Making the Case for Virtual Segmentation in OT Environments

•
October 14, 2025    

At the recent CS4CA Europe conference in London, one delegate remarked that moving from IT to OT security meant no longer keeping up with “mind-boggling pace of change.” Not exactly – the pace in OT is now accelerating as it races to catch up.

See Also: Agentic Commerce: The Technology Shaping the Future of Payments

The speaker certainly wasn’t referring to the escalating volume of attacks nor the OT attack surface as it expands to the cloud and incorporates artificial intelligence. Instead, he was referring to the apparent impracticality of expecting to keep defenses current across vast, heterogeneous environments, long-lived equipment, unknown dependencies and systems that can’t be patched quickly – if at all. This trade-off was a recurring theme at CS4CA Europe, along with the challenge of operationalizing zero trust in OT – moving beyond segmented boxes on a diagram to enforcing them in real-world operations.

In OT, safety and resilience trump data integrity, making acceptable “cyber risk” different for IT, which is why “keeping production running” outranks “patching every CVE.” This is reflected in regulatory and practitioner approaches. CISA’s July microsegmentation guidance reframed segmentation from static VLANs to workflow-aware policy enforcement across hosts, apps and databases – applying zero trust authentication controls where the process actually runs.

Speakers at CS4CA Europe, including Andrew McPhee, solutions manager for industrial security at Cisco, described the need for virtual segmentation based on workflow processes rather than physical locations. He explained how this can help deploy software-based segmentation. But given the complexity of connections and dependencies across networks, equipment and devices, he also advocates for using AI to help automate asset grouping to inform segmentation policies.

With practitioners focused on resilience and shoring up critical infrastructure systems, the urgency of addressing OT exposure is growing rapidly. A BitSight report predicts that 200,000 vulnerable ICS/OT devices will be exposed to potential compromise in less than a year, adding CISA has already published 1,850 CVE advisories on ICS devices, of which nearly 30% have no patch or update available.

That’s a brutal combination if your asset segmentation only exists on paper.

OT malware is no longer theoretical. FrostyGoop abused Modbus TCP to disrupt district heating in Lviv, Ukraine, for nearly two days. Fuxnet – attributed to the Blackjack hacking group – jammed M-Bus sensor gateways and bricked NAND devices tied to Moscow’s municipal systems. Both malware strains are ICS-specific and purpose-built to break safety processes, reduce visibility and cause disruption.

A recurring practitioner playbook at CS4CA Europe was to attain ground truth visibility and not just asset lists created years ago; derive logical groupings based on the function/workflow; enforce policies virtually, not just physically; and cut non-essential connections to contain the blast radius of hacks.

But don’t stop at Layer-3 zones. Implement host and application-level controls as policy enforcement points that understand the workflow to ensure containment will happen where the risk actually occurs.

AI/machine learning can be used for mapping and clustering flows based on the function to ensure segments reflect the real process – not the floorplan. Several 2025 analyses highlight AI/ML-powered policy recommendations and automated policy generation as standard features in microsegmentation stacks.

AI-assisted rule suggestions can translate “observed, allowed workflow” into enforceable, least-privilege policies without weeks of workshops. Zscaler, for example, documents real-time, telemetry-driven, AI-suggested rules for microsegmentation.

AI will not solve the problem of OT segmentation. But AI can reduce workloads and error rates through traffic baselining, policy drafting and anomaly triage, followed by human-in-the-loop review before enforcement, particularly for Level 0/1 devices, where safety margins are tight.

Other approaches include identity/workflow-based segmentation over existing OT networks, which involves using AI-assisted inventories and traffic maps to define logical zones by process, followed by centrally enforced policies – host-based or gateway-mediated – to block lateral movement. The 2025 Gartner Hype Cycle Takeaways put microsegmentation on the “Slope of Enlightenment,” and CISA’s guidance calls it foundational to modern zero trust architecture.

The use of threat-driven containment built on OT visibility requires multiple platforms that integrate deep OT protocol awareness with segmentation control. This allows, for example, anomalous Modbus function codes from a host to trigger just-in-time isolation of the affected device/segment – similar to the control FrostyGoop managed to evade in Ukraine.

The sheer complexity of establishing visibility and then untangling actual connections and dependencies from required connections can initially appear overwhelming, but not everything needs to be solved at once.

Organizations can start by establishing their boundary, followed by segregating IT and OT. Where data hand-offs exist, ensure one-way or tightly bounded interfaces and pre-agreed set-point limits to prevent IT data from directly changing OT parameters outside of risk tolerances. CISA and the U.K. NCSC issued joint OT-securing guidance to reinforce this approach.

To achieve visibility, build a live inventory and flow map; group assets by process/workflow, not geography; and identify “diagram-only” segmentation, closing the gap with enforceable controls. Dragos has flagged how persistent gaps exist due to flat networks, weak remote access and limited OT visibility.

Start where consequences are the highest. Protect your crown jewels such as safety instrumented systems and critical controllers by using compensating controls if patching isn’t possible. The BitSight report underscores why exposure is rising and patch-less ICS CVEs are common.

Use geographical designation only as a delivery tactic. Logical segmentation is the goal, but rolling out one country, one site, one line and one work process is still a useful way to implement change in global estates without outages.

Internet-exposed ICS/OT continues to grow, making segmentation and filtering, not just perimeter firewalls, but also a requirement to prevent potentially devastating attacks. OT cyber moves differently from IT, and virtual segmentation can help reconcile long-lived, fragile systems with fast-moving modern threats.

As highlighted at recent critical infrastructure resilience conferences, organizations need to establish visibility that maps to workflows, employ AI-assisted policy generation to reduce human error and put enforcement close to the process to contain incidents without affecting safety systems. IT and OT teams will need to meet in the middle – on the process boundary, not the network diagram.