OT and IT in one sentence each
IT (information technology) is the computing that handles information: laptops, servers, email, finance systems, the cloud. OT (operational technology) is the computing that controls something physical: the controller that keeps a freezer at minus 22, the PLC that runs a pump, the building management system that opens a damper, the charger that decides when your car gets power.
That’s the textbook version. The real difference, and the reason I keep writing about it, isn’t what the boxes are made of. Plenty of OT today is a small Linux computer with a web interface, exactly like an IT device. The difference is how the kit is bought, how long it lives, who looks after it, and what happens when it goes wrong. Those four things explain almost every OT security incident I’ve read about, including the supermarket freezer hacks currently working their way across Europe.
Where you find OT
Most people picture a factory, and factories are full of it. But OT is everywhere physical things need controlling, and a lot of it sits in places nobody thinks of as “industrial”:
- Retail: refrigeration controllers, HVAC, lighting, door access, car park barriers.
- Buildings: building management systems (BMS), lifts, fire panels, energy meters.
- Utilities: SCADA, telemetry outstations, pumping stations, substations, battery storage.
- Transport and energy: EV chargers, signalling, traffic systems, solar inverters.
- Manufacturing: PLCs, HMIs, robot cells, drives, process control.
And sitting between a lot of that OT and the outside world, more often than not, is a cellular router in a cabinet. That router is IT-shaped kit doing an OT job, which is a big part of why the line between the two keeps blurring.
OT vs IT: the side-by-side
| IT | OT | |
|---|---|---|
| What it does | Stores, moves and processes information | Monitors and controls physical equipment and processes |
| Typical replacement cycle | 3 to 5 years | 10 to 20 years, often “until it breaks” |
| Patching | Monthly, automated, expected | Rare, manual, needs a maintenance window, often never |
| Can you reboot it? | Usually, out of hours | Often not without stopping the process it controls |
| Top security priority | Confidentiality of data | Availability and safety of the process |
| Protocols | Modern, encrypted, authenticated by default | Often Modbus, BACnet, DNP3 and similar, designed for closed networks with little or no authentication |
| Who owns it | The IT department | Operations, facilities, or an outside contractor |
| Who supports it | IT team, vendor, managed service provider | Equipment maker or installer, sometimes long gone |
| What failure looks like | Lost, leaked or locked data | Spoilt stock, damaged plant, environmental harm, injury |
| Main standards | ISO/IEC 27001, NIST Cybersecurity Framework | IEC 62443, NIST SP 800-82 |
The priorities are upside down
Security people talk about the CIA triad: confidentiality, integrity, availability. In IT, confidentiality usually comes first. A server going down for an hour is annoying. Customer data walking out of the door is a disaster.
In OT the order flips. Availability and safety come first, then integrity, and confidentiality is often a distant third. Nobody much cares if an attacker can read a freezer’s temperature. They care very much if the attacker can change it. That one inversion explains a lot of behaviour that looks careless to IT people. An OT engineer won’t apply a patch that might stop a production line, won’t turn on a security feature that might add latency to a control loop, and won’t let an antivirus scan anywhere near an HMI that has been running happily since 2014. From where they stand, the biggest risk is the plant stopping, and an untested change is a good way to stop it.
They’re not wrong. But it does mean the security risk piles up quietly, year after year, until somebody else finds it first.
The lifecycle gap
This is the one that worries me most. IT kit gets replaced on a cycle, so old vulnerabilities age out of the estate naturally. OT kit is capital equipment. It is bought with the plant it controls, depreciated over the same period, and replaced when the plant is replaced. A refrigeration system, a chiller or a pumping station might be expected to run 15 to 20 years.
The software inside it almost never gets that long. Vendors support a model while they sell it, plus a few years. After that it carries on working perfectly, it just never gets another security fix. The Danfoss AK-SC 355 controllers caught up in the French supermarket attacks were phased out in 2016 and the AK-SM 800 went end of life in 2021, yet both were still running stores in 2026. I’ve argued in the freezer piece that the security support life of an embedded controller should match the working life of the thing it controls. Right now it rarely does. The plant you can’t patch is the normal state of affairs, not the exception.
