Every industrial organisation now lets someone in from the outside — OEM vendors, system integrators, remote engineers. How they get in determines whether a plant’s biggest convenience becomes its biggest breach path.
Remote Access Has Become OT’s Biggest Front Door
Operational technology (OT) environments were designed to be isolated. IT/OT convergence ended that: industrial control systems (ICS), SCADA servers, PLCs, and HMIs are now reachable across networks because efficiency, analytics, and remote maintenance demand it.
That maintenance is rarely done by the plant’s own staff alone. OEMs service their turbines and robots under warranty, system integrators tune SCADA applications, and in-house engineers troubleshoot from home at 2 a.m.
Third-party remote access is no longer an exception granted reluctantly it is a permanent operating requirement of modern industrial environments.
It is also the front door attackers prefer. Remote access pathways leaked VPN credentials, exposed remote desktop services, vendor connections have featured repeatedly in major industrial intrusions.
And in OT, the stakes are not confined to data: a compromised session can reach equipment whose failure affects production, the environment, and human safety.
Why OT Environments Can’t Be Secured Like IT
OT security inverts the priorities IT teams grew up with. Availability and safety outrank confidentiality: an outage or an unsafe state is the disaster, not the leak.
The equipment reflects that. Industrial assets run on 15-to-25-year lifecycles, often on operating systems past end of support, controlled by devices fragile enough that an ordinary vulnerability scan can crash them.
Patch windows arrive a few times a year, if at all.
Segmentation frameworks such as the Purdue model respond by structuring plants into zones connected through tightly controlled conduits.
But when patching can’t keep pace and the internals of a zone stay flat, one control matters above all others: deciding precisely who can reach what, over which protocol, for how long.
That is why remote access design not another perimeter appliance has become the defining OT security decision.
Why VPNs Fall Short for OT Remote Access
The VPN was built to answer a different question: “how do we put a trusted employee onto the corporate network?” Applied to OT, it answers it far too generously.
A VPN grants a network location, not a task. Once the tunnel is up, the remote laptop holds a routable path into the zone it lands in and everything reachable from there.
Vendors often share a single account, sessions run over standing tunnels that exist around the clock, nothing is recorded, and an unmanaged contractor laptop can bridge the open internet to the plant floor in one hop.
The concentrator itself compounds the problem. VPN appliances are, by design, internet-exposed and edge-device vulnerabilities have become one of the most heavily exploited categories in recent years, with attackers mass-scanning for unpatched gateways.
Every inbound port opened for remote maintenance is a firewall exception that quietly undermines the zone-and-conduit segmentation the Purdue model prescribes.
Jump servers soften the blast radius but bring their own sprawl: more credentials to manage, more systems to patch, and still no per-asset authorisation.
WEBINAR SPOTLIGHT:
OT Remote Access: VPN-less, Controlled, Secure — BeyondTrust’s APJ Tech Talk shows this architecture live: brokered, recorded, asset-level sessions into OT environments with no VPN in the chain. Reserve your seat here →
What VPN-less OT Remote Access Actually Means
VPN-less remote access replaces the tunnel with a broker. Lightweight connectors inside each zone dial outbound over TLS to an access gateway; the remote engineer or vendor reaches that same gateway from a browser.
No inbound firewall rules are created, no ports are exposed, and at no point does a routable network path exist between the remote device and the industrial asset.
Sessions are protocol-isolated: RDP, SSH, VNC, or an HMI’s web console is rendered through the gateway, so screen output and keystrokes cross the boundary — not raw packets from an untrusted laptop.
Authorisation is identity-based and per-asset: a vendor is approved for one PLC, one engineering workstation, one time window, under just-in-time policies rather than standing entitlements.
Credential handling changes just as fundamentally. OT account passwords stay in a vault and are injected into the session by the broker the third party authenticates as themselves, with multi-factor authentication (MFA), and never sees or holds the asset credential at all.
Every session is monitored live, recordable end to end, and terminable in one click. This is zero trust applied to industrial connectivity: never trust a network location; verify an identity, for one asset, every time.
This is the architecture behind BeyondTrust Privileged Remote Access (PRA), already running in industrial environments where a vendor session that once meant a standing VPN tunnel is now a single brokered, recorded connection to one asset.
