Identity Security in Critical Infrastructure: Why OT Security is the New Battleground

Federal and state leaders have maintained consistent focus on critical infrastructure protection through their cybersecurity evolution. Their priority remains preventing the disruption of essential services, including power, water, emergency response, transportation, communications, and healthcare. The reality driving this urgency is clear: adversaries and nation-state actors don’t need “Hollywood-style hacking” to cause real-world impact. Increasingly, they win by abusing access through compromised identities, overprivileged accounts, weak remote access paths, and other OT security gaps.

This is why the intersection of identity security and operational technology (OT) security has become the defining battleground for critical infrastructure resilience. It’s also why agencies like CISA have prioritized identity controls and remote access governance as core elements of protecting the nation’s critical infrastructure sectors. Now that operational technology is no longer truly air-gapped and remote operations and vendor support is a necessity, one question remains:

Can you prove who accessed what, when, from where—and what they did—without opening the network to do it?

This blog summarizes CISA’s 16 critical infrastructure sectors, explains why hacktivists, cybercriminals, and nation-states are increasingly targeting these environments, and dives into the practical “do-this-now” use cases for reducing risk using BeyondTrust Privileged Remote Access (PRA) and Identity Security Insights.

For state or local leaders, the takeaway is clear: even when you don’t “own” every asset, you often authorize access, operate identity systems, manage vendor relationships, coordinate incident response, and set minimum baselines. Resilience is still part of your job, and critical to your mission of serving and protecting your citizens and their families.

1) Hacktivists are chasing disruption and psychological impact

In December 2025, U.S. and international partners warned that pro-Russia hacktivists were conducting opportunistic attacks against critical infrastructure and using minimally secured, internet-facing VNC connections to access OT control devices—explicitly impacting sectors like water and energy. These actors are often less sophisticated than top-tier APTs, but their opportunistic targeting raises the odds of “wrong place, wrong time” disruption. [2]

2) Cybercriminals are monetizing downtime—and critical infrastructure has the most leverage

Ransomware remains a pervasive driver of risk. FBI data highlights that ransomware is a prevalent threat to manufacturing, healthcare, government, finance, and IT. Criminal groups are looking for the easiest access pathways, like stolen credentials, exposed services, unmanaged vendor access, and overprivileged identities. [3][4]

3) Nation states are pre-positioning for crisis leverage

Strategic actors want access that looks legitimate, lasts a long time, and can be activated when it matters. In 2026 U.S. government reporting and advisories have confirmed this pattern: adversaries aim to blend into normal administrative activity, making remote access paths and identity systems prime territory for their operations. Iranian and Chinese nation-state groups are directly targeting critical infrastructure. [5][6]

For more information, see the BeyondTrust Threat Advisory about critical risk related to Iranian groups.

OT security conversations often get stuck on tools and architecture diagrams. But current guidance is straightforward and clear: reduce exposed attack surface, enforce strong authentication, eliminate standing privilege, and ensure accountability for remote activity. [7]

The real-world pattern is equally blunt: attackers repeatedly exploit remote services and valid accounts to gain access, move laterally, and persist—especially where OT and IT converge. [8] So the practical question for state and local critical infrastructure leaders becomes:

How do we enable remote operations and vendor support without turning VPNs, jump servers, and shared accounts into “permanent breach infrastructure”?

In OT environments, remote work is not optional. Specialized engineers, integrators, OEMs, and field technicians need access to:

• Engineering workstations

• SCADA/HMI consoles

• Historians

• Dispatch/CAD and supporting systems

• PLC programming tools and vendor software

• Segmented networks aligned to the Purdue Model

As you modernize your OT, your attack surface expands. Traditional VPNs force broad network access, create long-lived pathways, and make it harder to prove accountability. Meanwhile, many zero trust network access (ZTNA) approaches struggle with custom PLC controllers and bespoke manufacturer software that don’t behave like more common web apps.

This is where Privileged Remote Access (PRA) helps, by providing point-to-point access to isolated and non-routable OT networks, outbound-only connectivity, and full recording for auditability without a traditional VPN.

Operational technology environments depend on trusted operators, vendors, and administrators who must access critical systems to maintain uptime and safety. The challenge is that attackers increasingly exploit the same pathways that legitimate users depend on. When credentials, vendor accounts, or remote access tools are compromised, attackers aim to operate like legitimate users to move laterally and persist.

BeyondTrust's privilege-centric identity security approach addresses this challenge by combining Privileged Remote Access (PRA) with Identity Security Insights, creating a practical model for securing OT environments built around three outcomes: visibility, intelligence, and protection.

• Visibility - Organizations must be able to see who has privileged access, what they can reach, and what activity occurs during each session. PRA provides complete session visibility across internal users and third-party vendors through session governance, recording, and detailed metadata.

• Intelligence - Identity Security Insights continuously analyzes identity relationships across endpoints, servers, identity providers, and cloud services to reveal hidden Paths to Privilege™. This includes identifying excessive permissions, risky credential relationships, and identity exposure that attackers often exploit to reach critical systems.

