Remote access across operational technology (OT) is under more strain than ever before. Vulnerabilities in legacy systems that cyber adversaries are increasingly exploiting with alarming precision are growing alongside industrial networks. Convenience-driven traditional OT remote access security solutions frequently fall victim to complex attacks, exposing vital infrastructure. It’s just as hard not to let operational defenses get in the way of organizational agility.
Balancing usability with security is walking a tightrope. Lax rules breed violations, but overly strict rules can hinder productivity. Granular access restrictions, adaptive authentication, and session monitoring that adapts to risk, without getting in the way of workflows, are the answer.
Monitoring remote access in complex OT environments involves more than just reviewing logs; organizations need to know who is connecting, when, and why at all times. Suspicious activity should create an immediate response, not cool analysis in hindsight. Organizations have NERC and National Institute of Standards and Technology (NIST) frameworks, but that kind of compliance really is not sufficient. Organizations need to move beyond checklists, baking security into remote-work operations.
The future of work will be determined by how effectively companies share threat intelligence, not only within their sectors but beyond national borders and academic disciplines. As threats continue to become more nimble, a siloed defense won’t cut it. In this new industrial age, survival is for those who defend together.
Fixes in the technical realm alone won’t bridge the gap. What will be required is sustained cooperation between asset owners, regulators, and technology providers, along with governance models to evolve in parallel with the real-time operational risk. In the next three to five years, secure remote access will either become a core strength or remain a chronic weakness waiting to be exploited.
Securing industrial access in shifting threat landscape
Industrial Cyber reached out to industrial cybersecurity experts to explore the state of OT remote access security, which technologies, architectures, or strategies, such as zero trust, identity and access management (IAM), jump servers, VPNs, and DMZs, have proven most effective in securing remote access across industrial environments. Based on their insights, they address whether adoption of these measures has gained momentum or stalled over the past 18 to 24 months.
Andrew McPhee, OT security solutions manager at Cisco, said that zero trust network access (ZTNA) has emerged as the most effective technology for enabling secure remote access.
“While Virtual Private Network (VPN) systems remain common and are often paired with a jump server, this traditional approach to remote access is increasingly seen as outdated,” McPhee told Industrial Cyber. “VPN systems are not inherently secure, requiring extensive configuration and often additional tools to achieve an acceptable level of protection. In contrast, ZTNA solutions are based on least privilege security as a core principle, offering built-in protection features such as restricting user access to only the necessary resources and verifying user trust before granting system access.”
Over the past two years, McPhee identified a clear shift toward ZTNA solutions, which are now preferred for their superior security capabilities. However, organizations with existing VPN infrastructures often face a slow transition process, leaving them vulnerable to potential security risks during the interim.
Roman Arutyunov, co-founder and senior vice president of products at Xage Security, told Industrial Cyber that VPNs and jump servers are increasingly being phased out due to their security risks and operational complexity.
“Over the past 18–24 months, we’ve seen accelerated adoption of consolidated platforms that integrate IAM with secure remote access, reducing reliance on fragmented tools,” Arutyunov said. “Zero Trust has gained strong traction, particularly as modern solutions implement it seamlessly, enforcing least privilege and identity-based access without adding user or deployment friction.”
He added that organizations are prioritizing simplicity, scalability, and stronger security posture, moving away from legacy architectures toward unified, zero trust driven strategies purpose-built for industrial environments, while still preserving the DMZ (demilitarized zone), defense-in-depth layered architectures, and resisting the urge to flatten networks and expose assets to the internet.
“DMZs are the most effective means of establishing control over access to OT assets,” Ian Schmertzler, co-CEO and founder at Dispel, said. “They ringfence the problem, but, more importantly, they scope it so people feel oriented and can engage with the problem. The deployment timeframe for an OT DMZ has compressed from eight months down to about three hours, and adoption has increased alongside that change in overhead.”
Jonathon Gordon, directing analyst at Takepoint Research, told Industrial Cyber that adoption has noticeably accelerated over the past 18 to 24 months, driven by a combination of operational changes, increased cyber risk, and regulatory pressure, particularly from frameworks like NIS2. “Among the most effective strategies are those that combine ZTNA, robust IAM, jump servers, and segmented DMZ architectures. VPNs still have a footprint, but they’re quickly losing ground as organizations recognize their limitations in visibility and control.”
Gordon added that the broader trend is toward software-defined perimeters and access models that emphasize identity, context, and least privilege. Just as important, however, is usability. Industrial users, engineers, technicians, and contractors are focused on maintaining uptime, not navigating unfamiliar tools. The most successful implementations are those that blend strong controls with a frictionless user experience, making security as transparent as possible without sacrificing protection.
