Operational Technology Security: Why Connected Equipment Needs Protection
Operational technology security has become an important concern as businesses connect industrial equipment, refrigeration systems, building controls, and manufacturing machinery to digital networks. A cyberattack against these systems can do more than expose information. It can interfere with the physical processes that keep businesses and essential services operating.
A recent example came from France, where a November 2, 2026 cybersecurity incident involving a refrigeration equipment provider affected cold-storage monitoring and control systems at three French Blood Establishment facilities. Temperature and defrost settings were changed to unusually high levels, but monitoring alarms helped staff respond before any blood products or samples were compromised. The affected products were transferred or secured as a precaution.
The incident demonstrated how a problem involving a connected service provider can reach equipment responsible for a physical process. It also highlighted why organizations need to consider the security of their suppliers, remote maintenance systems, and operational devices.
To understand this risk, it helps to look beyond conventional computer security and examine the technology that controls the physical environment.
What Is Operational Technology (OT)?
Operational Technology, commonly called OT, refers to hardware and software that monitor or control physical equipment, processes, and environments. Unlike ordinary office applications, these systems can directly influence how machinery operates or how a facility functions.
OT is used in many industries. Manufacturing facilities use it to control production lines, energy companies use it to manage electrical infrastructure, and water treatment plants use it to monitor pumps and treatment processes. Commercial buildings also depend on operational technology for heating, ventilation, air conditioning, access control, and other automated functions.
Industrial control systems (ICS) are an important part of this environment. They include technologies such as programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, and distributed control systems (DCS).
A PLC can control a machine or production process according to programmed instructions. A SCADA system can collect information from equipment distributed across different locations and provide operators with a central monitoring interface. A DCS coordinates multiple control functions within an industrial facility.
These technologies are designed for reliability, availability, and safe operation. Their security requirements can therefore differ from those of ordinary business computers.
How Can Hackers Reach Industrial Control Systems?
Industrial equipment does not necessarily need to be physically accessible for someone to interfere with its operation. When controllers connect to remote management platforms, business networks, or external service providers, those connections can create potential entry points.
Consider a refrigeration system maintained by an external engineering company. Technicians may use remote software to check temperatures, diagnose equipment problems, and adjust operating settings. This arrangement reduces maintenance time, but it also creates a digital connection that must be protected.
If an attacker gains unauthorized access to the management platform, a compromised service provider account, or an exposed controller, they may be able to interfere with equipment settings. The precise capabilities depend on the device, its configuration, and the access obtained.
Security researchers have also documented vulnerabilities in industrial controller management interfaces. In August 2026, Claroty's Team82 published research into vulnerabilities affecting the Danfoss AK-SM 800A refrigeration controller. The research described authentication and command-injection weaknesses that could affect exposed management interfaces. Danfoss released updated firmware addressing the reported issues.
This research illustrates why an internet-accessible management interface can become a significant security concern, particularly when the equipment controls an important physical process.
Why Operational Technology Can Be Difficult to Secure
Long equipment lifecycles
Industrial equipment is often designed to operate for many years. Replacing a controller or production system can require physical installation, engineering work, safety checks, and operational downtime. As a result, organizations may continue using equipment that does not receive regular security improvements.
Some older devices also have limited processing capacity or compatibility with modern security software. Applying an ordinary software update process may not be practical without testing its effect on the physical process.
Remote maintenance and third-party access
Manufacturers and maintenance providers frequently need remote access to diagnose problems and support equipment. This creates a relationship between the organization's network and an external service provider.
If supplier accounts are poorly protected, shared between employees, or left active after maintenance work, they may provide an opportunity for unauthorized access. A company's security arrangements must therefore include the systems and accounts used by contractors.
Limited separation between IT and OT networks
Information Technology (IT) generally supports activities such as email, databases, office applications, and business operations. OT focuses on monitoring and controlling physical processes.
When these environments share network connections without appropriate restrictions, an incident affecting one environment may create risks for the other. Network segmentation helps reduce unnecessary communication between systems and limits how far an intrusion can spread.
Security updates require careful planning
An update that works correctly on an ordinary computer may behave differently on an industrial controller. Equipment operators must consider compatibility, production schedules, safety requirements, and vendor support before applying changes.
This does not mean security updates should be ignored. It means organizations need a planned maintenance process that includes testing, approved installation windows, and recovery procedures.
How IT and OT Security Risks Differ
IT and OT security share several principles, including access control, network protection, monitoring, and vulnerability management. However, the consequences of a security failure can be different.
In a conventional IT environment, an attack may expose customer records, interrupt an application, or prevent employees from accessing files. In an OT environment, the same type of unauthorized access could interfere with machinery, alter operating conditions, or interrupt a production process.
For this reason, OT security cannot focus only on keeping information confidential. Equipment availability, process integrity, and human safety also matter.
NIST explains these differences in its Special Publication 800-82, Guide to Operational Technology Security. Its guidance addresses the unique performance, reliability, and safety requirements of systems that interact with the physical environment.
How Organizations Can Improve Operational Technology Security
Protecting industrial equipment requires coordination between IT teams, OT engineers, equipment manufacturers, and external maintenance providers. The following safeguards provide a practical foundation.
- Identify connected equipment: Maintain an accurate inventory of controllers, sensors, management platforms, network connections, software versions, and external access points. Organizations cannot protect devices they do not know are connected.
- Remove unnecessary internet exposure: Industrial controllers and management interfaces should not be directly accessible from public networks. Where remote access is essential, use controlled gateways and protected connections.
- Strengthen authentication: Replace default passwords, use unique credentials, enable multifactor authentication where supported, and remove unused accounts. Administrative permissions should be limited to people who need them.
- Separate IT and OT networks: Use network segmentation and firewalls to restrict communication between office systems, operational equipment, and external services. Only necessary connections should be allowed.