Why the gap used to be fine, and isn’t any more
For decades OT got away with it because it was isolated. The plant network didn’t touch the office network, let alone the internet. Weak protocols and unpatched controllers didn’t matter much when the only way in was through the factory gate.
Then everybody wanted the data and the convenience. The maintenance contractor wanted remote access so they didn’t have to drive out at 3am. Head office wanted dashboards. The energy manager wanted half-hourly readings. Each connection made perfect business sense, and each one chipped a bit more off the isolation that was doing the security job for free. This is what people mean by IT/OT convergence. The devices didn’t change much. Their exposure did.
Add 20-year-old protocols like Modbus into that mix and you can see the problem. As I covered in why new IIoT hardware still ships with Modbus, if a packet reaches a PLC on the right port, the PLC generally does what it is told. That’s fine on a closed network. It’s an open invitation on a reachable one.
The short version. IT security assumes you can patch, reboot and replace. OT security has to assume you can’t, so it leans on keeping things unreachable, watching them closely, and knowing exactly who is allowed in and how.
Where IoT fits
IoT sits right across the boundary, which is why I think it makes the problem both better and worse. A connected sensor or a cellular router is built like IT: Linux, web interface, regular firmware releases. But it is deployed like OT: bolted into a cabinet, left for years, owned by whoever installed it. If it is managed like IT, with updates and monitoring, it can be the thing that makes an OT site safer. If it is managed like OT, installed once and forgotten, it becomes one more internet-facing box nobody is watching.
The good news is that the gateway is often the best place to fix things. A properly hardened cellular router on a private APN, with a VPN for remote access and no management interface open to the internet, takes an unpatchable controller off the street without touching the controller at all. Some routers can now go further and inspect the industrial traffic itself, which I looked at in OT deep packet inspection on cellular routers.
Why the difference matters to you
If you run sites with any of the kit above, the practical upshot is this: don’t let OT fall into the gap between departments. IT thinks facilities own it, facilities think the contractor handles it, and the contractor is paid to keep things running, not to manage vulnerabilities. Somebody has to own it. Then:
- Find it. Make an inventory of every OT device that talks to anything, including who made it and what firmware it runs.
- Check its support status. Is the model end of life? When does security support end? Put that date on the asset register next to the warranty.
- Get it off the internet. Nothing OT should have its management interface on a public IP. Use Shodan, or your own exposure monitoring, to check what the world can see.
- Separate it. Keep OT on its own network segment, away from office IT and guest Wi-Fi.
- Control remote access. One managed route in, with named accounts, not a port forward and a password on a sticker.
- Plan for the bad day. Know how you’d restore it. I’ve written about OT backup and recovery separately.
None of that needs a big budget. It needs somebody to accept that the box running the freezers is a computer, and to treat it like one.
Frequently asked questions
Is OT the same as IoT?
No, but they overlap. OT is any technology that controls physical processes, much of it older than the term IoT. IoT is about connecting devices to networks and the cloud. A lot of modern OT is now IoT-connected, and a lot of IoT kit ends up doing OT jobs.
Is SCADA OT?
Yes. SCADA (supervisory control and data acquisition) is one of the classic OT systems, used to monitor and control distributed assets such as water, power and pipelines.
Why can’t OT just be patched like IT?
Often because patching means stopping the process it controls, because the vendor no longer supplies updates, or because the update hasn’t been tested with the rest of the plant. In many cases the hardware simply can’t run the newer firmware.
Does a cellular router count as IT or OT?
Both, really. It is IT technology doing an OT job, and it should be managed with IT discipline: kept updated, monitored, and never left with its web interface open to the internet.
Standards referenced: IEC 62443 series (industrial automation and control systems security); NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security; ISO/IEC 27001. Danfoss controller status as stated by Danfoss and CERT-FR, October 2026.
