# De-Risking Operational Technology: 5 Security Investments That Deliver Disproportionate Returns

- Link: https://www.agilicus.com/videos/de-risking-operational-technology-5-security-investments-that-deliver-disproportionate-returns/
- Published: 2026-05-15T13:36:57+00:00
- Author: Don Bowman

For too long, Operational Technology has been treated as a mysterious, untouchable
snowflake, supposedly protected by the legendary and impenetrable “air gap.” The
reality, however, is that modern industrial environments are highly interconnected,
hybrid networks where corporate IT seamlessly blends with plant floor machinery.
When we rely solely on an antiquated perimeter defence, we leave critical infrastructure
dangerously exposed to modern threat actors, supply chain vulnerabilities, and simple
human error. To meaningfully de-risk operational technology at a reasonable cost,
organisations must abandon the illusion of a perfect air gap and instead invest 
in a pragmatic, multi-dimensional defence-in-depth strategy that actively controls
system vulnerabilities.

### Related Reading

[Simple 3-Step Program To Reduce The Risk Of Ransomware](https://www.agilicus.com/videos/simple-3-step-program-to-reduce-the-risk-of-ransomware/)

**[Industrial Cyber Security Best Practices Scorecard](https://www.agilicus.com/l/industrial-cyber-security-best-practices-scorecard/)**

[Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/)

The inherent flaw of the air gap is that it assumes a binary world of “outside bad,
inside good,” completely ignoring insider threats, compromised vendor laptops, or
a malicious USB drive plugged directly into a SCADA workstation machine. Risk is
ultimately an equation: _Risk = Threat × Vulnerability × Impact_. While you cannot
always control the sophistication of the adversary (the threat) or the catastrophic
cost of physical downtime (the impact), you have absolute control over your vulnerabilities.
Relying on a single boundary is like holding up a single sheet of paper to stop 
an attack; when that layer fails, as historical compromises like Stuxnet and recent
attacks on electrical grids have proven, the entire system falls.

Effective security requires independent, orthogonal layers of defence, a concept
perfectly illustrated by the “Swiss Cheese Model.” In this model, every defensive
layer has inherent flaws or “holes,” but by stacking multiple, uncorrelated control
mechanisms, you ensure a single point of failure does not cascade into a total systemic
breach. If an adversary bypasses a network firewall, they should immediately hit
a completely unrelated barrier, such as an identity check or an internal micro-segmentation
rule. By categorising your environment pragmatically: recognising that much of your
operational technology is simply standard IT hardware sitting in a different building,
you can apply appropriate patching, hardening, and lateral movement restrictions
to contain potential breaches without disrupting the core industrial process.

![2026-05-14-it-ot-venn](https://www.agilicus.com/www/b7ace15e-2026-05-14-it-ot-
venn.avif)

To achieve this resilience, organisations should focus their investments across 
five distinct, independent dimensions: Boundary Defence, Identity & Credentials,
Lateral Movement, System Hardening, and Visibility & Detection. Upgrading just one
of these exponentially improves the overall strength of your network. For instance,
[CISA’s Risk and Vulnerability Assessments (RVAs)](https://www.google.com/url?sa=E&q=https%3A%2F%2Fwww.cisa.gov%2Fresources-tools%2Fresources%2Frisk-and-vulnerability-assessments)
consistently highlight that identity and credential abuse is a primary vector for
successful cyberattacks. By implementing phishing-resistant multi-factor authentication(
MFA) and eliminating shared vendor accounts, you neutralise this massive threat.
Combine this identity-first approach with strict boundary enforcement, internal 
protocols to block lateral movement, rigorous system hardening, and deep centralised
logging, and you buy your team the precious time needed to detect and stop an intrusion.

Securing operational technology infrastructure doesn’t demand an infinite budget,
nor does it require paralyzing the business in pursuit of “zero risk”; it simply
requires a layered, multidimensional approach that systematically mitigates vulnerability.
Every incremental improvement across these five independent dimensions drastically
reduces your operational risk, proving that the enemy of “good enough” is perfection.
You don’t have to tackle the entire environment overnight. To help you chart a pragmatic
course forward, Agilicus has developed a free [Cyber Security Assessment Scorecard](https://www.agilicus.com/l/industrial-cyber-security-best-practices-scorecard/)
and a detailed [Industrial Cyber Security Best Practices Guide](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).
I invite you to use these tools to evaluate your current posture, identify your 
most critical gaps, and begin making targeted security investments that deliver 
true operational resilience.