware versions for devices that do not have traditional agents.
- Use passive monitoring for OT to avoid disrupting control traffic.
- Require commissioning checklists that include device IDs, firmware, network location, and owner.
- Tag assets by function, for example, safety, production, perimeter, or data center access.
3. Flat networks that allow easy lateral movement between IT and OT
The gap: Over time, temporary connections become permanent. A plant network shares services with corporate IT. A camera subnet can reach domain controllers. Remote sites connect back with broad routing. Attackers love flat networks because one compromised endpoint can discover and reach high impact OT systems.
How to fix it: Implement zone and conduit segmentation. Separate corporate IT, OT control, OT supervisory, safety, physical security, and vendor access into distinct network segments. Restrict traffic using allow lists based on required protocols and destinations. Use industrial DMZ patterns for data flows between OT and IT, and include application layer proxies where possible.
- Start with “deny by default” between zones, then open only what operations needs.
- Place jump servers in controlled zones, not on the plant floor network.
- Segment physical security systems, cameras should not have general enterprise access.
4. Remote access that is convenient, but not controlled or monitored
The gap: Vendors and engineers often need remote access for troubleshooting and updates. Common shortcuts include shared VPN accounts, direct RDP to engineering stations, persistent tunnels, and unmanaged remote support tools. This creates a direct path into OT, and sometimes into physical security controllers.
How to fix it: Standardize remote access with strong identity, least privilege, and session oversight. Use a hardened remote access gateway with MFA, device posture checks, and time bound approvals. Route OT remote sessions through jump hosts with full session recording. Disable direct inbound access to OT networks, and block unauthorized remote tools by policy and technical controls.
- Implement just in time access, approvals per session, and automatic expiration.
- Record privileged sessions, including commands and file transfers.
- Require vendors to use named accounts, no shared logins.
5. Weak identity and access management for OT and physical security platforms
The gap: OT and physical systems frequently rely on local accounts, shared operator credentials, default passwords, or limited role separation. Badge system admins may also manage CCTV or intercoms with the same credentials. When a credential is compromised, the attacker gains control over both cyber and physical functions.
How to fix it: Extend IAM principles across convergence systems. Integrate access control, video management, and OT management platforms with centralized identity where feasible, using federation or directory integration. Enforce MFA for privileged roles. Apply role based access control that separates monitoring, configuration, and administration. Use unique accounts for operators and maintainers, and remove shared passwords.
- Implement strong password policies for devices that cannot integrate with a directory.
- Use PAM for administrator credentials, rotate passwords, and vault secrets.
- Perform quarterly access reviews for OT engineers, contractors, and guards.
6. Patch and vulnerability management that ignores OT constraints
The gap: IT patch cycles assume frequent updates and short maintenance windows. OT environments prioritize uptime and deterministic behavior, so patching is delayed or avoided. Physical security devices often run old firmware and are updated only when something breaks. This creates long lived vulnerabilities across multiple domains.
How to fix it: Create an OT and physical security vulnerability program that respects operational realities. Use risk based patching, prioritize internet exposed and remotely reachable systems, then move inward. Establish test environments for critical OT software and firmware. Where patching is not possible, use compensating controls such as segmentation, application allow listing, and strict remote access.
- Define maintenance windows and emergency patch procedures agreed by operations.
- Track end of support systems and build a lifecycle replacement plan.
- Include cameras, NVRs, door controllers, and intercoms in firmware reviews.
7. Overtrust in vendor supplied systems, integrators, and managed services
The gap: OT and physical security ecosystems rely heavily on vendors and integrators. Security assumptions often include “the vendor will handle it” or “the managed service monitors it.” In reality, responsibilities can be unclear, telemetry may be limited, and supply chain risk is real, including compromised updates and weak remote support practices.
How to fix it: Formalize third party security requirements and verify them. Use contracts that specify access methods, logging, incident notification timelines, vulnerability disclosure, and patch responsibilities. Require named accounts and MFA. Audit vendor access logs. For high impact systems, require signed updates, offline update procedures, and change approvals.
- Maintain an inventory of all third party connections and who approved them.
- Review vendor security posture annually, including their remote access tooling.
- Use least privilege contracts, only the functions the vendor truly needs.
8. Misconfigured or insecure physical security integrations
The gap: Convergence security frequently involves integrations, HR to badge provisioning, badge events to SOC platforms, video analytics to incident workflows, and access control to building systems. If APIs are weakly authenticated, services run with excessive privileges, or networks are open, an attacker can manipulate physical access, tamper with alarms, or blind cameras.