• Protection - Once risky privilege paths are identified, organizations can reduce exposure by enforcing least privilege, time-bound access, and session-level governance. BeyondTrust offers a modern privilege access management (PAM) approach, where PRA ensures access occurs only when needed and under controlled conditions, and Insights prioritizes the most impactful remediation opportunities to reduce the blast radius of compromise.

Together, these capabilities allow organizations to control the privileged access pathways attackers rely on while preserving operational workflows required to maintain industrial and mission-critical systems.

Use case 1: Replace VPN-based third-party access with outbound-only, session-governed access

Problem: Vendors and contractors often connect through VPNs or jump servers that provide more network visibility than needed. This is hard to monitor consistently.

The Privilege Remote Access (PRA) approach: Provide controlled access that does not require inbound exposure and supports stronger identity controls per session. PRA is explicitly positioned to enable outbound-only connections and fully recorded sessions for auditing.

How Identity Security Insights strengthens this use case: Insights identifies vendor accounts, shared credentials, and hidden privilege relationships that may allow attackers to escalate access after a connection is established. This helps security teams prioritize and reduce risky identity pathways before they can be abused.

What “good” looks like (success criteria):

• Replaced VPNs with outbound-only access that minimizes exposure

• Enforced MFA and just-in-time (JIT) access for internal and third-party users

• Achieved full session recording and audit evidence (video + logs)

• Identified and reduced risky vendor privilege relationships

Use case 2: Secure access into segmented, non-routable, and “effectively air-gapped” OT networks

Problem: OT environments often include segmented zones that are non-routable, with restricted connectivity aligned to Purdue levels. Secure access is needed without flattening segmentation.

The Privilege Remote Access (PRA) approach: Supports workflows where teams must traverse segmented architectures without turning segmentation into a myth. In customer examples, PRA supports operations that traverse Purdue Model zones while enforcing stronger access controls.

How Identity Security Insights strengthens this use case: Insights maps identity relationships across IT and OT-adjacent systems to reveal potential privilege escalation paths that could bypass segmentation through identity compromise.

What “good” looks like (success criteria):

• Enabled remote access across segmented zones without compromising firewall intent

• Preserved existing workflows while improving control and auditability

• Reduced the number of exposed services and “always-on” pathways

• Identified privilege escalation paths that could bypass segmentation controls

Use case 3: Support custom industrial tools and protocols while standardizing security controls

Problem: OT often depends on custom protocols and vendor tooling (Siemens, Rockwell, etc.) that break many “app-layer only” access.

The Privilege Remote Access (PRA) approach: Supports specialized tools, including capabilities like Protocol Tunnel Jump and network tunneling services.

How Identity Security Insights strengthens this use case: Insights analyzes identities interacting with these specialized environments, identifying risky privilege combinations, unused privileges, and machine identities that could allow attackers to move between systems

What “good” looks like (success criteria):

• Seamlessly supported specialized tooling workflows without exceptions that bypass security

• Standardized access controls even when the tools are not standardized

• Centralized governance over who can use which tool, to reach which asset, under what conditions

• Identified excessive privileges tied to specialized operational accounts

Use case 4: Centralize control and auditing for internal admins and third parties

Problem: Scattered access tools (VPNs, jump boxes, shared accounts, and ad hoc tooling) make it hard to prove accountability quickly—especially under audit pressure or during incident response.

The Privilege Remote Access (PRA) approach: Centralized controls, complete visibility across roles and sessions (including vendors), and “hands-free” auditing with recorded sessions and detailed metadata.

How Identity Security Insights strengthens this use case:
Insights provides continuous identity risk visibility across the environment, identifying hidden privilege relationships and risky identity configurations that could enable unauthorized access.

What “good” looks like (success criteria):

• Full session auditability with evidence for oversight and compliance

• Faster investigation and containment via session replay and centralized records

• Reduced operational friction for approvals and time-bound access

• Continuous visibility into identity risk and privilege escalation paths across systems aligned to known attacker techniques and tactics

For water and wastewater; electric utilities, hydroelectric dams, and nuclear-adjacent operations; transportation; communications; and emergency services, the security conversation cannot end at “reducing risk.” These sectors live and die by continuity and trust. The outcomes below matter because they reduce the most common pathways to disruption while preserving the operational reality that remote work, remote maintenance, and third-party support are unavoidable.

Replace VPNs with secure, outbound-only access to reduce remote access risk

VPNs and traditional jump servers expand network reach far beyond what a technician needs for a specific task, and they create durable pathways that are difficult to govern consistently, especially across vendors and distributed sites.

For critical infrastructure, the goal is remote access that doesn’t become the breach path. Eliminating or sharply reducing VPN reliance helps shrink the exposed surface area and prevents a single compromised credential from turning into broad network access.

What this looks like in practice:

• Energy and dams: Vendor access must be time-bound and scoped to assets and zones rather than an open tunnel.

