Many industrial organisations still lack complete visibility into their OT networks, while IT and OT security operations remain separate across much of the sector.
According to Palo Alto Networks’ 2026 State of Critical Infrastructure Cybersecurity Report, 68% of surveyed organisations lack complete, real-time visibility into connected OT assets. The report also found that 74% have not fully integrated their IT and OT security operations.
The findings are based on a survey of more than 1,600 security leaders across 11 countries and five critical infrastructure sectors. The research covers sectors including manufacturing and utilities, where connected equipment operates alongside enterprise IT systems.
Legacy infrastructure, incompatible technologies, and differing IT and OT priorities were among the challenges identified in the report.
Industrial network monitoring faces technical and operational constraints
Legacy industrial equipment remains a cybersecurity concern. Palo Alto Networks found that 42% of respondents identified unpatchable legacy OT assets as their single biggest cybersecurity risk.
Many industrial systems are designed to operate for extended periods, with software updates requiring testing and scheduled maintenance. Equipment that cannot receive security patches must instead rely on other protective measures, including network-level controls.
Industrial network monitoring also faces technical constraints. According to the US National Institute of Standards and Technology (NIST), active network scans can interfere with sensitive OT equipment and disrupt operational processes.
In its Guide to Operational Technology (OT) Security, NIST recommends scheduling active scans during planned OT outages where possible. Passive monitoring avoids direct interaction with devices but cannot identify equipment that is not communicating, while encrypted traffic can limit visibility.
NIST also notes that passive network scans often take days to complete because they depend on existing network traffic.
Palo Alto Networks found that organisations use an average of seven separate security tools to monitor and identify risks. According to the company, the use of disparate tools adds complexity and cost to security operations.
Network monitoring becomes more complex when industrial operators need to maintain asset information across multiple facilities. NIST recommends documenting network architecture and communications between connected devices before implementing security controls.
This includes connections within OT environments and between industrial systems and corporate networks. Such documentation is needed to establish appropriate monitoring and access controls.
The US Cybersecurity and Infrastructure Security Agency (CISA), together with international cybersecurity partners, addressed OT asset documentation in its Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators.
The guidance recommends maintaining OT asset inventories to support cybersecurity risk management. NIST also recommends identifying network connections and data flows to document communications between industrial equipment and other systems.
Centralised IT security policies do not automatically provide visibility into industrial equipment such as programmable logic controllers (PLCs), industrial gateways, and supervisory control systems. These devices have different performance, reliability, and availability requirements from conventional IT infrastructure.
NIST’s September 2026 draft update also addresses OT asset management, network monitoring, and the integration of Industrial Internet of Things (IIoT) systems.
IT and OT integration gaps affect network security controls
Palo Alto Networks found that many organisations continue to manage IT and OT security through separate operational processes. Technology incompatibility and differing priorities were identified as barriers to integrating security operations.
These differences also affect network monitoring. Conventional IT monitoring tools do not necessarily provide visibility into industrial controllers, their communications, or the operational processes they support.
NIST identifies network monitoring and centralised logging as components of OT security management. It also recommends assessing security tools for their potential effects on operational availability.
The Palo Alto Networks report also examined industrial network visibility across Asia-Pacific. Among 620 regional respondents, 74% lacked complete, real-time visibility into connected OT assets, while 80% had not fully integrated their IT and OT security operations.
Nearly two-thirds of Asia-Pacific respondents, or 64%, reported using six or more security tools across their environments. Another 58% said they had experienced a cybersecurity incident that affected operations during the previous 12 months.
Access controls were another area examined in the global research. Only 53% of surveyed organisations reported having policy enforcement and access controls across connected assets and users.
Palo Alto Networks identified network segmentation and secure remote access as measures for restricting communications between industrial equipment and limiting the movement of threats across connected systems.
NIST recommends identifying industrial network data flows and grouping equipment into zones based on operational and security requirements before implementing segmentation controls. These arrangements must account for communications between PLCs, engineering workstations, supervisory systems, and enterprise IT networks.
NIST identifies network switches, routers, firewalls, and unidirectional gateways among the technologies used for network segmentation and isolation. Their deployment must account for operational communications and system availability.
Implementing these controls across multiple facilities requires site-specific information about network architecture and equipment communications. The resulting segmentation arrangements must account for the operational requirements of each industrial environment.
Similar monitoring and asset management gaps were identified in separate research by Honeywell Technologies.
Its 2026 OT Cybersecurity Benchmark Report, released in September, surveyed more than 600 cybersecurity risk, compliance, and operations leaders across critical infrastructure sectors.
Although 88% of respondents described their OT cybersecurity programmes as mature, only 21% reported maintaining a complete inventory of their OT assets.
The report also found that only 33% of surveyed organisations had fully integrated OT into a centralised security operations centre. Meanwhile, just 20% continuously monitored connected Internet of Things (IoT) devices, including cameras and sensors.
(Photo by Philipp Katzenberger)
See also: Tailscale SSH flaw gives root on devices fleet-wide
Want to learn more about the IoT from industry leaders? Check out IoT Tech Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including AI & Big Data Expo and the Cyber Security Expo. Click here for more information.
IoT News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
