What CISOs Need To Know About Identity Governance Across OT And IT

Forbes

3 days ago

Peter Hill is the chief executive officer of Gathid.
As the boundaries between operational technology (OT) and information technology (IT) dissolve, identity is becoming the connective tissue and the point of greatest vulnerability.
Industrial and critical infrastructure organizations are digitizing rapidly. From connected sensors to hybrid cloud platforms, the convergence of OT and IT brings undeniable operational advantages. But for security leaders, it introduces a complex, fragmented identity landscape that's difficult to see, govern and secure.
For today's CISOs, the question is no longer whether OT and IT should be integrated. It's how to manage access and enforce identity governance in environments that were never designed to work together.
The Identity Challenge At The Heart Of OT/IT Convergence
Traditional identity and access management (IAM) systems were built for IT. They often assume cloud-ready environments, API access and a single source of truth. OT, on the other hand, remains a world of legacy systems, air-gapped networks, vendor-owned software and local admin accounts.
This disjointed architecture leads to significant governance challenges:
• No unified visibility across all identities (human and machine)
• Dormant or orphaned accounts in OT systems remain active
• Excessive privileges and toxic role combinations go unnoticed
• Manual access reviews are unreliable and out of date by the time they're completed
• Audits become operational burdens due to a lack of centralized evidence
For CISOs, this identity debt is not theoretical. It's a real risk: operational, reputational and regulatory.
Why The Old Playbook Doesn't Work
Many organizations attempt to extend their IT IAM tools into OT. However, these platforms often require full integrations, modern protocols and constant connectivity—things OT environments can't always provide.
And even when integration is possible, it's invasive. Retrofitting centralized IAM into OT networks may require architecture changes, incur downtime or expose systems to unnecessary risk.
Security leaders don't just need to control access. They need to fully understand it, continuously and contextually, without adding complexity or breaking mission-critical operations.
A Strategic Solution: Digital Twins Plus Knowledge Graphs
To bridge the identity governance gap, CISOs are turning to more adaptive, data-driven models, specifically digital twins and knowledge graphs.
A digital twin creates a virtual representation of your identity ecosystem, spanning both OT and IT systems. It maps every user, account, permission and role, providing a dynamic view of who has access to what and why.
Unlike traditional IAM, this model doesn't require bidirectional integration. It works with disconnected or air-gapped systems, making it especially suited to high-security OT environments.
Benefits for CISOs:
• See the full access landscape across all domains.
• Monitor changes as they happen.
• Continuously validate least privilege and policy compliance.
• Gain board-level visibility into identity-related risk.
Where digital twins give you the map, knowledge graphs show the structure. They model the relationships between people, systems, roles and policies, revealing patterns, risks and dependencies.
With knowledge graphs, CISOs can:
• Identify cross-system privilege creep.
• Detect conflicting roles before they become vulnerabilities.
• Tie service accounts back to owners and justify permissions.
• Analyze the downstream impact of access changes.
Together, digital twins and knowledge graphs form a risk intelligence layer for identity, delivering insights that most IAM tools miss.
What CISOs Should Do Next: Five Strategic Steps
To mature identity and access governance across converged OT and IT environments, CISOs should prioritize these actions:
1. Inventory the full identity landscape. Start with a complete audit of all identities: employees, contractors, third parties, service accounts and machine users. Map where access is granted and how it's governed, especially in non-centralized OT systems.
2. Build a unified identity model. Leverage digital twin technology to consolidate and continuously update your access map. This creates the foundation for scalable governance and auditability.
3. Uncover hidden risk through relationships. Use knowledge graphs to reveal toxic access paths, role conflicts and overprovisioned accounts. Context is key. Understanding how access is used and why is as important as knowing it exists.
4. Automate reviews and compliance checks. Manual reviews are slow, expensive and outdated before they're completed. Shift to ongoing validation of access rights and policy adherence. Make audits self-serve and always-on.
5. Enforce least privilege with confidence. Privilege management only works when it's grounded in accurate, current data. Use identity modeling and graph-based insights to enforce role-based access and eliminate unnecessary privileges, especially for sensitive OT systems.
Why This Matters: Identity As A Modern Threat Vector
Attackers no longer break in. They log in. Whether it's compromised credentials, privilege escalation or insider misuse, identity is now the attack surface of choice.
And in OT/IT converged environments, the stakes are even higher. A breach in a misconfigured identity could mean more than just data loss. It could halt production, disrupt energy grids or impact public safety.
For CISOs, this is not just a technology challenge; it's a boardroom imperative. Visibility, control and auditability of access across all environments must be provable, scalable and immediate.
Identity Governance Without Borders
The convergence of OT and IT is inevitable. Yet fragmented identity governance doesn't have to be. By embracing modern modeling technologies—digital twins for continuous visibility and knowledge graphs for contextual intelligence—CISOs can gain the insight and oversight they need.
This isn't about replacing existing tools. It's about complementing them with intelligence that closes gaps, reduces risk and transforms compliance from a burden into a strength.
In a world where identity is the new perimeter, understanding access is not optional. It's foundational.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?