In OT, the Response Can Become the Risk

Analyst Brief

Audience

IT SOC leaders, OT security owners, incident responders

Reading time

6 minutes

Difficulty

Intermediate

Operational impact

A containment action can interrupt engineering work, cut operator visibility or stop a process

Business impact

Precautionary shutdowns can cost more than the intrusion that triggered them

Relevant frameworks

NIST SP 800-82 Rev. 3, CI Fortify: Advice for Isolating Vital Systems (CISA and ASD), MITRE ATT&CK for ICS

Key concept

Weigh the consequence of the threat against the consequence of the response

Entry point

VPN and jump host access

Scenario

Vendor login to an OT jump host at 2:13 a.m.

Executive Summary

Enterprise security teams are trained to contain fast: disable the account, block the source, isolate the host. In operational technology, those same actions can interrupt an engineer's work, take away what operators see or stop a physical process. The jump host a SOC wants to cut off may be the only approved engineering path into a critical process area.

A suspicious vendor login deserves attention, because remote access is the leading way attackers reach OT. But precautionary shutdowns at Jaguar Land Rover in 2025 and Colonial Pipeline in 2021 show how much operational weight a containment decision can carry.

The answer is not slower response. OT incident response needs the operational context in hand before the alert fires: whether maintenance was approved, what the jump host can reach, what isolation would affect and who has the authority to decide. Most of that can be settled, documented and rehearsed in advance.

Quick Answer

How is OT incident response different from IT incident response?

OT incident response follows the same steps as IT incident response (detect, contain and recover), but containment carries physical consequences. Isolating a host or disabling an account in an industrial network can interrupt engineering work, cut operator visibility or stop a process. NIST SP 800-82 Rev. 3 states that any security measure that impairs safety is unacceptable, so OT teams weigh the consequence of each response action before taking it.

Key Takeaways

Remote access is the leading path into OT: Dragos reports that 73% of the incident response cases it has ever handled involved exploitation of VPNs or jump hosts or reuse of valid credentials for them.
Standard IT containment, such as isolating a host or disabling an account, can interrupt an industrial process when the system involved is an engineering path into the plant.
When a team can't tell what an intrusion can reach, the safest available response is often the most disruptive one, as precautionary shutdowns at Jaguar Land Rover and Colonial Pipeline showed.
Joint CISA and Australian Signals Directorate guidance from July 2026 treats isolation as a planned, tested capability with trigger criteria set in advance.
Most pre-containment questions, from approved maintenance windows to decision authority, can be answered and documented before an incident starts.

At 2:13 a.m., a vendor account authenticates to an operational technology (OT) jump host after several failed attempts. The security operations center (SOC) sees it within minutes. The analyst has the source address, the account, the authentication history and a threat intelligence match that makes the whole thing look worse.

Every instinct from enterprise security says to act now. Disable the account, block the source and isolate the host.

But the analyst doesn't know whether the vendor had approved maintenance tonight, which industrial systems sit on the other side of that jump host, or whether disabling the account would cut off an engineer in the middle of a change. In IT, gaps like these rarely hold up a containment decision. In OT, they are the decision.

That's what sets OT incident response apart. The work is the same as in any incident response: detect the attack, contain it and recover. But the systems involved run physical processes, so every response action has to be weighed against what it does to production and safety. The question shifts from "Is this malicious?" to "What does this mean to operations, and what should we do about it?"

The previous article in this series, Your OT Expert Is Not an Escalation Process, looked at who gets the call. This one looks at the decision that person is being asked to make.

Remote Access Is the Leading Way Into OT Systems

The 2:13 a.m. login is a realistic starting point, because remote access is the most common way attackers reach industrial systems. Dragos reports in its 2026 OT Cybersecurity Year in Review that 73% of all the incident response cases it has ever handled involved attackers exploiting VPNs or jump hosts or reusing valid credentials for them. The SANS 2025 State of ICS/OT Security survey points the same way: half of the cyber incidents its respondents reported began with unauthorized external access.

A jump host is the system vendors and engineers log into first, usually in a buffer zone between the corporate and control networks, before they reach the equipment they maintain. Because it's often the one approved path into a process area, it's both a checkpoint and a target.