- Manage updates and vulnerabilities: Monitor manufacturer security advisories, identify unsupported equipment, and install approved firmware and software updates through a controlled maintenance process.
- Monitor operational changes: Record login activity, configuration changes, unexpected commands, and unusual equipment behavior. Independent sensors and alarms can help identify problems even when a connected control system is compromised.
- Prepare incident response procedures: Establish clear responsibilities for isolating affected equipment, contacting vendors, restoring trusted configurations, and maintaining essential operations safely.
CISA's guidance on reducing cyber threats to operational technology recommends removing unnecessary public internet connections, changing default credentials, and securing remote access. These protections are particularly important for equipment that can directly control physical processes.
Why Supply Chain Security Matters in Industrial Environments
An organization does not always need to be attacked directly for its operational systems to become affected. Equipment suppliers, software vendors, maintenance contractors, and remote monitoring providers may all have connections to its infrastructure.
This creates a supply chain security challenge. A third-party service may have access to multiple customer environments, making the security of its accounts, software, and remote connections important to every organization using that service.
The French blood-storage incident provides a practical example. According to reporting by OCCRP, the incident involved a refrigeration equipment provider and affected monitoring and control systems at three facilities. Investigators had not established a connection between that incident and the separate supermarket refrigeration attacks.
Organizations should therefore understand which suppliers can access their equipment, what level of access they receive, how their sessions are authenticated, and how quickly that access can be disabled if suspicious activity occurs.
Vendor security requirements should also be included in maintenance agreements. These can cover account management, software updates, incident notification, remote access, and responsibility for protecting customer systems.
What Is Changing in OT Cybersecurity?
Operational technology is becoming more connected through cloud monitoring, Industrial Internet of Things (IIoT) platforms, remote diagnostics, and automated management systems. These technologies can improve efficiency and help operators identify equipment problems earlier.
However, greater connectivity also creates more relationships between physical equipment and digital services. Security teams must understand not only which devices exist, but also how they communicate and which external systems can influence their operation.
Zero Trust security principles are increasingly relevant in these environments. Instead of automatically trusting a device or user because it is connected to an internal network, access decisions are based on identity, permissions, and context.
In April 2026, CISA and government partners published guidance on adapting Zero Trust principles to OT environments. The guidance emphasizes asset visibility, supply chain security, identity management, network segmentation, and secure communication.
NIST also published the initial public draft of SP 800-82 Revision 4 on September 21, 2026. The draft expands its discussion of OT environments, including industrial IoT, cloud convergence, building automation, and critical infrastructure. It is a draft for public comment, not a finalized replacement for Revision 3.
Why OT Security Is Becoming a Business Priority
Operational technology is no longer a concern limited to industrial cybersecurity specialists. Retailers, hospitals, manufacturers, energy providers, logistics companies, and building operators all depend on connected systems that influence physical operations.
A successful attack can affect production, equipment availability, product storage, business continuity, and in some circumstances public safety. These consequences make OT security part of broader organizational risk management.
The practical lesson is that connected equipment deserves the same careful security planning as servers, employee accounts, and cloud applications. Organizations should know what is connected, control who can access it, monitor important changes, and prepare for situations in which digital systems cannot be trusted.
As more physical infrastructure becomes digitally managed, operational technology security will remain an important part of protecting modern businesses and essential services.
Official Sources and Further Reading
- NIST: Guide to Operational Technology (OT) Security, SP 800-82 Rev. 3. https://csrc.nist.gov/pubs/sp/800/82/r3/final
- NIST: SP 800-82 Rev. 4 Initial Public Draft, September 21, 2026. https://csrc.nist.gov/pubs/sp/800/82/r4/ipd
- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology. https://www.cisa.gov/sites/default/files/2025-05/fact-sheet-primary-mitigations-to-reduce-cyber-threats-to-operational-technology-508c.pdf
- CISA: Adapting Zero Trust Principles to Operational Technology. https://www.cisa.gov/resources-tools/resources/adapting-zero-trust-principles-operational-technology
- CERT-FR: Security Incident Targeting Remote Refrigeration Installation Controllers, October 12, 2026. https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012
- Danfoss: Cybersecurity Best Practices for Electronic Controllers. https://www.danfoss.com/en-in/service-and-support/fix-and-troubleshooting/cooling-support-for-wholesalers-and-installers/electronic-controllers-services-faqs/cybersecurity-best-practices/
- Claroty Team82: Research into Danfoss Refrigeration Controller Vulnerabilities, August 9, 2026. https://www.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
- OCCRP: Cyber Incident Disrupts French Blood Storage Systems, November 5, 2026. https://www.occrp.org/en/news/cyber-incident-disrupts-french-blood-storage-systems
Frequently Asked Questions
What is operational technology security?
Operational technology security protects hardware and software that monitor or control physical equipment, industrial processes, and infrastructure. It focuses on preventing unauthorized access, disruption, and unsafe changes to physical operations.
What is the difference between IT security and OT security?
IT security primarily protects information systems, applications, and data. OT security protects systems that interact with physical equipment and processes, where availability, reliability, and safety are especially important.
Can hackers control industrial equipment remotely?
Yes, if attackers gain unauthorized access to exposed controllers, management platforms, or remote maintenance connections. Their ability to change equipment behavior depends on the system's configuration and the permissions obtained.
Why is network segmentation important for OT security?
Network segmentation separates operational equipment from unrelated business systems and limits unnecessary communication. It can reduce the potential spread and impact of a cyber intrusion.
Which organizations need OT cybersecurity?
Manufacturers, hospitals, energy providers, water utilities, retailers, warehouses, transport operators, and organizations using connected building or industrial control systems can all benefit from OT security measures.
