7 Ways an OT Breach Can Take Down IT

An OT breach can take down IT because the systems that connect the plant to the enterprise, such as shared Active Directory, patch servers, historians and vendor access, carry an attacker in either direction, and a SOC that watches only IT sees half the path. The result is the damage CISOs already answer for: domain compromise, enterprise ransomware, stolen data and, at public companies, an SEC filing due four business days after the incident is judged material. Mithryl Systems addresses that blind spot with OT managed detection and response (OT MDR) that correlates activity across enterprise IT, the DMZ and OT to identify attacks that cross those boundaries.

Operational technology (OT) covers more than factory controllers. NIST defines it as "programmable systems or devices that interact with the physical environment" and names building management systems and physical access control alongside industrial control systems.

In a 2025 SANS Institute survey sponsored by OPSWAT, 58% of respondents said an IT compromise was an initial attack vector in their OT incidents. That's the direction everyone watches. The bridges run both ways, yet only 46% of the assessments in Dragos's 2026 report found adequate OT network monitoring. Dragos also found that ransomware sat in OT environments for an average of 42 days in 2025.

Diagram of enterprise IT, the IT/OT DMZ and the OT plant network with seven numbered two-way connections between them

Seven connections between plant and enterprise, each able to carry an attacker in either direction

1. A Shared Active Directory Turns a Plant Workstation Into a Domain Problem

When plant computers join the corporate domain, or trust it, credentials stolen in OT work in IT. Human-machine interfaces (HMIs) and engineering workstations are Windows machines that happen to run physical processes, and Dragos says they often get misclassified as IT.

In a published Mandiant red team engagement, testers used Mimikatz and DCSync to pull domain administrator credentials from an OT domain. Consider the same technique on an HMI that's joined to the corporate domain: accounts that log on to that machine, administrators included, leave credentials in memory that an attacker can harvest and reuse against corporate servers.

Domain compromise is a common precondition for enterprise-wide ransomware: Microsoft says attackers breach a domain controller in more than 78% of human-operated attacks. CISA's red team assessment of a critical infrastructure organization found that golden tickets and DCSync went undetected. Watch for authentication from OT subnets to corporate domain controllers.

2. Patch and Management Servers Push Commands in Both Directions

Any server trusted by both networks is a two-way bridge, and management servers are built to push code. In Mandiant's engagement, a permitted management path led to a Windows patch server in the DMZ. Testers logged in to the hypervisor console with IT domain administrator credentials, ran commands on the patch server, then moved over SMB into OT.

Picture the reverse: an attacker who lands on that DMZ patch server inherits the connections that trust it. CISA's red team also took over SCCM servers that managed most of an organization's Windows systems.

One compromised management server can deliver ransomware everywhere it reaches. Watch for management actions outside change windows and console logins from unexpected hosts.

3. Facilities and OT Vendors Hold Keys to Your Network

The 2013 Target breach began with credentials stolen from an HVAC contractor, not a hacked HVAC system. According to a U.S. Senate Commerce Committee staff report, attackers used the contractor's access to a vendor billing and project portal to reach point-of-sale systems, affecting 70 million to 110 million customer records. Target didn't require two-factor authentication for all vendors.

Claroty's Team82 found in 2024 that 55% of organizations run four or more remote access tools in their OT environments, many without multi-factor authentication or session recording.

Mithryl Systems integrates with VPNs, remote access systems and identity platforms, so its OT analysts can investigate suspicious vendor sessions with operational context.

4. Building Systems and Connected Devices Sit on the Corporate Network

Facilities devices can be the way in and the cause of the outage. In 2019, Microsoft caught the Russian group it tracks as STRONTIUM entering corporate networks through a VoIP phone, an office printer and a video decoder. Two still had default passwords. Once inside, the attackers scanned the network and hunted for higher-privileged accounts.

Verizon's 2017 Data Breach Digest describes a university where more than 5,000 compromised devices, including vending machines and lighting systems, flooded its DNS servers and brought the network to a near standstill.

These devices generally can't run endpoint agents, so network behavior is the main evidence. Watch for new protocols, new internal destinations and transfers to rare external addresses.