• Water and wastewater: Enable remote troubleshooting without leaving internet-facing services exposed.

• Emergency services: Grant access quickly during incidents without falling back to shared accounts or “always-on” admin connectivity.

Enable secure access to segmented, non-routable OT networks

Segmentation is a core safety feature in OT security, but it makes support inefficient, especially with legacy remote access approaches.

The goal is to traverse segmented architectures intentionally—without flattening zones, weakening firewall intent, or creating permanent routes that attackers can later abuse. This is especially relevant when:

• OT networks are segmented along the Purdue Model (or similar), and the operator needs controlled access across zones.

• Systems are non-routable by design (or effectively isolated) and cannot be reached by standard IT remote access tools.

• Access must work for both internal teams and critical third parties during outages or safety events.

Centralize control and auditing

When access is scattered across multiple tools, governance becomes inconsistent. Centralization provides a single control plane to manage who can access which assets, under what conditions, for how long, with what authentication, and with what evidence of their actions. This matters for public sector entities because accountability expectations are higher, reporting requirements are real, and investigations often require rapid, defensible proof.

Support compliance and custom industrial tools

OT relies on specialized engineering workflows and vendor toolchains that don’t behave like standard enterprise applications. If security forces OT teams into fragile workarounds or forbids the tools that actually run the environment, security loses—because operations will route around it.

The outcome is a security model that supports specialized workflows, while still enforcing consistent controls: authentication, least privilege, time-bounded access, and session evidence. This is where many “generic remote access” solutions fail in OT. Critical infrastructure teams need remote access that respects OT reality.

State and local critical infrastructure operators are facing a three-part pressure system: opportunistic OT intrusions that exploit exposed remote access and weakly secured services, ransomware disruption pressure that monetizes downtime, and nation-state prepositioning that aims for persistence and crisis leverage [2][3][5].

Critical infrastructure protection comes down to a simple operational truth: if you can’t govern access or see privilege, you can’t reliably prevent disruption. Detection matters, but it’s not a substitute for proactively eliminating risky pathways and shrinking standing privilege.

In the face of rising pressure from hacktivists, cybercriminals, and nation states, state and local leaders must prioritize the most common chokepoint: the identity and remote access pathways that lead into operational environments.

Because OT is where legitimate access becomes operational control, the most impactful step you can take today is redesigning that access to be outbound-only, point-to-point, time-bound, and fully auditable. That shift protects the workflows that keep communities running, ensuring that trusted access never becomes a breach path. BeyondTrust Privileged Remote Access is designed for the practical realities of OT, offering support for specialized tools, segmented networks, non-routable environments, and third-party dependencies.

If identity is the new battleground, then OT remote access is one of the most important front lines, and it is one you can materially improve by redesigning how access is granted, monitored, and proven.

Learn more about securing critical infrastructure for state and local governments, or get started today with a critical infrastructure OT assessment.

[1] Critical Infrastructure Sectors. Cybersecurity and Infrastructure Security Agency (CISA). https://www.cisa.gov/topics/cr...

[2] Advisory AA25-343A: Pro-Russia Hacktivists Targeting OT Control Devices via Internet-Facing VNC. Cybersecurity and Infrastructure Security Agency (CISA). Dec 9, 2025. https://www.cisa.gov/news-even...

[3] FBI Reporting on Ransomware Complaints Tied to U.S. Critical Infrastructure. Reuters. Apr 23, 2025. https://www.reuters.com/world/...

[4] StopRansomware Advisory AA25-071A: Medusa Ransomware Impacting Critical Infrastructure Sectors. Cybersecurity and Infrastructure Security Agency (CISA). Mar 12, 2025. https://www.cisa.gov/news-even...

[5] Disruption of PRC-Linked Volt Typhoon Activity Targeting Critical Infrastructure. U.S. Department of Justice. Mar 6, 2024. https://www.cisa.gov/news-even...

[6] Sanctions Related to PRC-Linked Salt Typhoon Telecom Intrusions. U.S. Department of the Treasury. Jan 17, 2025. https://www.cisa.gov/news-even...

[7] Primary Mitigations to Reduce Cyber Threats to Operational Technology. Cybersecurity and Infrastructure Security Agency (CISA). May 6, 2025. https://www.ic3.gov/CSA/2024/2...

[8] MITRE ATT&CK for ICS: Remote Services Exploitation and ICS Techniques. MITRE ATT&CK. https://attack.mitre.org/techn...

[9] Cybersecurity Performance Goals 2.0. Cybersecurity and Infrastructure Security Agency (CISA). Dec 2025. https://www.cisa.gov/sites/def...

[10] CIP-003-9 Security Management Controls (Effective April 1, 2026). North American Electric Reliability Corporation (NERC). https://www.nerc.com/standards...

[11] ISA/IEC 62443 Standards Overview. International Society of Automation (ISA). https://www.isa.org/standards-...

[12] NIS2 Directive Overview. European Commission Digital Strategy. https://digital-strategy.ec.eu...