Podcast: Why IT and OT remain out of sync in modern manufacturing

In this episode of Great Question: A Manufacturing Podcast, Scott Achelpohl of Smart Industry and Almog Apirion, CEO and co-founder at Cyolo, explore why IT and OT often remain misaligned and what it takes to close the gap. The discussion highlights how digital transformation, cybersecurity risks, and regulatory pressures are driving the need for convergence. Together, they examine the role of Zero Trust, identity-based access, and secure connectivity in protecting legacy equipment while keeping operations productive and resilient.

Below is an excerpt from the podcast:

SA: Why do you think there's so much pressure now on manufacturers to tear down the silos that exist between OT and IT? What are the incentives to do so?

AA: Yeah, it's a great question. So first of all, OT is more connected than ever. The old approach basically said, “If it's not reachable, it's not breachable.” But that approach is dead. IT is expected to be a business enabler, not a blocker. So their practices are now tightly interdependent. When they work together, uptime, safety, and compliance improve—and the business wins. And that’s not even talking about all the future benefits coming from AI.

SA: Even when both IT and OT agree that cooperation is critical, why is it still so hard to make it happen?

AA: So, I think it’s mainly misaligned incentives and fear of losing control. If you give OT predictable uptime and IT enforceable policy and visibility at the identity and session level, suddenly IT empowers the line of business instead of slowing it—just as an example.

SA: When that alignment does click, what organizational benefits do you see first and foremost, clearly?

AA: It’s better business results at the end of the day—less downtime, lower cyber insurance rates, regulatory alignment, and better productivity. And I think that both security and OT are looking at uptime altogether. The guys from security are looking at the things that can compromise uptime for, you know, security reasons, but they’re serving basically the same need.

SA: Okay, Almog, so digital transformation and network operations connected to IoT—IIoT, excuse me—or even legacy plant equipment that must be connected is placing pressure on IT/OT convergence. What other forces are at work here?

AA: Yeah, you’re absolutely right, Scott. The demand for IoT integration and digital transformation is accelerating IT and OT convergence. But there are several other forces converging at the same time that add to the pressure, I may say.

First, there’s the growing demand for operational agility—whether it’s remote troubleshooting, predictive maintenance, real-time analytics, or even modern industrial operation. Operations require fast and flexible access to systems that were historically siloed. That means, basically, more external vendors, more remote access, and more interconnectivity—often with legacy systems that were never designed with security in mind.

Second, the regulatory pressure. Frameworks like NIS2 in Europe, TSA directives in the U.S., and sector-specific standards like IEC 62443 are pushing organizations to enforce stronger segmentation and access controls, all of which demand tighter coordination between IT and OT teams.

And third, there is a growing cyber risk landscape that we need to address. Threat actors are not waiting for organizations to finish convergence. They’re actively exploiting this transitional phase, I may say. So we’re seeing a clear need for solutions that can bridge this environment securely without requiring a full rip-and-replace approach.

SA: Almog, you mentioned cybersecurity. Obviously, IT/OT convergence and networking legacy equipment—when it was not originally built for that—poses severe cybersecurity concerns. Can you describe a few of those concerns?

AA: Certainly, Scott. So one of the biggest challenges is that legacy OT systems lack native identity awareness. They were never designed to verify who is accessing them—only how they’re accessed. So when you network them or expose them to modern interfaces, they can’t differentiate between a trusted technician and a malicious actor.

Another major concern is insecure remote access pathways. Many organizations still rely on VPNs, jump boxes, and hard-coded credentials to enable remote access. And these methods lack fine-grained control or visibility. They open the door wide, rather than allowing precise, just-in-time access to a specific system for a specific task.

Finally, there’s the lack of segmentation—and let’s call it traceability—in many OT environments. Once a user gains access, there are often few controls, maybe too few controls, to prevent lateral movement or detect suspicious behavior. That’s the major issue when you’re dealing with critical infrastructure, where uptime and safety are non-negotiable, and you also need to deal with legacy.