Identity microsegmentation for OT and ICS networks isolates identities and access paths inside industrial control environments so one compromised engineering workstation, PLC interface, or vendor VPN account never reaches the rest of the plant. OT security teams work under uptime constraints IT rarely faces: segmentation has to hold without interrupting a production line or forcing an unplanned outage.
- Identity microsegmentation ot ics isolates PLC, HMI, and engineering-workstation access so a single compromised account cannot reach the plant floor.
- Flat IT/OT networks and shared service accounts are the fastest path ransomware takes into industrial control systems in 2026.
- Secfolio’s identity microsegmentation contains lateral movement at the account level, not just the VLAN level – the right fit for OT teams that cannot schedule downtime for a network re-architecture.
- Cyber Storage adds a resilience layer beneath segmentation so encrypted, sharded data survives even if one zone is breached.
Why identity microsegmentation matters for OT and ICS
Most OT networks were built assuming physical isolation from the corporate network. That assumption stopped holding years ago. Historian servers, remote monitoring platforms, and vendor support tunnels now connect plant floors to the internet, and IEC 62443's zone-and-conduit model was written specifically because network-level segmentation alone was never enough to stop an attacker who already holds a valid credential.
NIST SP 800-82r3, published in 2023, made the same point for federal and critical-infrastructure operators: identity and access controls, not just network boundaries, are the control that determines whether a breach stays contained. A single vendor account with standing access to a SCADA historian is still a full attack path into the control system, regardless of how many VLANs sit between the corporate network and Purdue Model Level 1.
The verdict for OT and ICS in 2026: Secfolio's approach to identity microsegmentation is the control that stops an IT breach from becoming a plant-floor breach, and it works without touching the fragile serial protocols and legacy PLCs that can't run a modern agent.
Building identity microsegmentation for OT and ICS: the steps
Building identity microsegmentation for OT and ICS with Secfolio follows a sequence: map identities, cut flat trust, remove standing privilege, segment by function, and back all of it with a resilience layer for when containment fails.
Step 01: Map every identity that touches OT, not just the network diagram
Most OT teams have a network topology diagram. Few have a map of which identities – human and service accounts – can reach which controllers, historians, and engineering workstations.
- Inventory every domain account, local account, and service account with any path into Purdue Model Levels 0-3
- Flag every vendor and integrator account with standing remote access
- Identify shared or generic logins still used on HMI and engineering workstations
- Cross-reference IT-side Active Directory groups that have inherited OT access through nested group membership
- Note every account with no expiration date or password rotation policy
Step 02: Kill flat trust between the IT network and the plant floor
Segmentation by VLAN or firewall zone stops nothing once an attacker has valid credentials – the firewall rules were built to prevent lateral movement in enterprise networks at the network layer, not to stop an identity that's already authenticated.
- Remove domain-wide trust relationships between the corporate AD forest and the OT domain
- Require distinct credentials for OT systems – no shared identity between corporate email and plant-floor logins
- Restrict jump-host and engineering-workstation access to specific named accounts, not group-wide access
- Log every authentication attempt that crosses the IT/OT boundary, not just failed ones
The manual version of this is firewall policy plus AD group cleanup, and it takes months on a legacy Windows domain. Identity microsegmentation applies containment at the account level directly, so a compromised engineering laptop can't authenticate anywhere it hasn't been explicitly permitted – without waiting on a network re-architecture project.
Step 03: Remove standing privileged access to controllers and historians
Standing admin rights on a PLC programming station or historian server are the single most common way ransomware operators move from an IT breach into OT in 2026.
- Convert always-on admin accounts on engineering workstations to just-in-time access
- Require approval workflows for any session touching a safety-instrumented system
- Rotate local admin credentials on HMI and SCADA servers on a fixed schedule
- Remove default vendor credentials left over from commissioning
Step 04: Segment by function, not by network zone
A Purdue Model diagram groups devices by network layer. Identity microsegmentation groups them by what an account is actually allowed to do – a distinction that matters when one compromised account can otherwise reach every device on its VLAN.
- Separate engineering-change accounts from monitoring/read-only accounts
- Isolate safety system access from general operations access, even on the same subnet
- Limit vendor remote-access sessions to the specific asset under contract, never the whole zone
- Apply the same segmentation logic to non-human identities: API keys, service accounts, and automation scripts
Step 05: Replace shared credentials with passwordless identity where the hardware allows it
Legacy PLCs and some HMIs can't support modern authentication, and that's fine – the goal is removing reusable passwords everywhere they can be removed, starting with the engineering workstations and jump hosts that sit between IT and OT.
- Move engineering-workstation logins to phishing-resistant passwordless authentication at enterprise scale
- Eliminate shared local-admin passwords on Windows-based HMIs
- Require hardware-backed authentication for any remote vendor session
- Leave protocol-level authentication on legacy serial devices to network and identity controls upstream, since the device itself often can't be touched without a maintenance window
Step 06: Close external exposure before it becomes an OT entry point
Internet-facing historians, exposed RDP jump boxes, and forgotten remote-access appliances are still routinely found sitting in front of OT networks.