Attackers have used that path before. In the December 2015 attack on Ukraine's power grid, documented in MITRE ATT&CK, intruders used stolen credentials to get into the grid operators' own control system VPN, then opened breakers through remote commands to the operators' human-machine interfaces (HMIs). The outages lasted up to six hours and, according to CISA, affected about 225,000 customers.

So the analyst's suspicion is reasonable. The hard part is what to do with it.

Diagram of a vendor engineer and a possible intruder sharing one jump host path into an OT control network, with branches showing that containing the login stops both the threat and legitimate engineering work

One path in. Cutting it stops both.

How Is OT Incident Response Different From IT Incident Response?

The biggest difference is what containment costs. IT incident response is built around rapid containment, and in an enterprise network that's usually the right call. A compromised laptop gets isolated, a suspicious account gets disabled and a server gets rebuilt from a clean image. The business absorbs the disruption.

Industrial systems don't absorb it the same way. That jump host may be the only approved engineering path into a critical process area. Blocking its traffic can interrupt an industrial application, and isolating a system can take away what operators see on their screens.

NIST's Guide to Operational Technology Security, SP 800-82 Rev. 3, states the principle plainly: "Any security measure that impairs safety is unacceptable." The same guide warns that "indiscriminate use of IT security practices in OT may cause availability and timing disruptions."

Industrial equipment can also be more fragile than security teams expect. In August 2006, the controllers for both reactor recirculation pumps at Browns Ferry Unit 3 stopped responding, and operators manually shut down the reactor. The Nuclear Regulatory Commission traced the failure to excessive traffic on the plant's own control network and did not attribute it to an attack.

That's why the consequence of the threat has to be weighed against the consequence of the response. Both are real, and in OT the second can be the larger of the two.

Analyst Note

Two Consequences, One Decision

Questions about the threat compared with questions about the response
Weighing the threat	Weighing the response
Is the login malicious, suspicious or expected?	Would disabling the account cut off active engineering work?
What can the account reach from the jump host?	Would isolation remove what operators see on their screens?
Could it reach systems that change the process?	Is the jump host the only approved path into the process area?
What happens if the activity continues?	What happens to production, safety and recovery if we act?

When the Shutdown Costs More Than the Intrusion

Precautionary shutdowns show how much weight a containment decision carries. After Jaguar Land Rover was hit by a cyberattack at the end of August 2025, the company said it "took immediate action to mitigate its impact by proactively shutting down our systems." Global production stopped for about five weeks, and the UK's Cyber Monitoring Centre estimated the cost to the UK economy at about £1.9 billion.

Colonial Pipeline followed similar logic in May 2021. Ransomware hit the company's IT systems, and Colonial shut down all 5,500 miles of pipeline to keep the malware from spreading. All lines were back in service five days later.

Neither decision is the point here, and both companies presented theirs as the protective choice. What matters is what drove the choice. When you can't tell what an intrusion can reach, the safest response available is often the most disruptive one.

Planning changes that. CI Fortify: Advice for Isolating Vital Systems, joint guidance released in July 2026 by CISA, the Australian Signals Directorate and partners, treats isolation as something to design and rehearse in advance. It warns that isolating systems "will trigger manual processes and interrupt system-to-system communication," and it calls for trigger criteria for each isolation step to be set ahead of time and for isolation plans to be tested regularly.

What Should You Ask Before Containing an OT Incident?

Before acting on a suspicious login to an OT jump host, the SOC needs answers to eight questions:

Was the access expected, and was there an approved maintenance window?
Which industrial assets, applications and processes can be reached through the jump host?
Could the account reach systems capable of changing the process?
Was engineering or maintenance work underway?
Could disabling the account interrupt legitimate operational activity?
Could isolation affect production, operator visibility, safety or recovery?
Does the event create regulatory, evidence or reporting obligations?
Who has the authority to make the operational decision?

Most of these are operational questions triggered by a cybersecurity event, and most of them can be answered before anything happens.

Take the first one. NIST SP 800-82 Rev. 3 says maintenance on OT assets, including remote maintenance, should be scheduled, authorized, tracked and logged, with the remote connection torn down once the work is done. When that discipline holds, whether a vendor should be connected at 2:13 a.m. is a lookup rather than a phone call. Mapping what each jump host can reach, agreeing on when isolation is warranted and naming who approves disconnecting a vendor do the same for the rest of the list.

