This is an anonymized field note from an industrial security assessment. The operator is not identifiable, and specific equipment has been generalized. The finding is reported as it happened.
The engagement opened with the client's own description of the environment: the control network was air-gapped from corporate IT. That belief was sincere, held by capable engineers, and wrong.
The Setup
The operator ran continuous industrial processes across several facilities. The control environment had been built when air gapping was the standard approach and had been documented that way ever since. The network diagram, which was detailed and evidently maintained with care, showed no connection between the corporate and control environments.
The diagram was accurate as of roughly a decade earlier.
What We Found
Four connections, discovered over the first week, none of them present in the documentation.
A vendor remote access appliance. Installed for a commissioning project, retained for support, and reachable from the internet. It authenticated with a shared account whose password was in the project documentation, and it connected directly into the control network, bypassing the corporate environment entirely. The project had completed four years earlier.
A data historian with a foot in both networks. The historian collected process data for reporting and had two network interfaces, one in each environment, with routing enabled. This was deliberate and had been approved, on the reasonable grounds that management needed production dashboards. What had not been assessed was that compromising the historian gave direct access to the control network, and the historian ran an operating system that had reached end of support.
An engineering workstation on the corporate wireless network. A laptop used for controller programming had been connected to corporate wireless for software updates and had remained connected. It held the engineering software, the project files and cached domain credentials.
A forgotten switch uplink. A physical link between a control network switch and a corporate switch, installed during a facility expansion and never removed. It carried no configured VLAN separation.
Each connection had a rationale. Each had been created by someone competent solving a real problem. Nobody had ever assembled the four into a single picture.
Impact
Combining the findings, a route existed from the internet, through the vendor appliance, into the control network. A second route existed from an ordinary corporate phishing compromise, through the historian, to the same place. Neither required defeating the air gap, because there was no air gap to defeat.
Once inside the control network, the environment was as expected for its generation: industrial protocols with no authentication, controllers that accept commands from anything that can reach them, and no monitoring that would distinguish an operator's command from anyone else's.
We did not test what could be done to the physical process, and would not have. The presence of the path was the finding.
How the Boundary Is Actually Enforced
The operator's response was structural rather than device-by-device, which is the right instinct.
- Reduce to one crossing point. The vendor appliance was removed, the switch uplink physically disconnected, and the historian rebuilt as a one-way data flow using a data diode arrangement so process data leaves without anything entering. Vendor access now routes through a single jump host requiring multi-factor authentication, with full session recording and access granted per request.
- Separate credentials completely. Engineering accounts were removed from the corporate domain, so a corporate compromise yields nothing in the control environment.
- Fix the workstations. Engineering laptops were removed from corporate wireless and brought under a managed update process that does not require general network access.
- Monitor the crossing point. With one path instead of four, monitoring it became tractable. Traffic across the boundary is now logged and reviewed.
- Document what exists, not what was designed. The operator now validates the network diagram against discovered reality on a set cadence, which is what would have caught all four connections years earlier.
Why It Matters
Industrial operators are targeted by ransomware crews who have learned that a business losing production pays quickly, and by state-aligned actors interested in the physical process itself. CISA has issued repeated advisories about exactly this boundary.
The recurring finding across these assessments is not that operators are careless. It is that connectivity accumulates faster than documentation, and that an environment described as air-gapped is rarely reassessed, precisely because everyone believes the strongest possible control is already in place.
To have your IT and OT boundary assessed safely, get in touch.
Frequently asked questions
What is an air gap in an industrial context?
An air gap means there is no network path whatsoever between two environments, typically a corporate IT network and an operational technology network controlling physical processes. It is a strong control when it genuinely exists. In practice, true air gaps are rare in operating businesses, because the pressure to move data out of the control environment for monitoring, reporting and vendor support is constant.
Why do air gaps erode over time?
Each individual connection is added for a good reason: a vendor needs remote support, management wants production dashboards, a historian must feed a reporting system. Each is approved on its own merits, often by different people over several years, and no one holds the cumulative picture. The gap does not fail; it is dismantled one reasonable decision at a time.
Is it safe to scan an OT network?
Active scanning of legacy control equipment carries genuine operational risk, because industrial protocols and older controllers can respond badly to unexpected traffic, and a device that fails may be controlling something physical. Responsible assessment uses passive traffic analysis and configuration review as the default, and performs any active testing only with control engineers present, outside operational windows, and with a rollback plan.
What is the Purdue model and does it still apply?
The Purdue model is a reference architecture that separates industrial systems into hierarchical levels, from field devices up to enterprise IT, with controlled boundaries between them. It remains useful as a way to reason about segmentation, though modern cloud connectivity and industrial IoT complicate the clean layering. The principle it encodes, that traffic should cross levels only through controlled points, is what still matters.
What single control matters most at the IT to OT boundary?
A single controlled crossing point with strong authentication and session recording, and nothing else permitted. Most of the risk in these environments comes not from the strength of the boundary but from the number of places it is crossed. Reducing four paths to one, properly instrumented, does more than hardening any individual device.