Applying Zero Trust to Ageing Operational Technology in Critical Infrastructure

October 17, 2026 - 20:06

Older operational technology systems remain the backbone of power grids, water treatment plants, and manufacturing floors. Many of these systems were designed decades ago with reliability and safety as the top priorities, not security. As organizations move toward zero trust models, applying those principles to ageing OT environments raises difficult questions about how to protect critical infrastructure without disrupting the physical processes that keep it running.

Zero trust assumes no user or device should be trusted by default, even inside the network perimeter. In IT environments, this approach has become standard. In OT, the stakes are different. A misconfigured access control or an aggressive monitoring tool can interrupt a production line or interfere with safety instrumented systems. The challenge is to segment networks, enforce strict identity checks, and monitor traffic without introducing latency or failure points that could endanger workers or the public.

Practical steps include mapping all assets and data flows before making changes, isolating legacy systems behind strict gateways, and applying least privilege access for engineers and vendors. Continuous monitoring helps detect anomalies, but it must be tuned to avoid false alarms that trigger unnecessary shutdowns. Safety must remain the governing constraint, meaning security controls are validated in test environments and rolled out gradually. With careful planning, zero trust can strengthen resilience in ageing OT without compromising the safety systems that protect people and equipment.