5. Plant Cellular Routers Can Bypass Your Corporate Firewall

Cellular routers that OT teams install for remote monitoring can give the plant its own internet connection, one that never passes through the corporate firewall. In 2023, Forescout found more than 86,000 Sierra Wireless OT and IoT routers exposed online. Researchers at OTORIO disclosed 11 vulnerabilities in 2023 in routers and cloud management platforms from Sierra Wireless, Teltonika and InHand, including a way to register a victim's router to an attacker's own cloud account.

The edge is a proven entry point. In May 2023, attackers exploited CVE-2023-28771 in Zyxel firewalls at Danish energy companies and drafted some of those firewalls into a botnet.

A compromised router is a door the corporate perimeter never sees. Inventory every network path out of OT, and flag traffic from plant subnets toward corporate servers that has no business purpose.

6. Historians Feed the ERP, and Attackers Can Follow the Data

A historian is a database that stores process data and feeds it to ERP and analytics systems, so it sits in the DMZ with trusted connections to the business. Claroty's Team82 disclosed an authentication bypass rated 9.8 out of 10 in GE Proficy Historian in 2023. Chained with a file-upload flaw, it allowed code execution as SYSTEM.

Consider an attacker who reaches that historian from the plant side. Every connection it holds to business systems becomes a path forward, and corrupted production data flows into the ERP.

Mithryl Systems monitors historians and IT/OT DMZ environments. A historian that suddenly opens SMB, RDP or LDAP connections toward IT deserves an investigation.

7. Plant Laptops and USB Drives Carry Infections Out

Laptops and USB drives that move between plant and office carry malware across. MITRE ATT&CK for ICS lists these paths as Transient Cyber Asset (T0864) and Replication Through Removable Media (T0847). Honeywell's 2025 Cyber Threat Report found that one in four incidents its team handled involved a USB event, and detections of the credential-stealing Ramnit trojan in industrial networks rose 3,000%.

OT malware doesn't stay put. Stuxnet was built for one Iranian plant, and Symantec counted roughly 100,000 infected computers worldwide by September 2010.

Credential stealers in OT feed straight back to item 1. Flag any device seen on both the OT and corporate networks.

IT-Only Monitoring Versus Cross-Boundary Detection

The gap is visible in what each approach can see.

IT-only SOC monitoring compared with detection across IT, the DMZ and OT
Compared on	IT-only SOC monitoring	Detection across IT, DMZ and OT
Agentless and legacy OT hosts	Largely invisible to EDR	Covered through OT network monitoring
Identity attacks such as golden tickets and DCSync	Missed in CISA's red team assessment	Correlated with OT context
OT ransomware exposure time	42-day industry-wide average dwell time (Dragos, 2025)	Five days on average to detect and contain, with comprehensive OT visibility (Dragos)
Response decisions	IT playbook may isolate first	Customer keeps operational authority

Frequently Asked Questions

Can our existing SOC see an attack that moves from OT into IT?

Often only part of it. A security operation built around endpoint agents misses activity on agentless OT devices and at the network layer, where boundary crossings happen. CISA found one critical infrastructure organization "relied too heavily on host-based endpoint detection and response."

Does an OT incident count for SEC cyber disclosure?

The SEC rule turns on materiality, not on which network the incident started in. Public companies currently must file a Form 8-K within four business days of deciding an incident is material. Nucor and Sensata both filed after incidents halted or disrupted production.

Do we need to replace our security tools to monitor IT and OT together?

No. Mithryl Systems integrates with existing SIEM, OT monitoring, EDR, firewall, identity, VPN and remote access tools and correlates their telemetry instead of replacing them.

Will an OT MDR provider shut down our equipment if it finds an attack?

Mithryl Systems won't. Operational authority stays with the customer; analysts investigate, explain the operational implications and recommend actions, and your engineering and operations teams decide.

Review Your Detection Coverage Across IT, the DMZ and OT

Each of these seven paths crosses a boundary your SOC probably treats as someone else's problem. Mithryl Systems OT MDR monitors 24x7, correlates activity across enterprise IT, the DMZ and OT, and investigates before it escalates, so your team gets evidence and recommendations instead of raw alerts.

Talk to Mithryl Systems about reviewing your detection coverage against these seven paths, starting with the connections between your plant and your domain.