Flat networks turn one compromised account, laptop, or vendor connection into a route across systems that were never meant to trust one another. In an industrial environment, that route can lead from corporate IT to engineering workstations, HMIs, PLCs, safety systems, and production lines. The largest risk is not simply that an attacker reaches one more host. It is that the network gives the attacker time, reach, and options.
What makes a flat IT and OT network dangerous?
A flat network treats reachability as a proxy for trust. If a device can route to another device, the next security decision often depends on a shared subnet, firewall rule, VPN, or local credential rather than the identity of the user, workload, or machine.
That model is a poor fit for converged environments. NIST describes zero trust as an architecture that does not grant implicit trust based on network location, ownership, or physical placement. In practice, a plant floor should not become trusted just because traffic arrived from an internal VLAN.
The risk is amplified in OT because many assets have long service lives, narrow maintenance windows, and safety or uptime constraints. A controller may be difficult to patch. An HMI may run an obsolete operating system. An unmanaged switch may connect equipment that cannot run a security agent. Those constraints make reachability control more important, not less.
The six biggest risks of unsegmented networks
The biggest risks are lateral movement, cross-domain compromise, excessive vendor access, ransomware disruption, weak incident containment, and incomplete evidence about what happened.
1. Lateral movement becomes the default path
Lateral movement is an attacker moving from an initial foothold to other systems. In a flat network, the attacker can test reachable hosts, reuse credentials, exploit exposed services, or move through administration tools without crossing a meaningful policy boundary.
One compromised endpoint does not automatically compromise a plant. It does give the attacker a set of reachable next steps. Every reachable step increases the number of paths the security team must detect and close.
This is why segmentation is not just a way to organize IP addresses. It should reduce which identities can reach which services. A network that has many VLANs but broad routing and shared administrative access can still have a large lateral-movement problem.
2. IT and OT compromise each other across a trust boundary that is not enforced
IT and OT have different priorities and failure modes. IT teams optimize for access, collaboration, and rapid change. OT teams protect physical processes, safety, deterministic behavior, and uptime. A shared or weakly controlled path makes the more exposed environment a stepping stone into the more sensitive one.
The path can run through an engineering workstation, historian, remote desktop host, file share, backup system, or vendor jump box. The initial malware does not need to understand a PLC. It only needs a route to a system that can communicate with one.
The NIST Guide to Operational Technology Security treats segmentation and isolation as core OT security design concerns because OT systems combine cyber assets with physical processes. The control objective is not to disconnect every system. It is to restrict and monitor the conduits that carry necessary traffic.
3. Vendor and contractor access exposes more than the task requires
Third-party access is often essential for maintenance, diagnostics, and equipment support. On a flat network, the practical shortcut is frequently a VPN, shared jump host, or account that reaches an entire site or subnet.
That creates two problems. First, the vendor identity may have more reach than the task needs. Second, the plant may not have a precise record of which person accessed which machine and when.
The result is standing access where just-in-time access would be safer. If a supplier account is stolen, the attacker inherits the same broad path. If the account is not revoked after a project, the path remains open after the business reason has ended.
4. Ransomware can become an operational outage
Ransomware in IT is costly. Ransomware that crosses into OT can stop production, delay recovery, and create safety concerns even when the controllers themselves are not encrypted.
The flat-network risk is operational dependency. Manufacturing systems may rely on shared identity services, historians, patch repositories, file shares, remote administration, or backup infrastructure. A security event in one zone can remove the services another zone needs to operate or recover.
Segmentation does not make ransomware impossible. It limits the number of systems an incident can affect and gives operators a chance to keep critical processes isolated while IT investigates. That is a materially different recovery position from treating the whole enterprise as one reachable environment.
5. Incident response becomes slower and less certain
Containment requires a boundary. Without one, responders must choose between leaving a possible path open and making a disruptive change under pressure.
Teams may disable a switch, block an entire subnet, shut down remote access, or disconnect a plant. Those actions can protect systems, but they can also interrupt production and destroy useful evidence. The more broad the emergency control, the harder it is to separate an infected asset from a healthy one.
Identity-based policy gives responders a narrower option. They can revoke a user, device, service, or conduit without taking every unrelated system offline. That approach matches NIST’s zero trust principle of evaluating access to resources rather than assuming that a network location is safe.
6. Audit evidence does not match the access decision
An IP address can show where traffic came from. It does not, by itself, explain which human, workload, vendor, or device was authorized to use a service.
Flat environments often spread evidence across firewall logs, VPN records, operating-system logs, jump hosts, and local application logs. Correlating those records after an incident takes time, and the result may still not identify the exact asset or action.
Industrial programs also need to show that access is controlled between zones and conduits. CISA’s zero trust microsegmentation guidance frames microsegmentation as a way to reduce attack paths and limit blast radius. The evidence should show policy, identity, session, and enforcement, not only that a firewall rule existed.
Why OT makes flat-network risk harder to fix
OT environments cannot always use the same controls as ordinary laptops and servers. Many devices cannot host agents, accept frequent reboots, or tolerate an inline change that affects timing.
Three conditions make the problem persistent:
- Legacy assets: Controllers and HMIs may depend on unsupported software or protocols that cannot be modernized quickly.
- Unmanaged equipment: Sensors, PLCs, serial devices, and embedded systems may have no local identity mechanism or software installation path.
- Production constraints: A maintenance window can require coordination across safety, engineering, operations, and a vendor. A security change that is easy in IT can be high risk on a live line.