Take the eight questions into your next tabletop exercise. CISA's Tabletop Exercise Packages include industrial control system compromise scenarios that make a practical starting point.

OT Incident Response Doesn't Have to Be Slow

OT incident response doesn't have to be slower than IT response. It has to be informed by the operating environment, and that information has to be ready before the alert fires.

Cybersecurity identifies the threat. Operational Intelligence helps determine the decision.

A short test shows where you stand. When a cybersecurity event reaches operations, can your team answer three questions: What happened? What does it mean for production, safety and compliance? What should we do about it? Then ask whether your SOC can answer all three without first tracking down an engineer.

Diagram of three connected steps from the SOC to operations: what happened, what it means for production, safety and compliance, and what to do about it

Three questions every OT event has to answer before it reaches a decision.

If it can't, the gap won't show up on a dashboard. It shows up at 2:13 a.m., when someone has to choose between leaving a possible intruder connected and cutting off the only engineering path into a running process.

Mithryl Systems OT MDR (managed detection and response) was built for that moment. It extends the SOC you already have with OT expert investigation and operational context, so the people making the call can see the consequence of the threat and the consequence of the response side by side. Operations keeps the decision authority.

If you'd like to walk through how your team would handle a login like that one, schedule an executive briefing with Mithryl Systems.

CyberFusion Center Perspective

The Containment Decision Is an Operational Decision

A traditional SOC asks whether the 2:13 a.m. login is malicious and how fast it can be stopped. A CyberFusion Center asks a second question in the same breath: what will stopping it do to the plant? Security telemetry can answer the first. Only operational context can answer the second.

That context has to exist before the alert does. Which systems each jump host reaches, when maintenance is approved, which processes can run in isolation and who signs off on disconnecting a vendor are all facts a fusion model collects in advance, so the person making the call at 2 a.m. is choosing between known consequences rather than guessing.

How Mithryl Systems Approaches It

Mithryl Systems OT MDR (managed detection and response) extends the SOC an organization already runs with OT-native expertise and Operational Intelligence. When an event reaches an industrial environment, the investigation establishes what happened, which assets and processes are involved, what could happen if the activity continues and what could happen if the organization takes containment action. Augmented Intelligence speeds up correlation, enrichment and timeline construction, and OT analysts interpret what the evidence means for production, safety and compliance. The result is a recommendation that weighs cyber risk against operational risk. Decisions such as isolating a system or disabling an operational account stay with operations, which retains decision authority throughout.

Frequently Asked Questions

Should you isolate an OT system during a cyberattack?

Isolation can be the right call, but only as a planned step. Cutting a system off can trigger manual processes, interrupt system-to-system communication and reduce what operators can see. Joint guidance from CISA and the Australian Signals Directorate calls for isolation plans with trigger criteria set in advance and regular testing.

Can incident response cause more damage than the cyberattack?

Yes. In OT, a containment step can halt a physical process or force a precautionary shutdown far larger than the intrusion itself. Jaguar Land Rover's proactive shutdown in 2025 preceded about five weeks of halted production, which is why response actions have to be weighed alongside the threat.

How do attackers usually get into OT systems?

Remote access is the most common path. Dragos reports that 73% of the incident response cases it has ever handled involved attackers exploiting VPNs or jump hosts or reusing valid credentials for them, and the SANS 2025 State of ICS/OT Security survey found half of reported incidents began with unauthorized external access.

What is an OT jump host?

An OT jump host is the system vendors and engineers log into first, usually in a buffer zone between the corporate and control networks, before reaching the equipment they maintain. Because a jump host is often the one approved path into a process area, disabling or isolating one can cut off legitimate engineering work.

What should you ask before containing an OT incident?

A SOC should confirm whether the access was expected and approved, what the account can reach, whether engineering work is underway and what disabling or isolating would affect. The team also needs to know the regulatory and reporting implications and who has authority to make the operational decision.

Who should decide whether to shut down an industrial system during a cyber incident?

Operations should hold that decision, informed by security and engineering, and the authority should be named before an incident starts. A SOC analyst working alone at 2 a.m. shouldn't have to guess who can approve disconnecting a vendor or isolating a production system.

Sources and Further Reading

Could Your SOC Make the 2:13 a.m. Call?

Walk through how your team would handle a suspicious vendor login with Mithryl Systems OT MDR experts, from first alert to operational decision.