How to fix it: Secure integrations as first class applications. Use strong API authentication, scoped tokens, and certificate based trust. Isolate integration middleware in a controlled zone. Review service accounts and permissions. Validate event integrity, for example, ensure door forced open events cannot be spoofed easily. Hardening should include secure time synchronization, because logs and alarms depend on accurate time.
- Threat model each integration, identify what happens if the integration is abused.
- Use allow listed IPs and mutual TLS for sensitive API connections.
- Monitor for abnormal patterns, for example, mass badge provisioning or alarm suppression.
9. Insufficient logging and monitoring across OT and physical domains
The gap: Many security teams monitor IT endpoints and cloud, but have limited telemetry from OT networks, access control servers, and video management systems. Logs may be overwritten quickly, stored locally, or not normalized. Without visibility, detection becomes slow, and investigations become guesswork.
How to fix it: Build a unified monitoring approach that feeds a SOC or 24/7 monitoring function. Centralize logs from key systems, remote access gateways, jump hosts, OT monitoring sensors, access control, and video platforms. Use use case driven detection, not just log collection. Prioritize alerts that indicate attacker movement between domains, such as an IT admin account logging into an OT jump host, or changes to door schedules outside business hours.
- Define log retention targets that support investigations and compliance requirements.
- Use time synchronization across OT, IT, and physical systems for reliable correlation.
- Test alert quality with tabletop scenarios and purple team exercises.
10. Safety and availability risks not integrated into cyber risk decisions
The gap: IT security often measures impact in data terms, confidentiality and integrity. OT adds safety and availability, and physical security adds life safety and site security. If cyber risk is assessed without these factors, controls may be misprioritized, or changes may be rejected because they appear “too risky” without a structured way to evaluate operational impact.
How to fix it: Adopt a risk assessment method that includes safety, operational downtime, regulatory impact, and physical consequences. Map critical processes and dependencies, for example, how badge access affects control room staffing, or how a building management outage affects server room cooling. Use business impact analysis and define acceptable downtime for OT segments. Make cyber controls operationally safe by design, including fail safe behavior for access control and careful change management.
- Include operations, EHS, facilities, and security in risk workshops.
- Classify systems by safety and production criticality, then align controls accordingly.
- Define safe fallback procedures for outages, including manual overrides and staffing.
11. Weak incident response for IT OT convergence scenarios
The gap: Many incident response plans assume IT systems only. OT incidents require different evidence sources, different containment steps, and careful coordination to avoid unsafe actions. Physical security incidents add chain of custody, camera footage handling, and coordination with site teams. Without a combined playbook, the response becomes slow, inconsistent, and risky.
How to fix it: Create convergence incident response playbooks that cover cross domain scenarios. Examples include ransomware affecting a plant historian, compromise of an access control server, suspicious remote access into OT, and camera system tampering during a theft attempt. Define who can isolate networks, who can shut down remote access, and how to coordinate with operations for safe containment. Include communication templates and escalation criteria.
- Run joint tabletop exercises with IT, OT, facilities, physical security, and leadership.
- Pre stage incident tooling, offline backups, spare hardware, and secure golden images.
- Ensure evidence handling covers logs, controller configs, and video footage.
12. Human risk gaps, social engineering, insider threats, and poor operational discipline
The gap: Convergence security is not only technical. Common issues include tailgating into sensitive areas, shared control room accounts, engineers bypassing policies to “get the job done,” and phishing that steals VPN credentials used for vendor access. In OT, small procedural lapses can have outsized impact because systems are highly trusted and changes propagate quickly.
How to fix it: Implement human risk controls tailored to operational environments. Strengthen onboarding and offboarding, including immediate badge and account revocation. Use security awareness that is specific to OT and physical operations, not generic training only. Add procedural controls for high risk actions, such as two person approval for changing firewall rules to OT zones, modifying door schedules, or altering PLC logic. Use continuous monitoring to detect abnormal behavior, not to punish, but to reduce risk.
- Use strong visitor management, escort policies, and anti tailgating measures.
- Require shift handover checklists for control room accounts and access tokens.
- Measure compliance with drills, audits, and near miss reporting.
Putting it all together, a practical improvement roadmap
Many organizations try to fix convergence risks by buying tools first. A better sequence is to establish governance and accountability, then gain visibility through asset inventory and monitoring, then reduce attack paths through segmentation and secure remote access, then mature identity, patching, and third party control. Finally, validate everything through incident response exercises that include IT, OT, and physical security, supported by 24/7 monitoring and clear escalation procedures.
If you address these 12 gaps systematically, you reduce both the likelihood and impact of incidents, while improving operational resilience, compliance readiness, and site safety. Convergence security succeeds when security controls support operations, and operations actively participates in security outcomes.