Passive network monitoring that baselines normal OT traffic and process behaviour, then uses machine learning to flag deviations that signature-based tools would miss.
Converged IT/OT security operations centres
Industrial IT / OT / Critical Control Information Infrastructure
Industry Acceptance
Near-term · 2–5 yrs
Evidence E4 · Multi-site references
Security operations that monitor and respond to threats across both business IT and the industrial control environment, with OT-specific visibility, playbooks and authority. Widely recommended and increasingly expected by regulators, but unevenly implemented.
Why OT needs its own seat in the SOC
Most attacks that reach control systems start in IT: phishing, stolen remote-access credentials or an exposed internet-facing service, followed by movement into the plant network. A security operations centre (SOC) that watches only IT will often see the first stage and miss the second. One that watches only OT will miss the early warning. A converged SOC aims to see the whole path.
The threat picture supports the investment. Dragos's 2026 Year in Review tracked 119 ransomware groups affecting industrial organisations in 2025, up from 80 the year before. It reported that ransomware dwell time in OT environments averaged 42 days, while organisations with comprehensive OT visibility contained incidents in about five days on average. It also documented state-linked groups systematically mapping industrial control loops 1.
The SANS 2025 State of ICS/OT Security survey of more than 330 practitioners found that just over one in five organisations reported a cyber incident in the previous year, that 40 percent of those incidents disrupted operations, and that only 12.6 percent of respondents had visibility across the full ICS Cyber Kill Chain, with the largest gaps close to controllers and process equipment 2.
What makes OT security operations different
- Telemetry. OT monitoring relies mostly on passive network sensors that decode industrial protocols, because many controllers cannot run endpoint agents or produce useful logs.
- Context. An alert means little without knowing what the asset does. A write to a PLC from an engineering workstation may be routine maintenance or an attack, depending on who made it, when, and under which work permit.
- Response. Isolating a compromised laptop is easy; isolating a controller may stop production or affect safety. OT playbooks must be agreed with operations in advance and name who may authorise each action.
- Priorities. Availability and safety come first. In OT, the SOC's job is often to help operations keep running safely in a degraded state, not to shut systems down.
Organising it
There are three common models: a single corporate SOC with OT specialists embedded, a separate OT SOC that shares intelligence with the IT SOC, and a managed service from an OT security provider. Each can work. What fails is a SOC that receives OT alerts but has neither the knowledge to interpret them nor the authority to act, combined with a plant team that is not told.
NIST SP 800-82 Revision 3, the US guide to OT security published in September 2023 3, and the IEC 62443 series provide the framework: an asset inventory, zones and conduits, monitoring at defined boundaries, and incident response that includes the plant. Regulation is making these expectations more explicit, for example through the EU NIS2 directive for essential and important entities.
| Model | Strength | Typical weakness |
|---|---|---|
| Corporate SOC with embedded OT analysts | One view of the whole attack path | OT analysts outnumbered; plant context thin |
| Separate OT SOC | Deep plant knowledge | Handoffs with IT SOC during an incident |
| Managed OT security service | Specialist skills without hiring | Limited authority to act on site |
Get the basics in order first
The most common gap is not tooling but inventory. A SOC cannot monitor assets it does not know about, and many plants still lack a current list of controllers, workstations, firmware versions and network paths. Passive OT monitoring tools help build that inventory, which is one reason organisations often deploy OT network monitoring before they reorganise the SOC. The Dragos finding that well-instrumented organisations contain OT ransomware far faster 1 is, in effect, an argument for visibility before sophistication.
Evidence timeline
- Sep 2023NIST publishes SP 800-82 Revision 3, Guide to Operational Technology Security. 3
- Nov 2025SANS State of ICS/OT Security 2025: 12.6% report full ICS Cyber Kill Chain visibility. 2
- Feb 2026Dragos Year in Review: 119 ransomware groups affecting industrial organisations; 42-day average OT dwell time. 1
Why it sits at the Industry Acceptance stage
Guidance is clear, tooling is mature and many large operators run converged SOCs. That is the Industry Acceptance stage. The SANS visibility figures show how far most organisations still have to go, and the organisational part, shared authority between security and operations, consistently lags the technology.
Adoption signals to watch
- Regulators auditing OT monitoring and incident response specifically, not only IT controls.
- Mid-sized operators, not only the largest, reporting converged or managed OT SOC coverage.
- Rising shares of organisations reporting visibility close to controllers in industry surveys.
Questions to ask before committing
- Do we have a current inventory of OT assets, firmware versions and network paths?
- Who in the SOC can interpret an OT alert, and who on site can authorise a response?
- Are OT incident playbooks agreed with operations and tested in exercises?
- Which network segments, especially near controllers, are not monitored today?
Terms used on this page
- SOC
- Security operations centre, the team and tooling that monitors for and responds to security incidents.
- SIEM
- Security information and event management, the platform that collects and correlates security events.
- NIST SP 800-82
- The US guide to operational technology security.
Sources
- Dragos 2026 Year in Review: new OT threats and ransomware
- SANS report warns of rising gap between fast detection and slow recovery in critical infrastructure
- NIST publishes SP 800-82 Revision 3
Related technologies
See this entry on the full maturity map · All IT/OT & CCII entries · How placements are made. Stage and time-horizon placements are editorial judgements based on the public sources listed above, as of October 2026. They are not engineering, safety or investment advice; see the Terms of Use.