In a global networked environment where devices outnumber people two to one, new vulnerabilities are emerging. Everyday physical systems—HVAC, traffic lights, medical devices, emergency management systems—are now integrated with IT networks, expanding the attack surface.

Recent cyberattacks against OT share key traits: they exploit the convergence of IT and OT, use legitimate credentials and native tools that defeat conventional detection, gain initial access through internet-facing devices with known vulnerabilities or default credentials, and establish dwell times from months to years.

The near-term threat—now accessible to a broad range of adversaries—is disruption: loss of visibility, operational shutdown, and extended recovery. The Colonial Pipeline attack illustrates how: ransomware hit billing systems, not OT, yet operators shut the pipeline down voluntarily because they could no longer safely monitor product flow. The longer-term, higher-consequence threat is physical destruction, currently concentrated in nation-states but expanding as AI lowers barriers.

As the federal government focuses on translating zero trust principles into OT-native implementations that preserve operational uptime, agencies will need different tools, timelines, and risk calculations compared with zero trust for IT, particularly when the goal is detecting and neutralizing access that may already exist. 

According to our exclusive survey of over 100 federal IT and cyber leaders, they're currently facing multiple barriers to zero trust OT implementation. These barriers reflect real structural challenges: OT devices in federal and commercial environments often carry lifecycles of 15 to 30+ years, engineered for reliability—not security. Many can't run authentication software, accept patches without operational risk, or participate in identity-based access control. And 98% of organizations experiencing cyberattacks report that IT incidents also affected OT environments, reflecting collapsed domain boundaries.