Manufacturing accounted for 27.7% of all cyberattacks tracked worldwide in 2025, making it the most targeted industry for the fifth consecutive year, according to IBM’s X-Force threat intelligence team.
The concern for manufacturers is not just what happens to the IT network. An incident that starts in IT can become an operational technology (OT) problem when there is a path into the plant. Once an attacker reaches an engineering workstation, server, or other connected system, the question becomes how far that access can extend.
OT network segmentation puts boundaries around that movement.
In May 2021, ransomware hit Colonial Pipeline’s business systems, including accounting and billing. The company ultimately took pipeline operations offline because it could not confirm that the attack only impacted the business side.
That is an important distinction for industrial operators. Separating IT and OT is not simply about keeping two networks on different switches. It is about creating boundaries that can be understood, monitored, and enforced so that a problem in one part of the environment does not automatically become a production problem.
What OT Network Segmentation Actually Does on a Plant Floor
You already run a version of this. The welding cell talks to its own programmable logic controller (PLC). The historian sits somewhere in the middle, and one engineer has a laptop that reaches everything, because that’s how commissioning went in 2015.
Over time, those connections can become difficult to track.
OT network segmentation formalizes those boundaries. Instead of allowing devices to communicate simply because they share the same network, OT network segmentation organizes the plant into zones based on process function and communication requirements. Devices within a zone can communicate as needed, while communication between zones is limited to defined paths.
That distinction matters in OT because the devices being segmented are not all general-purpose computers. A PLC may have been in service for years. A machine controller may not support modern security software. A vendor may require remote access to a specific system. Production may depend on a connection that was established long before anyone started talking about segmentation.
The segmentation strategy has to account for those realities.
The NIST Guide to Operational Technology Security recommends separating business systems from control systems and using a demilitarized zone (DMZ) where appropriate, to manage communication between them.
The goal is not to isolate every device from every other device. It is to ensure that each connection is necessary and follows a defined path through the network.
Why Flat Plant Networks Keep Losing
A flat network, using traditional networking technology, creates a problem when an incident occurs. If an engineering workstation is compromised, for example, its ability to reach PLCs, HMIs, servers, or other production equipment depends largely on how the network was built. When those systems share broad network access, an attacker has fewer boundaries to overcome.
This is what makes lateral movement such a concern in OT. The initial compromise may happen somewhere else, but the impact can move toward the systems responsible for production.
The Cybersecurity and Infrastructure Security Agency identifies insufficient network segmentation as a condition that can allow threats to reach industrial control system environments.
Plant networks rarely become flat because someone deliberately designed them that way. They usually evolve.
- Integrators build the fastest working path during commissioning, because the line has to run on Monday.
- A vendor asks for remote support access and gets a route instead of a defined rule.
- The historian needs to communicate with both sides of the network, so it becomes a bridge that nobody regularly reviews.
- Every added cell inherits the addressing scheme of the cell beside it because that’s the fastest way to bring it online.
Over time, those decisions add up. What started as a practical way to get a line running becomes a network where too many devices can reach too many other devices.
Where VLANs Run Out of Room
DYNICS takes a cautious view of virtual local area networks (VLANs) in OT environments. VLANs can provide logical separation, but they are not complete security boundaries. They depend on correct configuration and consistent management, which can be difficult to maintain across plants with legacy equipment, changing production requirements, and multiple network administrators.
For that reason, VLANs should not be treated as the primary answer to OT segmentation. They may still have a role in organizing traffic or supporting a broader network design, but they do not provide the granular, device-level control needed to manage communication between industrial systems.
Firewalls remain important at network boundaries, especially between the business network and OT environment. DYNICS ICS360.Defender is built for this role, providing firewalling, deep packet inspection, VPN capabilities, and other security controls at the network edge.
Segmentation does not stop at that boundary, though.
A large plant may have dozens of production cells and hundreds of industrial devices. Those systems need to communicate, but a PLC in one cell may have no reason to communicate with a PLC in another. Creating separate VLANs does not, by itself, provide the visibility or control needed to manage those relationships.
The answer is to deny by default, and only allow those connections/communications when they are explicitly required. Give connections a defined path and enforce what is allowed to cross the boundary. This is where software-defined networking (SDN) adds another layer of control.
An OT SDN Controller can establish communication policies between devices and zones through industrial network switches. Rather than relying primarily on VLAN assignments or endpoint configuration changes, the network can enforce which devices are permitted to communicate.
Firewalls and SDN serve different purposes and work well together. Firewalls control traffic between IT and OT, while SDN provides granular, device-level segmentation deeper inside the OT environment.
That is especially useful for equipment that is difficult or risky to modify. A legacy PLC does not necessarily need new software or a network configuration change to benefit from tighter communication policies. The network can enforce the boundary around it.
DYNICS engineers have written about why VLAN-based segmentation struggles on the plant floor, and the same challenges show up across the plants they work with.
Segmenting a Plant That Can’t Stop Running
Most OT segmentation projects face the same practical question. How do you change the network when that network is producing products 24/7 x 365 days a year.
The answer is to separate the planning and validation work from the changes that affect products.
Start by learning the network before changing it. Understanding traffic, what devices are communicating, which protocols they use, and which connections production actually depends on. From there, zones and policies can be designed around the way the plant operates rather than the way an old network diagram says it operates.
Before enforcement, validate those policies in a monitoring or alert-only mode. This shows which connections would be affected without blocking production traffic. Any unexpected communication can be reviewed and addressed before changes are made.
Once the policies are understood and validated, introduce them gradually during planned maintenance. Start with a manageable production area, confirm that it operates as expected, and continue through the plant as each zone is ready.
This approach also creates an opportunity to introduce SDN without redesigning the entire network at once. Existing firewall boundaries can remain in place while more granular segmentation is added inside the OT environment.