These constraints do not justify a flat network. They change the control point. Instead of installing an agent on every controller, teams can enforce policy at a connector, gateway, conduit, or service boundary while leaving the production asset unchanged.
What segmentation should enforce
Useful segmentation answers three questions for every connection: who or what is connecting, which service is being requested, and why that connection is allowed now.
| Control | Flat network behavior | Stronger OT and IT behavior |
|---|---|---|
| Identity | Trusts an IP, subnet, or shared account | Authenticates the user, device, workload, or vendor |
| Reachability | Makes many hosts routable by default | Makes services unreachable until policy permits access |
| Privilege | Grants network-level access to a zone | Grants only the required service or machine |
| Vendor access | Uses standing VPN or jump-host access | Uses time-bound, task-specific access |
| Containment | Blocks a broad network area | Revokes a specific identity or conduit |
| Evidence | Correlates IP and infrastructure logs | Records identity, policy, session, and destination |
This is the difference between dividing a network and reducing trust. VLANs and firewalls still have a place, especially for safety and reliability controls. They should not be the only mechanism deciding whether an identity can reach a critical service.
A practical risk assessment for flat networks
Start with the paths that matter most, not a diagram of every switch. A useful assessment can be completed in five passes.
- List the critical processes. Identify the lines, substations, plants, or control functions whose interruption creates safety, production, or regulatory impact.
- Map the conduits. Record every path from corporate IT, remote users, vendors, cloud services, engineering workstations, and neighboring plants into those processes.
- Identify the trust assumption. For each path, ask whether access is granted because of an IP address, subnet, VPN membership, shared credential, or broad group.
- Test the blast radius. Assume one laptop, vendor identity, or engineering workstation is compromised. Document the systems it can reach without a new approval.
- Replace broad paths first. Start with remote vendor access, IT-to-OT paths, and services that expose many assets. Measure success by fewer reachable services and clearer evidence, not by the number of VLANs created.
The assessment should include normal operations and failure operations. Ask what happens if the control plane is unavailable, a local connector loses its upstream link, or a vendor needs emergency access. OT security controls must contain compromise without becoming a new production dependency.
How zero trust reduces the blast radius
Zero trust reduces blast radius by making authentication and authorization prerequisites for a connection, not checks performed after a network route already exists. NIST’s Zero Trust Architecture publication explicitly moves the focus from static network perimeters to users, assets, and resources.
For OT and IT, that means a policy can define a narrow conduit between a verified identity and a specific service. A vendor can reach one HMI for a scheduled task without receiving a route to the plant. An IT workload can call a required historian service without gaining access to every controller on the subnet. A compromised endpoint can remain connected to normal business services while its access to sensitive conduits is revoked.
This model is different from simply adding another firewall in front of a flat network. It makes reachability itself conditional. NetFoundry describes this approach for OT as identity-first connectivity that can front legacy SCADA, PLC, and HMI assets without placing an agent on the controller. Its OT and IoT connectivity architecture also addresses constrained devices and vendor access, which are the cases where conventional endpoint controls often stop.
Related articles
- How to Achieve Zero Inbound Ports
- Zero Trust Tools for Cloud Workloads: A How-To Guide
- Private vs. Public MCP Servers: Security Architecture and Threat Model
FAQ
What is the biggest risk of a flat network?
The biggest risk is unrestricted lateral movement after an attacker gains one foothold. A compromised endpoint, account, or vendor connection can reach systems across business, engineering, and operational zones without a fresh authorization decision.
How does network segmentation reduce lateral movement?
Segmentation reduces lateral movement by limiting which systems and services can communicate. The strongest model combines network boundaries with identity-based, least-privilege policy so that an attacker cannot use simple network reachability as implicit trust.
Why is a flat OT network especially dangerous?
OT assets often include legacy controllers, unmanaged devices, and systems that cannot be patched or rebooted on demand. A flat path lets an IT or vendor compromise reach those assets, while production constraints make emergency containment more disruptive.
Does VLAN segmentation solve the risks of an unsegmented network?
VLANs can reduce broadcast scope and create useful boundaries, but VLANs alone do not guarantee least-privilege access. Broad routing, shared credentials, permissive firewall rules, and VPN access can preserve lateral paths across multiple VLANs.
How should companies segment IT and OT networks?
Separate critical OT zones from corporate IT, define the required conduits, and enforce access by verified identity and service rather than by location alone. Test the design against a compromised laptop, vendor identity, and engineering workstation before changing production traffic.
Can legacy PLCs be segmented without installing agents?
Yes. A connector or gateway can enforce access in front of a PLC, HMI, or SCADA system when the asset cannot run software. The design must preserve local control, avoid unnecessary production changes, and provide a clear fallback for loss of upstream connectivity.
What is the difference between segmentation and microsegmentation?
Segmentation divides an environment into larger security zones, such as IT, DMZ, and OT. Microsegmentation applies smaller policy boundaries around workloads, devices, services, or individual conduits so that compromise of one asset does not grant broad access to its neighbors.
Sources & References
- NIST SP 800-82 Rev. 3 – OT security and segmentation guidance
- NIST SP 800-207 – zero trust architecture principles
- CISA Zero Trust Microsegmentation Guidance – blast-radius reduction and microsegmentation
- NetFoundry OT and IoT Connectivity – identity-first OT connectivity and legacy-asset controls