On factory floors worldwide, a quiet vulnerability is compounding: programmable logic controllers (PLCs) that have outlived the engineers who commissioned them, running on flat, unsegmented OT networks never designed for an internet-connected world. A recent Spiceworks analysis argues those systems were already a liability. AI-powered malware has just made them urgent.
The uncomfortable truth is that many plants still run controllers older than their help-desk interns ā devices that are never patched, rarely monitored, and effectively invisible to the IT security team. In a flat OT network, once an attacker breaches a single endpoint, nothing stops lateral movement across the production floor.
Analyst Insight: The threat model has shifted faster than the architecture. For two decades, OT security leaned on air gaps and obscurity. AI-assisted tooling now accelerates reconnaissance, exploit development, and phishing at a pace that signature-based defenses were never built to match ā turning legacy PLCs from a background risk into a frontline exposure.
Why OT Network Security Is Now a Board-Level Priority
OT network security has moved out of the engineering department and into the boardroom. Frameworks from CISA and NIST now treat network segmentation as a baseline requirement rather than an advanced control, and executive ownership of industrial cyber risk is rising fast.
Fortinet's 2026 State of OT and Cybersecurity Report, based on a global survey of more than 700 OT professionals, captures a market in transition: maturity is improving, yet intrusions remain frequent and visibility is still dangerously incomplete.
Fortinet 2026 State of OT and Cybersecurity Report ā Key Data Points
-
Full OT visibility: rose from 5% of organizations in 2025 to 14% in 2026 ā real progress, but still a minority.
-
Modernization shift: 40% reported their ICS systems are less than five years old, up from 20% a year earlier.
-
Executive ownership: roughly 60% say the CISO now owns OT cybersecurity.
-
Incident frequency: about 71% reported between one and nine OT-related incidents, up from 47% in prior years.
-
Attack types: phishing emails (76%) and ransomware (50%) remained the leading intrusion vectors.
Market Trend: Only 14% of organizations claim full visibility over their OT environment. You cannot segment, patch, or defend assets you have not inventoried ā making passive asset discovery the highest-leverage first step in any industrial security program.
The Economics of Doing Nothing
The financial stakes are no longer theoretical. Industry analysis cited in Q3 2025 OT incident research placed global industrial cyber losses in the hundreds of billions, with ransomware and unplanned downtime driving the largest share of damage.
For manufacturers, an outage can cost far more than the ransom itself. Lost output, safety incidents, and contractual penalties quickly outstrip the cost of remediation ā a reality that explains why cybersecurity investment in critical infrastructure keeps rising despite broader economic uncertainty.
Frameworks Converge: Segmentation and Zero Trust as Baseline
The regulatory and standards picture has hardened. CISA, alongside the Departments of War, Energy, Justice, and the FBI, published joint guidance on adapting Zero Trust principles to operational technology, mapping controls directly to the NIST Cybersecurity Framework 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
That guidance builds on established references ā NIST SP 800-82 Rev.3, the ISA/IEC 62443 series for industrial automation and control systems, and the Purdue Model's layered zone architecture. Together, they no longer describe segmentation as optional. They describe it as the floor.
Analyst Insight: Segmentation is not a silver bullet. CISA's own guidance warns that air gaps can be bridged, VLANs misconfigured, and permissive rules can undermine intended isolation. Well-segmented environments still fail without continuous validation, strong access control, and active network monitoring.
A Practical Remediation Playbook
Defense in depth for legacy environments generally follows a predictable sequence. The priorities below reflect widely adopted OT security best practice.
OT Security Remediation Priorities for IT/OT Convergence
-
Establish asset visibility using passive network monitoring that builds a baseline without disrupting production.
-
Segment IT from OT with clearly defined zones and conduits, and insert a DMZ at the IT/OT boundary.
-
Apply microsegmentation inside OT ā control, safety, supervisory, and historian layers should inhabit distinct zones.
-
Enforce least-privilege access and eliminate default credentials, shared accounts, and over-permissive vendor connections.
-
Monitor continuously for anomalous traffic and integrate OT telemetry into unified SOC workflows.
-
Manage the PLC lifecycle ā plan risk-prioritized replacement of end-of-support controllers instead of indefinite deferral.
Frequently Asked Questions
What is a flat OT network?
A flat OT network is one in which industrial devices share a single broadcast domain with few or no internal boundaries. If any device is compromised, an attacker can move laterally to controllers, engineering workstations, and historian servers with minimal resistance.
Why are legacy PLCs a cybersecurity risk?
Many PLCs were designed for reliability and deterministic control, not security. They often lack authentication, encryption, or vendor patch support, and may run on operating systems no longer maintained. Because they are rarely patched, known vulnerabilities remain exploitable indefinitely.
Does network segmentation alone secure an OT environment?
No. Segmentation constrains lateral movement but must be validated continuously. CISA notes that misconfigured VLANs, bridged air gaps, and overly permissive rules can quietly defeat isolation, making monitoring and access control essential complements.
What does zero trust mean for OT?
Zero trust replaces implicit network trust with explicit, per-request verification. In OT, this means identity-based access, tightly scoped communication flows, and continuous monitoring ā adapted carefully so that controls never interfere with real-time industrial processes.
How should operators handle end-of-life controllers?
Lifecycle management is now a security control. Best practice pairs compensating measures ā segmentation, monitoring, and virtual patching ā with a risk-prioritized replacement schedule for controllers that no longer receive vendor support.
The Bottom Line
The modernization signal in Fortinet's 2026 data is genuine: more organizations are replacing aging ICS, appointing accountable owners, and budgeting for OT security. But with only a minority reporting full visibility, the gap between maturity leaders and laggards is widening.
Flat OT networks and unpatched legacy PLCs were a liability before AI entered the equation. AI has simply removed the luxury of time. For plant operators, the question is no longer whether to segment and modernize ā but how quickly they can do so without stopping production.
