OT Security Goes Credentials-First at the Industrial Endpoint

Why it matters now: The fastest-growing threat to a production line is no longer a malicious executable — it is a password. A new credentials-first OT security model, detailed by Manufacturing Business Technology, argues that conventional endpoint defence built around malicious binaries and software package provenance is scanning for the wrong thing. In converged plants, attackers rarely need malware. They log in. And the credential they use to reach an engineering workstation is frequently the same one that reaches the historian, the HMI and, eventually, the PLC.

The shift lands against a hard statistical backdrop. IBM X-Force has ranked manufacturing as the most-attacked industry for multiple consecutive years, and its 2025 index found that roughly 30% of intrusions began with valid account credentials rather than malware.

What a Credentials-First Endpoint Model Actually Does

The approach inverts the traditional inventory. Instead of cataloguing files and processes, it catalogues secrets — every credential physically discoverable on a machine — then resolves each one to the production asset it unlocks.

Critically, it also resolves reuse: every other location where that same secret appears. In OT, that lateral map is the whole ballgame.

Secrets typically discovered on an industrial endpoint

• Service accounts running SCADA, historian and MES connectors, often with non-expiring passwords.
• API keys and tokens for cloud dashboards, OEE platforms and remote monitoring gateways.
• Engineering workstation logins, frequently shared across shifts, contractors and integrators.
• Hard-coded credentials inside scripts — batch files, PowerShell, Python data-pull jobs.
• Credentials embedded in controller projects and configuration archives, including VPN and FTP details for firmware or recipe transfers.
• Cached SSH keys and certificates on maintenance laptops that move between air-gapped and connected zones.

One Shared Password, Every Zone

Network segmentation remains foundational, but segmentation assumes the attacker must traverse a boundary. A reused credential does not traverse — it is already trusted on both sides.

This is why the lateral view matters more in OT than in enterprise IT. A single shared password can chain from an engineering workstation to a historian, from the historian to an HMI, and from the HMI into controller and safety-system reach. Each hop looks like legitimate operator behaviour to a monitoring tool tuned for anomalies in protocol traffic.

The living-off-the-land problem

Threat intelligence has been consistent on this point: adversaries increasingly avoid noisy tooling in favour of valid accounts and native utilities. In an OT context, that means no unsigned binary triggers an alert, no new process appears, and the intrusion resembles a night-shift engineer doing routine work.

AI Is Now a Secret-Generating Machine

The MBT analysis singles out AI tooling as an accelerant. Copilots and code generators produce integration scripts, connectors and test harnesses at speed — and those artefacts routinely contain embedded keys, connection strings and service-account references.

The governance gap is arithmetic. Manual credential reviews operate on quarterly or annual cycles; AI-assisted engineering produces new secrets daily. IBM's most recent index underlines how commoditised this exposure has become, citing some 300,000 AI chatbot credentials observed for sale on dark web markets.

Scale check: machine identities versus human identities

Palo Alto Networks estimates a machine-to-human identity ratio of roughly 82:1 in modern enterprises. Applied to a plant floor, that ratio is arguably conservative — every IIoT sensor, edge gateway, robot controller, camera and OPC UA client carries or consumes an identity, and many legacy devices cannot store credentials securely or support rotation at all.

Market research firm market.us puts global active IoT endpoints at approximately 21.1 billion by end-2025, growing 14% year on year. IDC projections cited by CrowdStrike placed connected XIoT devices at around 42 billion. Each new endpoint is another place a secret can be stored, copied or leaked.

The XIoT Security Market Moves in Parallel

The credentials-first thesis is emerging alongside rapid growth in Extended Internet of Things (XIoT) security — the vendor category offering protocol-aware visibility, continuous monitoring and threat management across OT, IT and IoT assets, typically backed by dedicated ICS threat-intelligence teams.

The two are complementary rather than competing. XIoT platforms answer what is on my network and how is it behaving. Credentials-first endpoint tooling answers who can command it, and from where.

Market data: IoT and industrial security spend

• IoT security market: USD 28.67 billion (2025) rising to USD 80.30 billion by 2031, a CAGR of 18.7% — MarketsandMarkets.
• Largest application: smart manufacturing, at approximately 24.1% of the market in 2025.
• Network security share: 38.1% of 2025 European IoT security revenue, reflecting the dominance of deep-packet inspection tuned for Modbus, PROFINET and OPC UA — Mordor Intelligence.
• Threat landscape: critical infrastructure accounted for around 70% of incidents IBM X-Force responded to; extortion groups tracked rose from 73 in 2024 to 109 in 2025.

Figures are third-party market estimates and vary by methodology and segment definition.

What This Means for Automation and Controls Teams

The practical takeaway is a reordering of priorities. Credential hygiene, vaulting and least-privilege remote access now sit alongside network segmentation and firmware patching as core controller-protection measures — not as IT department housekeeping.

A pragmatic sequence for brownfield plants

1. Discover before you police. Inventory secrets on engineering workstations, HMIs, panel PCs and maintenance laptops first. Most teams underestimate the count by an order of magnitude.
2. Kill reuse, not convenience. Break shared credentials into unique per-asset identities, but keep an emergency break-glass path documented for production stoppages.
3. Vault and rotate. Move secrets out of scripts and project files into a managed vault with automated rotation where devices support it.
4. Broker remote access. Replace standing vendor VPN accounts with time-bound, session-recorded, task-scoped access.
5. Treat legacy honestly. Controllers that cannot enforce authentication should be compensated for with strict conduit control and monitoring, and flagged in the asset lifecycle plan for replacement.

How this maps to ISA/IEC 62443

The credentials-first model aligns closely with Foundational Requirement 1 (Identification and Authentication Control) in IEC 62443-3-3:

• CR 1.1 / 1.2: identify and authenticate all human users, and all software processes and devices.
• CR 1.3 / 1.4: provide and manage accounts with unique identifiers per account — the direct counter to shared shift logins.
• CR 1.5: manage the full lifecycle of authenticators, including initial values, changes and secure storage — effectively a mandate against hard-coded secrets.
• Security Level 2 practice: commonly implemented as unique IDs plus MFA on engineering workstations, role-based access control, certificate-based device authentication and audited login attempts.

Frequently Asked Questions

Does credentials-first security replace network segmentation?

No. Segmentation limits reachability; credential control limits authority. An attacker holding a reused administrative secret inside a segmented zone still has legitimate authority within it. The two controls address different failure modes and are strongest deployed together.

Our PLCs are on an isolated network. Are we exposed?

Isolation is rarely absolute. Maintenance laptops, USB-borne project files, contractor tooling and data-historian links all cross the boundary. The relevant question is not whether the network is isolated, but which endpoints store credentials that are valid inside it.

Can we rotate credentials without stopping production?

Often yes, but sequencing matters. Service accounts tied to running SCADA or historian connectors require change-window coordination and dependency mapping — which is precisely why the credential-to-system map is the prerequisite deliverable, not the rotation itself.

Where do legacy controllers without authentication fit in?

They are treated as trusted-by-design assets protected by compensating controls: strict conduit rules, monitored access paths, and brokered remote sessions. Where the risk cannot be reduced acceptably, the device enters the modernisation backlog.

For controls engineers and maintenance leads, the operational implication is unglamorous but immediate: credential inventories, vaulting policy and brokered remote access belong in the same maintenance discipline as spares strategy, firmware baselines and hardware lifecycle planning. Secure automation now depends as much on managed secrets as on reliable silicon.