Why OT Security Isn’t IT Security: A Primer for Defense Manufacturers
When we think of the end state of a cyberattack, we often picture compromised laptops, stolen data, and corporate apologies. But the cyberattacks that reach manufacturing and other critical sectors often end differently: spindles stop turning, a production line goes dark, and a factory falls silent.
That’s what’s at stake in an operational technology (OT) breach. An attacker who gets into the systems that run your machines can halt production, damage equipment, or quietly alter the specs of the parts you ship. For a defense manufacturer, any of those outcomes is a problem for your business, for your customers, and ultimately for the warfighters who depend on what you build.
November is CISA’s Critical Infrastructure Security and Resilience Month, and the defense industrial base is one of the 16 sectors the federal government designates as critical infrastructure. Even so, many still treat OT security as a subset of IT security, handling it with the same general playbooks and assumptions even though the two are very different.
This is the first post in a three-part series on OT security for defense manufacturers. In this article, we’ll cover why OT has become such an attractive target, what really separates OT from IT, and why some of the practices that keep your office network safe can cause trouble on the shop floor.
Why Attackers Are Aiming for the Shop Floor
To a nation-state adversary, U.S. critical infrastructure offers major leverage. The systems that deliver power, water, communications, and military equipment are what keep our country running… which is exactly what makes them worth disrupting either before or during a crisis.
Adversaries have been targeting critical infrastructure and DIB suppliers with espionage attempts for years. In a joint advisory in 2022, CISA, FBI, and NSA reported that Russian state-sponsored actors had been targeting both large and small defense contractors and subcontractors for proprietary information on weapons development, communications infrastructure, and scientific research since at least 2020. And the threats haven’t let up: In July 2026, NSA and partners warned about Russia’s FSB Center 16 exploiting poorly configured networks in the DIB and other sectors; in August 2026, FBI, NSA, and U.S. Cyber Command’s Cyber National Mission Force warned of ongoing activity by a China-linked hacking group also targeting the DIB.
More recently, the goal has shifted from stealing information to preparing to cause damage. U.S. agencies assessed with high confidence that the Chinese state-sponsored group Volt Typhoon was pre-positioning on IT networks in order to move laterally into OT assets and disrupt them, not for the purpose of espionage but to put critical infrastructure at risk. While most of the confirmed intrusions were in energy, water, communications, and transportation, an adversary could use the same OT-targeting technique to try to slow U.S. military production in a conflict.
The OT Advantage
What makes OT such an appealing aim? Simply put, it’s often easier to break into than the business network around it. Much of the equipment on plant floors was designed decades ago for isolated networks, and retrofitting it to be more secure is challenging.
The result is that OT often offers very basic weaknesses for attackers to exploit, like the PLCs at U.S. water facilities that were targeted by Iranian hackers in 2023. According to CISA, the affected devices were exposed directly to the internet and still used the manufacturer’s default password, “1111.”
Manufacturing is even more vulnerable than other sectors because downtime is extremely expensive, giving ransomware attackers extra leverage, and because the walls between the office and the plant are often thin or missing. Dragos noted in its 2026 report that manufacturing environments have the highest rate of shared IT and OT network domains of any sector it assesses, at 46%. When the two networks share credentials and infrastructure, a phishing email that compromises one employee’s account can become a path to the shop floor.
Taken together, all these factors make DIB manufacturing companies a particularly attractive target to attackers. Understanding how to secure both IT and OT in a manufacturing environment is crucial to protect against everyone from foreign governments to criminal crews.
IT vs. OT: More Than Machines vs. Computers
Ask anyone in a defense manufacturing shop to explain OT versus IT, and you’ll probably hear some version of “IT is the computers, OT is the equipment.” That’s not wrong, but it is an oversimplification.
Traditional IT security puts confidentiality first: keep sensitive data away from people who shouldn’t see it. OT turns that order upside down. On the shop floor, safety and availability come first. The machine has to keep running, it has to run correctly, and it can’t risk causing physical harm. A security control that protects data but allows a production line to be shut down isn’t acceptable in OT.
The timelines are different for IT security than OT security, too. A laptop typically gets replaced every few years, while a CNC machine, PLC, or other piece of equipment might stay in service for decades. That’s why so much OT equipment runs software that’s long past its vendor support date: Upgrading would take production offline for weeks and potentially cost more than the machine itself.