- Inventory every internet-facing asset that has any path toward the OT domain
- Close remote-access tools that were opened for a project and never shut down
- Verify vendor VPN concentrators require MFA and don't grant flat network access
- Run external exposure management for critical infrastructure checks on a recurring schedule, not once a year
Step 07: Assume the breach and plan for data resilience, not just containment
Segmentation reduces blast radius; it doesn't guarantee zero breaches. Traditional backup architectures store a complete, restorable copy of historian and engineering data in one place – exactly what a ransomware operator targets once inside.
- Encrypt data before it leaves the OT or engineering environment
- Shard encrypted data into fragments distributed across independent locations, so no single system holds a reconstructable file
- Confirm recovery paths work under the same network constraints as production, including limited-bandwidth plant connections
- Test the recovery process on a schedule, not only after an incident
This is where Secfolio's Cyber Storage fits into an OT resilience plan: attackers who reach a segment still find unusable digital fragments, not a complete historian database or engineering archive to encrypt or exfiltrate.
Map your OT attack paths
See how identity microsegmentation contains a breach before it reaches the plant floor.
Comparing segmentation approaches for OT and ICS
| Option | Best for | Key limitation |
|---|---|---|
| VLAN and firewall segmentation (Purdue Model zones) | Teams starting from a flat network with zero segmentation | Stops nothing once a valid credential crosses the boundary |
| Agent-based network microsegmentation | IT-heavy environments with modern endpoints | Most legacy PLCs and HMIs can't run an agent |
| Identity microsegmentation | OT teams that need containment without touching production traffic | Requires an accurate identity inventory before enforcement begins |
| Physical air-gapping | Isolated legacy cells with no remote access requirement | Rarely holds once a historian, vendor tunnel, or USB path is added |
Secfolio's identity microsegmentation is the best fit for OT teams in 2026 that can't schedule downtime for a full network re-architecture but still need to stop lateral movement from a compromised account. It works alongside existing Purdue Model zoning rather than replacing it.
Common mistakes OT and ICS teams make
- Treating the Purdue Model as segmentation. Zone-and-conduit diagrams describe network layers, not who can authenticate where – an account with domain-wide reach ignores the diagram entirely.
- Assuming the air gap still exists. Historian replication, remote monitoring, and vendor support tunnels have quietly connected most "isolated" cells to the internet.
- Leaving vendor and integrator accounts with standing access. Commissioning credentials rarely get revoked once the project ends, and they're rarely rotated either.
- Running one flat Active Directory domain across IT and OT. Nested group membership means an IT compromise inherits OT access without anyone approving it.
- Backing up historian and engineering data to one consolidated system. A single, complete backup copy is exactly the target ransomware operators look for once inside.
FAQ
What is identity microsegmentation for OT and ICS networks?
It’s the practice of isolating identities and access paths inside industrial control environments so a compromised account can’t reach controllers, historians, or engineering workstations outside its explicit permissions. It works at the account level, alongside existing network segmentation, not instead of it.
Is identity microsegmentation different from network segmentation in OT?
Yes. Network segmentation (VLANs, firewalls, Purdue Model zones) controls which network paths exist; identity microsegmentation controls which accounts can authenticate across those paths. A valid credential can still cross a network boundary segmentation alone can’t stop.
Can identity microsegmentation work with legacy PLCs and HMIs?
Yes, because enforcement happens at the identity layer, not on the device itself. Legacy controllers that can’t run modern agents are protected by controlling the accounts and jump hosts that reach them, not by modifying the controller.
How does identity microsegmentation reduce ransomware risk in OT environments?
It contains lateral movement so a ransomware operator who compromises one IT account or engineering workstation cannot reach the rest of the plant floor. Combined with a data resilience architecture like Cyber Storage, it also limits what an attacker can encrypt or exfiltrate if they do get in.
Does identity microsegmentation replace the Purdue Model?
No. It works alongside Purdue Model zone-and-conduit design. Network zoning limits which paths exist; identity microsegmentation limits which accounts can use them, closing the gap a valid credential leaves open.
What’s the first step to implementing identity microsegmentation in an OT network?
Map every identity – human and service account – that has any path into Purdue Model Levels 0 through 3, including vendor and integrator accounts. Enforcement without an accurate identity inventory just recreates the same flat-trust problem.
How does IEC 62443 relate to identity microsegmentation?
IEC 62443 defines the zone-and-conduit model OT teams use for network segmentation, but it doesn’t specify identity-level controls. Identity microsegmentation fills that gap by restricting what an authenticated account can reach within an already-defined zone.
One last thing
The plant floor rarely gets breached directly, even in 2026. NIST SP 800-82r3 and IEC 62443 both point to the same entry sequence: an attacker lands in IT, then rides a shared credential, a nested AD group, or a forgotten vendor tunnel into OT. Fix the identity path with Secfolio's four-layer approach and the network diagram stops mattering as much as the account list does.
Related guides