Global flavour-and-fragrance manufacturer MANE adopted this approach across its plant environments see how in the case study.
Inside a Controlled OT Session
The lifecycle above is what “controlled” means in practice. Access is requested for an asset, never for a network. Identity is verified with MFA before anything connects. The asset owner approves a bounded window.
The broker builds the session, injecting vaulted credentials. Operations teams watch or record everything that happens, and when the window closes, access simply ceases to exist leaving an audit trail instead of an open tunnel.
Want to see each of these six stages demonstrated against a live environment? The BeyondTrust APJ Tech Talk walks through the full workflow, from vendor request to audit evidence — register here.
Prefer three minutes right now over a full session? Watch Secure OT Environments with Privileged Remote Access for a short walkthrough of the same brokered-session model.
FREE ASSESSMENT:
Operational Technology (OT) Cybersecurity Assessment — find out where your own remote access setup stands against the checklist below before you finish reading it. Take the free assessment →
Mapping VPN-less Access to IEC 62443, NERC CIP, and NIS2
Controlled remote access is also what the frameworks keep asking for. In IEC 62443 terms, a broker is an enforced conduit between zones implementing identification and authentication control, use control, and logging at exactly the boundary the standard cares about.
NERC CIP requires interactive remote access to pass through an intermediate system with multi-factor authentication and encryption, and expects utilities to know and control vendor remote access as part of supply-chain risk management.
NIS2 pushes the same direction across European critical infrastructure: demonstrable access control, privileged account management, and supply-chain security.
A recorded, time-bound, per-asset session model produces the evidence all three demand something a shared VPN account never will.
For a clause-by-clause mapping of session controls to utility compliance requirements, see BeyondTrust’s NERC CIP Alignment guide.
An Evaluation Checklist for OT Remote Access
Whatever platform you evaluate, hold it to six requirements:
- Outbound-only architecture — no inbound firewall rules, no exposed ports, no routable path from remote device to asset.
- Per-asset least privilege — authorisation scoped to individual systems with just-in-time, time-bound windows.
- Identity-first authentication — MFA and directory integration for employees and third parties alike.
- Credential vaulting and injection — vendors never see, hold, or reuse OT passwords.
- Session monitoring, recording, and termination — live oversight with an instant kill switch.
- Framework-mapped reporting — audit evidence aligned to IEC 62443, NERC CIP, and NIS2.
A product that cannot meet these is not an OT remote access solution — it is a VPN with better marketing.
TALK TO AN EXPERT
Get a Second Opinion on Your OT Remote Access Setup Talk through your specific ICS/SCADA footprint, vendor access model, and compliance requirements with a BeyondTrust OT security expert — no webinar slot required. Talk to an expert →
FAQ: OT Remote Access
Is a VPN safe for OT remote access?
Not by modern standards. A VPN provides standing, network-level access, exposes an internet-facing appliance that attackers actively scan for, and offers no per-asset authorisation or session recording. For third-party access to industrial systems, it should be treated as a legacy pattern.
What replaces the VPN in OT environments?
Identity-based, brokered remote access — often called secure or privileged remote access, or zero trust network access for OT. Connections are outbound-only, protocol-isolated, scoped to single assets, time-bound, and fully recorded.
BeyondTrust Privileged Remote Access (PRA) is built specifically for this model.
Does VPN-less remote access align with IEC 62443?
Yes. A brokered session model implements the standard’s zone-and-conduit architecture, its identification and authentication requirements, and its use-control expectations, while generating the audit evidence assessors ask for.
The Bottom Line
Remote access to OT is permanent; the tunnel doesn’t have to be. The organisations securing industrial environments most effectively are replacing network-level trust with identity-level control standing tunnels with just-in-time sessions, invisible activity with recorded evidence.
The technology to do it without slowing a single vendor or engineer already exists.
See it for yourself: Register for the APJ Tech Talk · Take the Free OT Assessment · Talk to an Expert
The post VPN Is the Biggest Backdoor Into Your Plant — Here’s What Should Replace It on Your OT Network appeared first on Cyber Security News.