How OT remote access fails under pressure
Weak OT remote access security remains a root cause of many successful breaches, especially when VPNs and exposed devices are left unprotected. The executives analyze the common pitfalls organizations face when deploying remote access solutions in OT environments, and how they can effectively assess the performance and resilience of these systems to uncover areas that need improvement.
“A common challenge is failing to keep industrial systems up to date and protected against exploitation. Devices with a public IP address become an easy target, often subjected to multiple attacks daily,” McPhee said. “Successful breaches are on the rise, primarily due to vulnerabilities stemming from improper patching and inadequate management. Adopting remote access solutions that expose industrial assets to the public internet means you’re inviting attacks on your network.”
In contrast, he noted that ZTNA solutions mitigate this risk by employing a combination of on-premises agents and cloud brokers. “With this approach, remote users connect to a secure cloud instance rather than directly accessing the organization’s network. On-premises agents initiate communication with the cloud, eliminating the need to expose entry points that could invite external attacks.”
McPhee noted that for organizations hesitant to transition to newer approaches like ZTNA, maintaining robust security measures is essential. “This includes keeping systems consistently updated with the latest security patches, enforcing strict identity and access management policies, and eliminating dormant accounts. Additionally, implementing strong multi-factor authentication (MFA) policies can significantly reduce vulnerabilities and enhance the overall security posture.”
Arutyunov mentioned that securing network access alone is no longer sufficient; organizations must extend security down to the individual asset level to ensure true protection in OT environments.
“Common pitfalls in implementing remote access include reliance on insecure solutions such as traditional VPNs, inadequate access controls, and the continued use of static credentials,” he added. “These weaknesses introduce significant security vulnerabilities and increase the risk of operational disruptions. To identify and address these gaps, organizations should rigorously evaluate their remote access solutions through regular penetration testing, measurement of productivity improvements for internal users and third-party vendors, and assessment of audit readiness against industry regulations.”
Schmertzler told Industrial Cyber that ‘secure remote access’ is not, in fact, one system; it is six systems merged. “As more competitors have entered the remote access market, firms have competed on price by chopping up their offerings and running an upsell route. The process to avoid this is straightforward: ask your potential vendors to provide you with a line-level walkthrough of how their product maps to your NIST 800-82 or -53 system security plan gaps.”
He added that, barring the occasional dishonest salesman, this approach helps preserve clarity on whether all 791 controls are being met by the solution or combination of solutions being procured.
“A major misstep is attempting to apply IT remote access models directly to OT environments without accounting for their unique operational demands,” Gordon said. “Uptime requirements are non-negotiable in industrial settings, and solutions that introduce latency, complexity, or risk of disruption rarely gain traction. Many organizations also underestimate the complexity of securing ICS protocols and fail to implement adequate visibility into what users are actually doing during remote sessions.”
Another blind spot he identified is contingency planning. “Too few organizations ask the basic question: What happens when connectivity is lost? In OT, degraded networks or isolated systems are common realities, and remote access strategies need to reflect that. Solutions must be able to degrade gracefully or support offline fallback procedures without compromising safety or operations.”
“One of the most overlooked but critical issues is the failure to involve key user groups early in the process. Secure remote access initiatives are often rolled out from the top down, without embedding plant engineers, operators, or even third-party vendors into the design phase,” Gordon said. “These stakeholders are the ones using the tools day to day, and if their operational challenges aren’t addressed up front, adoption suffers. Bringing them in from the beginning helps ensure that the solution is not only secure, but also practical and fit for purpose.”
He noted that the more advanced organizations are going further, stress-testing their access models through red-team exercises and scenario-based drills.
Balancing security and usability in industrial remote access
The executives explore how organizations balance usability and OT remote access security when granting remote access to third parties such as vendors and contractors. They also examine how these priorities have shifted in response to escalating geopolitical tensions.
“In the past, secure often meant complicated,” McPhee evaluated. “A typical remote access session involved multiple cumbersome steps: adding users to the VPN, optionally setting up multi-factor authentication (MFA), restricting VPN users to access only the jump server, providing separate credentials for the jump server, configuring policies to limit the server’s functionality, setting up live monitoring during the session, and, finally, remembering to disable all access and policies once the session ended. This intricate process not only created inefficiencies but also increased the risk of human error.”
He added that ZTNA has resolved these challenges by seamlessly integrating security with user-friendliness. “With ZTNA, MFA is enabled by default, users are granted access only to the specific resources they need, and built-in controls allow organizations to schedule access and monitor sessions effortlessly. This streamlined approach significantly reduces complexity while maintaining a robust security posture.”