The objective is simple. Improve the boundaries around production without creating a new production problem in the process.
See how the OT SDN Controller provides granular segmentation for industrial networks.
The Devices You Can’t Segment
Every plant has them. A press control runs an operating system that went unsupported before some of your engineers were hired. Beside it sits a machine whose warranty voids if anyone changes its network settings. Somewhere else, a device crashes when it sees traffic it doesn’t recognize.
Vendor guidance tends to skip these systems, and that’s a real problem because they are often running some of the most important processes in the building. You cannot patch them. Replacing them can turn into a capital project that was never on the schedule.
What you can do is put the boundary around them instead of on them.
| Constraint | Control that works around it |
|---|---|
| Unsupported operating system, no patches available | Put the device in its own zone with an allow-list of the few conversations it legitimately needs |
| Vendor warranty forbids configuration changes | Enforce upstream at the switch or security appliance. The device is untouched. |
| Device crashes on unexpected traffic | Passive monitoring only. Build its profile from captured traffic rather than probing it. |
| Vendor needs remote access for support | Time-bound access into one zone, brokered through the DMZ, logged and reviewed |
| Historian must reach both business and control networks | Replicate to a DMZ-resident copy. Business users query the copy, never the original. |
An older device sitting inside a tightly defined zone is a smaller problem than that same device sitting on a flat network with unrestricted access. The control does not always have to be applied directly to the device.
That is where software-defined networking (SDN) can be useful in OT network architecture. Our OT SDN Controller sets permitted communication paths at the switch instead of requiring changes to the end device. Traffic outside an approved path does not forward, allowing legacy PLCs and other difficult-to-change equipment to be protected without modifying their configurations.
This also levels the playing field when faced with using proprietary security measures such as CIP Security, Profinet Security, Modbus TCP Security, BACnet Secure Connect, DNP3 Secure, and the list goes on. The OT SDN Controller and network are a single means to secure devices.
A Working Sequence for OT Network Segmentation
Inside a plant that keeps producing, the order of operations matters.
- Inventory passively before you design anything. You can’t zone devices you don’t know about, and the actual device count is often different from the drawings. Fortunately, if devices are missed, the OT SDN Controller will indicate what port they are connected to on what switch.
- Baseline real traffic for a full production cycle. Capture what talks to what, which protocols are being used, and when those connections occur. Modbus, DNP3, and EtherNet/IP may behave differently during normal operation than the documentation suggests.
- Draw zones around process function and downtime cost. Group equipment based on what needs to be communicated and what stops together. Safety systems should have the most restrictive boundaries.
- Enforce cell by cell during maintenance windows. Start with a manageable area, validate the change, and keep a documented rollback available before moving to the next zone.
- Re-baseline regularly. Plants change. New machines get added, applications move, and vendors need new connections. Segmentation has to change with the network.
The ISA/IEC 62443 standard defines how industrial systems can be grouped into zones and how communication between those zones is controlled. If your plant is working toward that standard, DYNICS engineers can explain how microsegmentation maps to zones and conduits in more detail.
Utilities run the same basic process with documentation requirements. North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) rules require evidence of security controls and boundaries, which shapes how these projects are planned for energy and utility operators.
Common Questions About OT Network Segmentation
What is OT network segmentation?
OT network segmentation divides a plant network into zones based on what the equipment does and how it operates. Traffic between those zones is limited to the connections that are actually needed and can be monitored or controlled at the boundary.
The goal is to keep an incident from spreading across the plant. If one area of the network is compromised, the other zones have a defined boundary between them instead of an open path.
How do you separate OT and IT networks?
A common approach is to use a demilitarized zone between the business and control networks. This removes the direct path between IT and OT and gives legitimate traffic a defined place to cross the boundary.
For example, historian data can be sent to a system in the DMZ, where it can then be accessed by business applications without giving those systems direct access to the control network. NIST’s operational technology guidance recommends this type of separation rather than allowing direct communication between business and control systems.
Does network segmentation disrupt production?
It doesn’t have to. Much of the planning and validation can happen while the plant is running. Physical changes and enforcement can then be scheduled during maintenance windows and rolled out one cell at a time.
The key is to understand the network before enforcing the policy. If you don’t allow the necessary traffic because you don’t know what the plant depends on, that’s when segmentation can create unexpected production problems.
What is the Purdue Model?
A reference architecture that sorts industrial systems into levels. Sensors and actuators sit at Level 0, control and supervisory systems in the middle, and business systems at Levels 4 and 5, with the DMZ between the operations levels and the business levels. Most plants treat it as shared vocabulary for where a boundary belongs, not as a literal blueprint. Note, a pure Purdue Model implementation isn’t sufficient for OT networks, rather use Purdue to describe operational functions and major boundaries; use ISA/IEC 62443 zones and conduits to design the actual security architecture.
Which technology is commonly used to implement segmentation in OT networks?
Traditional, complex, and difficult to manage in OT, VLANs on managed switches remain the most common starting point, backed by firewalls and access control lists at the boundaries. Software-defined networking (SDN) has grown as an option because it sets permitted paths centrally, and per-switch configuration is the thing that drifts. OT SDN is easy to manage for those without IT backgrounds in networking and cybersecurity.
What is the purpose of network segmentation in ICS security?
Limiting how far an intruder can travel. Segmentation rarely stops the first break-in, because that usually lands on the business side. It changes the outcome instead, turning a plant-wide encryption event into one walled-off zone that lets the rest of the floor keep producing.
Working through an OT segmentation plan?
Dynics designs, fabricates, and assembles industrial computing hardware and OT cybersecurity systems at a 37,500 square foot facility in Ann Arbor, Michigan. Its engineers have been sequencing this work inside running plants for more than 30 years.