It’s also not true that OT is always found in a giant machine on a factory floor; plenty of it looks exactly like IT. The human-machine interface (HMI) an operator uses to run a line, for example, is often an ordinary Windows PC, but it’s considered OT because it controls machinery.
Those differences carry over into compliance. Most of the security frameworks that DIB companies know best, including NIST SP 800-171, were written with conventional IT systems in mind. OT has its own guidance built around safety and availability, mainly NIST SP 800-82 and the ISA/IEC 62443 series. Compliance documentation also differs, since many OT systems produce few or no logs, run proprietary software, or can only be configured by the OEM that installed them. Unlike IT-centric frameworks, the OT-specific standards understand that you can’t always update a configuration, patch on schedule, or reboot at a moment’s notice.
Where the Line Gets Murky
If OT and IT lived in separate worlds, securing them would be fairly simple: draw a hard line and put the correct controls on each side. But on a modern shop floor, that line can be hard to find.
Imagine a single manufactured part traveling through the machine shop. An engineer designs it in CAD on a workstation connected to the corporate network, then CAM software turns that design into numerical instructions for the CNC machine on the floor. By the time the part is finished, the design data (which may be CUI or export-controlled technical data) has traveled from your business network onto a machine controller, then back up to your quality control systems and ERP.
Several systems in particular live at the intersection between the IT and the OT worlds. Engineering workstations can program equipment but also browse the web and check email, for example, and manufacturing execution systems connect production lines to the ERP so leadership can see output in real time. This is intentional, since the data interchange between IT and OT is critical for efficient factory operations, but it also creates more opportunities for attackers to gain access. And that’s not to mention machines with remote access for equipment vendors or Industrial Internet of Things (IIoT) sensors that report to cloud platforms.
The takeaway is that “Is this IT or OT?” is often the wrong question. A better question might be “What does this system connect to, and what would happen if someone took control of it?”
When IT Best Practices Don’t Work for OT
Unfortunately, strengthening OT security isn’t as simple as extending your IT security practices to more of your machines. Many of the practices that security teams consider non-negotiable in IT can cause real trouble when they’re applied to OT as blanket rules.
Patching is the clearest example. In IT, you apply security updates quickly and automatically, and an occasional reboot is a minor inconvenience. In OT, a patch can break a validated configuration, interfere with the software running a machine, or void the vendor’s support agreement. Many OEMs require that updates be tested and approved before installation, and the update itself may have to wait for a planned maintenance window, which could be weeks or months away.
Vulnerability scanning is another. Running an active scan across the network is routine in IT. Point the same scanner at older PLCs or controllers, and the flood of traffic can make them freeze, fault, or drop offline. That’s why OT environments usually rely on passive monitoring, which watches network traffic without poking at the devices themselves.
Endpoint protection doesn’t always fit, either. Installing an EDR agent or antivirus on every machine is standard practice in IT, but many OT devices lack the spare processing power or can’t run that software at all.
Even access controls need a second look. Account lockouts, short session timeouts, and repeated MFA prompts are sensible defaults on a laptop, but an operator who gets locked out of an HMI while responding to an alarm may face a safety issue. OT access controls still matter a great deal, but they have to be designed around how manufacturing and infrastructure operations actually work.
Bringing IT and OT to the Same Table
Good OT security doesn’t mean adopting the same assumptions and goals as IT security. Instead, the move is to consider both perspectives in the same room. IT teams know threats, identity, and network defense. Engineers and operators know how equipment behaves, what it can tolerate, and what happens when it goes down. Compliance teams, meanwhile, know which requirements apply and what evidence an assessor will expect. A strong OT security program will incorporate all of those perspectives.
The same lessons apply not just for defense manufacturing but also for water utilities, power providers, hospitals, and every other critical infrastructure operator that relies on industrial systems. Adversaries already see these environments as connected and are probing them for the weakest point, so it’s time to defend them the same way.
For defense manufacturers, of course, the stakes include contractual obligations and regulatory compliance. In the next post in this series, we’ll look at what CMMC actually requires for the shop floor and how assessors handle specialized assets.