Arutyunov assessed that improved security and usability are no longer at odds. “Just-in-time and just-enough-access principles are the expectations now for vendor access. Additionally, customers are now integrating their secure remote access with external IdPs and identity governance solutions to ensure vendor identity is real and verified.”
Amid rising geopolitical tensions, he suggested that it is more critical than ever for organizations to continuously monitor their environments for anomalous behavior. Automated controls should be in place to immediately isolate critical systems and restrict access for users exhibiting suspicious activity. This proactive approach minimizes dwell time, reduces the risk of escalation, and ensures that threats are contained before they can impact operations.
“Remote access systems are not cybersecurity systems; they are efficiency tools with necessary cybersecurity attributes,” according to Schmertzler. “Higher security solutions have always and continue to struggle outside of regulated or heavily attacked markets due to their underlying costs. We have seen a material increase in security as a priority for remote access systems in the European and Oceanic markets.”
Gordon signaled that organizations are increasingly turning to brokered access models that provide third parties with highly scoped, time-limited entry points, often through ZTNA platforms or secure gateways that enforce strict policy controls. “The goal is to limit what a contractor or vendor can see and do, while maintaining enough usability to support fast, effective troubleshooting or maintenance.”
In many cases, he observed that usability has improved through tighter integration with existing vendor onboarding workflows and minimal agent requirements. “This balance is critical, especially as geopolitical tensions rise. Access from certain regions is being geo-fenced or scrutinized more heavily, and identity verification requirements are tightening in step with supply chain risk awareness.”
Furthermore, Gordon mentioned that the conversation has shifted from ‘how do we enable access?’ to ‘how do we enable the right access, to the right people, for the right amount of time, no more, no less?’
Auditing remote access in complex OT environments
Maintaining visibility and auditability is central to any robust OT remote access security program. The executives review the governance and policy measures essential for managing remote access in distributed OT environments, and how organizations can maintain continuous session monitoring and auditing across all sites.
McPhee said that because industrial organizations rely on multiple remote experts to maintain a massive number of OT assets, managing identities and defining who can access what and when is critical. “One key principle is ensuring remote access is on-demand rather than always available. This minimizes the attack surface by enabling access only when needed. Additionally, admin accounts should be strictly limited. Not every user in your system needs unrestricted access across all sites.”
He also called upon organizations to designate a local admin for each site, while all other accounts remain standard users. “To ensure robust oversight, remote access tools should go beyond simply granting access—they must also provide visibility into remote access activity.”
“Organizations managing distributed OT environments should adopt zero trust policies and enforce least privilege access to minimize risk,” according to Arutyunov. “Security can be especially challenging at remote or isolated sites, where connectivity is limited and devices often can’t support agents, making traditional approaches ineffective. Access solutions must secure systems without introducing new attack vectors.”
He added that centralized session monitoring is essential, with real-time oversight, logging, session recording, and the ability to terminate sessions instantly if needed. “We are seeing customers wanting to get more granular with their session management to control not just access to the machines, but also the commands users should be able to execute on those machines and track command execution histories.”
Schmertzler said that it is essential that a vendor deploy both a remote access tool and a policy that lets the machine managers control access to their equipment. “If you don’t, you’ll find out the day something goes wrong. The foreman knows who should be working on the equipment. The IT person rarely does. Run drills during your pilot period to see if your procedures and the systems you are testing really work under pressure.”
“Effective governance starts with clearly defined access roles, enforced through centralized policy management and approval workflows,” Gordon recognized. “Organizations that have successfully scaled remote access across multiple industrial sites typically rely on a unified platform to apply and enforce these rules, reducing the risk of inconsistent implementations.”
He added that continuous monitoring is also key, not just for compliance, but for operational assurance. Real-time session recording, centralized logging, and integration with broader SIEM or SOAR platforms allow security teams to maintain oversight without being embedded on-site.
“Auditability has become a board-level concern, especially as more regulators require demonstrable proof of control,” according to Gordon. “It’s not enough to say access is secure; organizations must be able to show who connected, when, for what purpose, and what actions were taken during that session. Solutions that make this easy, and that fit within existing industrial workflows, are the ones gaining traction.”
NERC and NIST guide OT remote access practices
In light of recent incidents tied to weaknesses in OT remote access security, the executives examine how regulations, industry frameworks, and standards, such as NERC CIP, IEC 62443, and the NIST Cybersecurity Framework, are influencing secure remote access strategies across industrial sectors.
