A majority of enterprises say CISOs now responsible for OT security

The C-suite at enterprises is taking operational technology (OT) security more seriously than in years past, reported Fortinet.

The OT study released July 9 found that 52% of organizations said the CISO or CSO is now directly responsible for OT security, a dramatic rise from just 16% in 2022.

Also notable was that 80% of respondents planned to consolidate OT security under the CISO in the next 12 months.

“This consolidation is more than a reporting change,” said the Fortinet researchers. “It reflects a broader understanding that industrial cybersecurity must be part of an integrated, enterprisewide strategy. With threats targeting both IT and OT systems simultaneously, separating their security models no longer works.”

Kevin Surace, chair at Token, added that the report confirmed what many security professionals have observed firsthand: The traditional separation between IT and OT has disappeared. Surace said OT systems are now deeply connected to enterprise IT networks, which means attackers only need to compromise a single identity or access point to potentially impact critical infrastructure.

“The shift of OT cybersecurity responsibility to the C-suite is also a positive development,” said Surace. “It shows that leadership is recognizing OT as a strategic business risk, not just a technical issue. However, the report also highlights that complexity is increasing faster than most organizations can adapt, especially with phishing and credential-based attacks still so prevalent.”

James Maude, Field CTO at BeyondTrust, added that securing remote access remains one of the top priorities for many organizations especially in high risk, OT and ICS environments, such as manufacturing, energy and transportation. Maude said organizations need to think about how to securely manage privileged access into their critical environments.

“Teams must ensure that employees, vendors, and third parties have just the access and permissions needed to do their job without additional risk exposure,” said Maude. “The C-Suite, CISOs, and CSOs need to look beyond siloed views of obviously privileged identities in individual systems and take a holistic view of the combinations of privileges, entitlements and roles that could be exploited by an attacker to elevation privilege, move laterally and inflict damage.”

Jeff Macre, industrial security solutions architect at Darktrace, said maintaining accurate, real-time visibility is one of the core challenges organizations face when trying to secure legacy OT systems. Macre said many existing tactics, such as traditional rule-based methods, create a host of false positives and fail to detect subtle changes in OT environments such as unusual device behavior or network traffic, which can help identify early indications of an attack.

Macre said the good news is that AI can help:

“OT device communications are often highly predictable and routine, with devices following consistent schedules and fixed command sets,” said Macre. “Unlike in IT environments, where behavior can vary widely, OT systems tend to repeat the same operations in the same order, day after day. This makes it easy for AI to understand their normal behavior and be able to detect deviations that may indicate cyber threats or operational anomalies.”