From air-gapped to connected: staying in control when isolation is no longer an option

For years, the air gap was considered the gold standard for securing OT environments. If systems are physically disconnected from the internet and the corporate network, attackers simply cannot, or can barely, reach them. That logic still holds true. However, for many organizations, the air gap has long since ceased to be a reality, often without anyone consciously deciding to move away from it.

Three situations, one question

Not every organization is at the same stage. Broadly speaking, there are three scenarios:

1. The deliberate air gap: an organization that, after careful consideration, chooses to keep its OT environment completely isolated. For certain sectors, such as defense, nuclear energy, or parts of critical water infrastructure, this remains the right choice. The risks of connectivity outweigh the operational benefits.
2. The deliberate connection: an organization that actively decides to connect OT and IT, driven by needs such as remote monitoring, data integration, or vendor access, and that carefully prepares for this transition.
3. The unintended connection: an environment that is still labeled “air-gapped” on paper, but in reality contains dozens of small openings. Examples include a temporary VPN connection for a vendor who could not visit on-site, a USB drive carrying a software update, or a data connection requested by operations to improve efficiency.

This third situation is the most common and the most risky. Not because the connections exist, but because nobody treats them as such. The most dangerous situation is not an environment without an air gap. It is an environment where everyone believes the air gap still exists.

Why the air gap is under pressure

Even for organizations that consciously want to maintain an air gap, complete isolation is becoming increasingly difficult. The pressure comes from multiple directions.

Remote monitoring and maintenance make it possible to identify issues before they lead to downtime. In industries such as energy and water, where physical presence can be expensive or logistically challenging, this is a tangible benefit that operations teams are unlikely to ignore.

Data integration gives operational managers real-time insight into production output, energy consumption, and machine health. That data flows into ERP systems, dashboards, and analytics platforms, inevitably extending into the IT network.

External vendors increasingly require access for maintenance, updates, and support. For specialized systems, remote access may be the only practical option. In these situations, the question is no longer whether a connection will exist, but how it will be secured.

The problem is not that these connections are being established. The problem is that the security implications are rarely given equal consideration. The connection is made, the benefits are realized, and security is either addressed later or not at all.

What the air gap provided and what must replace it

The air gap did one thing exceptionally well: it made attacks physically difficult, if not impossible. No connection, no attack. That principle cannot be replicated one-to-one in a connected environment. However, it can be replaced by a combination of controls that achieve the same objective: keeping attackers out and limiting the damage if they do get in.

Segmentation: multiple boundaries instead of one

Where the air gap created a single hard boundary, network segmentation creates multiple boundaries within the network. The Purdue Model offers a proven architecture for this approach: a layered structure in which each level communicates only with adjacent layers, and OT systems are never directly accessible from the IT network or the internet. A demilitarized zone (DMZ) is placed between IT and OT to serve as a buffer.

A critical requirement is that the firewalls enforcing these boundaries must understand OT protocols. A generic IT firewall that merely happens to inspect OT traffic is not enough. Protocols such as Modbus, DNP3, and IEC 60870-5-104 require deep packet inspection specifically tailored to those protocols. Only then can abnormal traffic be accurately detected and blocked. Segmentation also offers another important advantage: it limits the damage if an attacker gains access. A compromised system in Zone A cannot simply move laterally into Zone B. As a result, the impact of an incident remains manageable.

Secure remote access: the door an air gap never needed

An air-gapped environment does not need a door. A connected environment does, and that door must be securely locked. A VPN protected only by a password is no longer sufficient. The minimum requirement is multi-factor authentication (MFA). For OT environments, however, Privileged Access Management (PAM) is the preferred approach: a centralized platform that determines who can access which systems, under what conditions, and for how long, while recording and optionally capturing every session.

In practice, this means vendors are not granted permanent access. Instead, they receive temporary, restricted access only to the systems they are responsible for, and only when required. Access is automatically revoked afterward. Every session is fully traceable. This not only improves security but also provides demonstrable compliance for regulators and auditors.

Active monitoring: seeing what is happening

In an isolated environment, trust was straightforward. In a connected environment, nothing can be taken for granted. New devices, unexpected connections, and unusual behavior all require active monitoring. OT environments are particularly well suited for this because normal behavior tends to be highly predictable. The same systems communicate at fixed times, using known protocols, with known counterparts. Any deviation is therefore a signal.

Network Detection and Response (NDR) solutions for OT environments can identify these anomalies and respond automatically, not based solely on signatures, but on behavior. Combined with centralized log management, they provide the visibility that air-gapped environments once achieved simply by allowing nothing in.

The transition phase: the most dangerous moment

Organizations moving from an air-gapped to a connected environment go through a period in which the old protection has disappeared while the new safeguards are not yet fully in place. This is when vulnerability is at its highest.

Never connect before the security architecture is ready

Connecting first and securing later is one of the most common mistakes. Segmentation, access control, and monitoring must be established before the first data flows.

First understand what you have

A connected environment that is not fully understood cannot be effectively managed. Know which assets exist in your OT environment, how they communicate, and how critical each system is. Without this inventory, every subsequent step is built on unstable foundations.

Take a phased approach

Do not connect everything at once. Start with the least critical systems, learn from the experience, and then expand gradually. This creates time to identify and resolve issues before they impact critical operations.

Actively test whether controls work

Do not trust configurations merely because they look correct on paper. Penetration testing and simulated attack scenarios reveal whether segmentation and other controls hold up in practice.

How Nomios and Fortinet can help

The transition from air-gapped to connected requires technology specifically designed for OT environments, not IT products adapted for industrial use.

Fortinet provides a strong foundation through its FortiGate Rugged firewalls combined with the OT Security Service license, enabling segmentation that truly understands OT protocols. FortiNAC delivers device-level network access control, identifying and classifying every device before granting access. FortiPAM provides centralized access management for external engineers and vendors, including session recording and time-limited access rights.

Nomios supports organizations throughout the transition, from the initial assessment and asset inventory to the design of the security architecture and deployment of the appropriate controls. We see firsthand the mistakes organizations make when transitions happen too quickly or without proper preparation, and we know how to avoid them.

Security beyond the air gap

For some organizations, the air gap remains a conscious and defensible choice. For many others, however, it has not been a reality for years, often without anyone fully recognizing it. That is precisely what makes the situation dangerous. Whether you are deliberately connecting OT and IT or you are already connected without having properly secured the environment, the core question remains the same: How do you replace the protection that isolation once provided with something equally effective in a connected world? 

The answer lies in a combination of segmentation, controlled access, and active monitoring, implemented together as part of a cohesive strategy rather than added as an afterthought. In the next blog, we will explore how to translate these principles into an OT security program that remains effective even as operational demands, budget constraints, and regulatory pressures continue to increase.

Missed the first blog in this series?

Read the first blog here: OT Security in 2026: from blind spot to strategic priority.