Why OT Hardening Requires a Different Mindset
Operational technology environments — PLCs, DCS controllers, RTUs, HMIs, historians — were designed for reliability and determinism, not confidentiality. Many systems run on Windows XP or embedded real-time operating systems that cannot be patched without vendor approval or a maintenance window that may only occur annually. The consequence of a misconfiguration is not a data breach; it is a turbine trip, a pipeline pressure anomaly, or a safety system failure. Defense-in-depth in OT means compensating for what you cannot patch rather than assuming you can harden everything directly.