McPhee said that industry frameworks play a crucial role in providing blueprints for securing critical infrastructure, yet remote access guidance is frequently buried within extensive documents, making it difficult to locate and emphasize. “Given the growing importance of securing remote access technologies, standalone guidance is needed. It should be easy to access and must highlight the risks of poorly implemented controls.”
“In other cases, such as with NERC CIP, industry frameworks can create barriers to adopting advancements in remote access technologies,” according to McPhee. “Many of today’s most secure solutions are cloud-hosted, leveraging trusted cloud brokers to prevent remote users from directly accessing an organization’s network. These brokers act as a protective layer, significantly reducing external exposure. However, the path to utilizing cloud technologies under such frameworks is often unclear, leading to hesitation or delays in implementation.”
Arutyunov highlighted that these regulations, frameworks, and standards emphasize zero trust, least privilege, strong authentication, session monitoring, and granular access controls. “Solutions should enable compliance by enforcing identity-based access, improving credential management, enabling phishing-resistant MFA, recording all activity, and securing remote sessions—even across air-gapped or legacy systems—ensuring resilience and regulatory alignment across all sites.”
“The most repeated reference standard we have heard about in the last year, by far and regardless of where we are in the world, has been NIST 800-82 and its parent document, NIST 800-53,” Schmertzler said. “The combination of its materials being free to access, its steady tempo of updates, and its readily approachable training has made it the clear leader. It is shaping secure remote access strategies because it provides a checklist of controls against which any vendor and any system that defines the OT network can be judged.”
Gordon said that regulations and frameworks are setting the tone for how secure remote access is expected to function across industrial sectors. “Standards like IEC 62443 and regulatory regimes such as NERC CIP are defining the baseline, access controls, session logging, periodic reviews, they’re no longer nice to have, they’re required.”
He added that the latest update to the NIST Cybersecurity Framework puts greater emphasis on third-party and supply chain risk, an area where remote access has often been a soft spot. High-profile breaches involving poorly managed remote connections have reinforced the need for real-time authentication, segmentation, and behavior-based monitoring.
More importantly, Gordon noted that compliance expectations are evolving. “It’s no longer about producing documentation after the fact. Regulators and stakeholders expect organizations to demonstrate live control, measurable, monitorable, and adaptable to changing threats.”
Road ahead for OT remote access and intelligence sharing
Looking ahead three to five years, OT remote access security is expected to undergo significant evolution, as executives weigh in on key trends shaping its future in industrial settings, and the role cross-sector collaboration and threat intelligence sharing will play in strengthening defenses.
“Over the next 3-5 years, remote access identity threat detection and response (ITDR) functions will play a key role in securing the networks. ITDR focuses on identifying anomalies in human behavior, detecting potential unauthorized access, and responding to security incidents promptly,” McPhee said. “As artificial intelligence gets better and better, so does the ability of attackers to use it for social engineering, compromising user accounts, and building vulnerability exploits. Remote access technologies must be equipped with the tools to protect against these attacks and provide organizations with visibility when suspicious activity is occurring.”
Arutyunov said that remote access security in industrial settings will accelerate toward Zero Trust architectures with AI-driven policy enforcement over the timeframe. “Just-in-time, credential-free access will become standard, reducing both risk and administrative burden. Cross-sector collaboration and real-time threat intelligence sharing will play a pivotal role—enabling dynamic policy refinement, faster threat response, and stronger collective defense across critical infrastructure sectors.”
“Remote access into OT environments happens because something needs to change inside of that environment,” according to Schmertzler. “Demand for faster reaction times across facilities is going to drive increasing demand for firmwide (i.e., ‘unified’) OT DMZs. This will, in turn, raise the expectations for the reliability of the connections between such secure enclaves and the enclaves they are spanning into.”
For cross collaboration, he added that the NIST has been a reliable standards body that would not only listen but also update standards in a timely fashion to shifting threats. “We do not expect this to change in the next 3 to 5 years.”
Gordon estimated that OT remote access security is evolving toward a dynamic, AI-driven, risk-aware model. “AI-powered monitoring, real-time trust scoring, and policy-driven orchestration will enable more adaptive control, where access is granted or revoked, based on live context, not static rules.”
“Collaboration will be central to this evolution. Threat actors are moving faster, and often across sectors,” according to Gordon. “The ability to share actionable intelligence, especially through ISACs and industry consortia, will determine how well organizations can anticipate and respond. That said, not all ISACs are created equal. Some have matured into highly effective platforms for collaboration, while others still face challenges in reach and coordination.”
As industrial operations grow more connected and interdependent, Gordon concluded that the importance of shared playbooks, standardized practices, and mutual defense mechanisms will only increase. Remote access isn’t just an IT concern anymore; it’s a core element of industrial resilience.
