Think Your OT Is Safe Until IT Is Breached? 

Think Again.

One of the most persistent beliefs in industrial cybersecurity is that Operational Technology (OT) is only at risk after the corporate IT network has been compromised. It’s an assumption reinforced by many high-profile cyberattacks, where threat actors first gained access through phishing emails, stolen credentials, exposed VPNs, or other weaknesses in the IT environment before moving laterally into operational systems. As a result, many organizations have come to view IT as the mandatory gateway to OT.

While this attack path is well documented, it isn’t the only one.

As industrial environments become increasingly connected, attackers no longer need to rely solely on the corporate network to reach operational systems. Remote access platforms, internet-exposed industrial devices, wireless communications, third-party vendor connections, and cloud-enabled operational technologies have all introduced new attack paths. In the wrong circumstances, OT itself can become the first point of compromise.

The belief that “OT is safe until IT falls” can create a dangerous blind spot.

The Reality of Modern OT Environments

Industrial networks have changed dramatically over the past decade.

What were once isolated control systems are now connected to enterprise applications, cloud services, remote maintenance platforms, asset management systems, and operational dashboards. These integrations have delivered enormous benefits, allowing organizations to improve efficiency, reduce downtime, and gain better visibility into their operations.

However, every new connection also introduces another potential pathway into the environment.

A vendor supporting equipment remotely may connect directly to an engineering workstation. A cellular gateway may link remote assets back to a control center. A maintenance contractor may use a dedicated remote access appliance that bypasses the corporate network altogether. In some facilities, HMIs or industrial gateways are even exposed to the internet to simplify remote support.

These are legitimate business requirements.

They are also potential entry points for attackers.

Attackers Follow the Path of Least Resistance

Cyber attackers rarely care whether they’re entering through IT or OT. Their objective is simple: find the easiest path to the systems they want to compromise.

If the corporate network presents the easiest opportunity, they’ll start there. If an internet-facing HMI has weak credentials, they’ll start there instead. If a vendor remote access solution is poorly secured, that may become the preferred route.

In other words, attackers don’t think in terms of IT and OT. They think in terms of opportunity.

Assuming they will always begin with IT means assuming they will behave exactly as you expect. History has repeatedly shown that sophisticated attackers don’t follow assumptions. They exploit weaknesses.

How OT Can Become the Initial Target

There are several ways attackers can reach operational technology without first compromising the corporate network.

Remote access remains one of the most common examples. Vendors, contractors, and equipment manufacturers often require direct connectivity into operational environments to perform diagnostics, software updates, and maintenance. If those connections are protected by weak authentication, shared credentials, or outdated remote access software, they can provide attackers with a direct route into OT.

Internet exposure presents another significant risk. Security researchers routinely discover industrial control devices that are publicly accessible because of firewall misconfigurations, forgotten maintenance connections, or systems deployed with default settings. An attacker performing automated internet scans doesn’t need to compromise IT first if the operational device is already visible.

Wireless infrastructure, cellular gateways, remote telemetry systems, and portable engineering laptops create additional attack surfaces. Even physical access during maintenance activities can introduce malware directly into an operational network without involving the business environment at all.

None of these scenarios are hypothetical. They reflect the reality of many modern industrial environments.

Unitronics

The attacks against internet-connected Unitronics PLCs in 2023 provide a clear example. Threat actors scanned the internet for exposed programmable logic controllers protected by default or weak credentials. Because the industrial devices themselves were accessible, there was no need to first compromise the organizations’ IT networks.

Similarly, the attempted attack on the Oldsmar water treatment facility highlighted the risks associated with remote access into operational environments. Public reporting did not establish a traditional IT-to-OT attack chain. Instead, the attacker gained access directly to the control interface used to manage the treatment process.

These incidents demonstrate an important point.

While many attacks still begin in IT, operational technology can absolutely become the initial point of compromise when direct access exists.

Why This Matters for Risk Management

These are not simply technical questions. They are business risk questions.

Every unanswered connection represents another potential pathway to operational disruption.

Why OT Penetration Testing Matters

Traditional vulnerability scanning has limitations in operational environments. Many industrial systems cannot tolerate aggressive scanning, while others rely on proprietary protocols that conventional security tools struggle to assess effectively.

This is where specialist OT penetration testing provides significant value.

A properly planned OT penetration test evaluates the real-world attack paths that could allow an adversary to compromise operational systems. Rather than focusing solely on individual vulnerabilities, experienced testers examine trust relationships, remote access methods, network segmentation, authentication controls, engineering workstations, and the pathways between critical assets.

The objective isn’t simply to identify weaknesses.

It’s to determine whether those weaknesses could realistically be exploited without disrupting operations.

For organizations supporting critical infrastructure, that insight is often far more valuable than a list of vulnerabilities.

Strengthening Your OT Defenses with VADR and Penetration Testing

For organizations regulated under the TSA Security Directives, the Cybersecurity and Infrastructure Security Agency’s Validated Architecture Design Review (VADR) provides another essential layer of assurance.

While an OT penetration test demonstrates whether an attacker can exploit weaknesses within the environment, a VADR evaluates whether the architecture itself supports secure operations.

It examines how critical assets are segmented, how remote access is controlled, whether identity and access management align with best practices, and whether the overall design reduces opportunities for attackers to move through the environment.

The two assessments answer different, but equally important questions.

Together, they provide a far more complete understanding of operational cyber risk than either assessment can deliver on its own.

Security Should Be Built Around Attack Paths, Not Assumptions

One of the biggest mistakes organizations can make is building security around the attack they expect instead of the attacks that are possible.

Attackers don’t distinguish between IT and OT. They don’t follow network diagrams. They don’t respect organizational boundaries.

They identify the easiest available route and exploit it.

Sometimes that route begins with a phishing email. Sometimes it’s a forgotten VPN appliance. Sometimes it’s a contractor’s remote access account. And sometimes it’s an internet-facing industrial controller.

Effective security programs recognize all of those possibilities.

Final Thoughts

It’s easy to see why so many organizations believe OT is only at risk after IT has been compromised. Many of the industry’s most well-known cyberattacks followed that path, and those incidents have shaped the way we think about industrial security.

The challenge is that attackers don’t follow assumptions.

As OT environments become more connected, there are more ways than ever to reach operational systems. Remote vendor access, internet-connected devices, wireless infrastructure, cloud services, and legacy systems can all create opportunities for attackers if they aren’t properly secured. In some cases, they can bypass the corporate IT network altogether.

That’s why protecting OT isn’t just about securing the boundary between IT and OT. It’s about understanding how your environment is connected, identifying every realistic path an attacker could take, and validating that those paths are properly protected.

Whether an attack starts in IT or OT matters less than whether you’re prepared for either scenario.

The organizations that are best positioned to defend their operations don’t rely on assumptions. They regularly test their environments, validate their architecture, and address weaknesses before an attacker has the chance to find them. That’s exactly where OT penetration testing and a VADR can make a real difference—not just by identifying today’s risks, but by helping you build a more resilient OT environment for the future.

Meeting regulatory requirements is important, but it doesn’t always tell you whether your environment can withstand a real-world attack.

Aerstone’s OT Penetration Testing combines deep industrial cybersecurity expertise with proven testing methodologies to identify exploitable risks before attackers do.