You see the whitepapers and the conference talks. Some CISO at a factory in Munich stands on stage and declares they've wrapped their 30-year-old PLCs and SCADA systems in a shiny Zero Trust blanket. The vendor's marketing team has a field day.
Then you talk to anyone actually on the ground in a plant. The conversation is about air gaps, physical keys, and serial cables. Not about conditional access policies or identity providers.
So I'm genuinely asking: who has implemented a true ZTNA model for operational technology? Not just putting a gateway in front of a legacy HMI and calling it a day. I mean the core principles: explicit verification, least privilege access, continuous assessment for *actual* control system assets.
The vendor slide decks make it seem inevitable, but the realities look different:
* The agents required by most proper ZTNA solutions are a non-starter on Windows XP embedded systems running critical lines.
* "Identity integration" for OT often means service accounts, because you're not giving every contractor and engineer an Azure AD identity that can talk to your MES.
* The concept of "trust signals" falls apart when the endpoint has no concept of security posture. You can't assess a CNC machine.
I've seen attempts that are just VPNs with a fancy logo. Or network micro-segmentation rebranded as Zero Trust. The sales teams are pushing hard into manufacturing right now, promising to solve all their security problems. I'm deeply skeptical.
Is anyone doing this beyond the pilot phase? What are you *actually* using for enforcement? And more importantly, what did you have to compromise on from the vendor's "standard" enterprise ZTNA pitch to make it work?
Your mileage will vary
You've hit on the core disconnect. I consulted on a project where the initial mandate was exactly this, a full ZTNA overlay for a bottling line's control network. The reality check arrived during the risk assessment. The "continuous assessment" principle requires an endpoint that can report its health. The Windows NT 4.0 system running the line's sequencer fundamentally cannot. The project scope shifted dramatically from a true zero-trust implementation to what I call "gateway segmentation with extra steps."
We ended up using a purpose-built OT proxy that acts as a policy enforcement point. It checks the identity and device posture of the *engineer's laptop* before allowing a connection through, but the PLCs and the antiquated HMI behind it are completely unaware. The least-privilege model is applied to the human access channel, not the OT assets themselves. It's a pragmatic hybrid, but you're right to challenge whether it deserves the full ZTNA label.
That "pragmatic hybrid" is the only realistic outcome. The ZTNA label is marketing at that point, but the pattern works.
You've isolated the real problem: the trust boundary moves to the gateway because the endpoints can't participate. That's not zero trust for the assets, it's strong identity-aware access control for the human-to-machine interface. It's a good step, but call it what it is.
I've seen the same pattern with MODBUS TCP gear. You can wrap it in a proxy that authenticates the engineer, but the PLC still trusts anything that gets past the gate. The real win is killing VPNs and having decent audit logs for who touched what. The rest is slideware.
Simplicity is the ultimate sophistication