14. October 2026
Remote access to industrial and operational technology (OT) networks has become an everyday operational necessity. Technology vendors need to service PLCs, system integrators need to configure and troubleshoot HMIs, and technicians need to resolve equipment failures remotely. Yet the vast majority of companies still rely on the same tool their IT departments use to enable employees to work from home: a traditional VPN. But an OT network is not an office network. What may be an acceptable compromise in IT can become a critical security vulnerability in an industrial environment—one that an attacker only needs to discover once.
A VPN gives users access to a network, not to a specific device. Once connected, a user can technically reach anything that is routable from that point in the network—not just the production line or control panel they originally needed to access.
In practice, this means:
Vendors often share a single account among multiple technicians, making it impossible to trace a specific intervention back to an individual.
VPN tunnels often remain permanently active, even when no one is using them.
Activity within the tunnel is typically neither recorded nor monitored.
An unmanaged subcontractor's laptop effectively gains direct access to the production line through the tunnel.
Furthermore, VPN concentrators are exposed to the internet and have long been among the most frequently exploited types of network devices. Attackers actively scan for them, looking for unpatched gateways. And every port opened for remote maintenance creates a firewall exception that undermines network segmentation based on the Purdue Model, which forms the foundation of most industrial security architectures.
According to Claroty Team82's State of CPS Security 2025: OT Exposures report, nearly one million OT devices analyzed across manufacturing, logistics, and transportation revealed that 12% had known exploited vulnerabilities (KEVs), 68% of which were associated with ransomware groups. In manufacturing alone, more than 96,000 devices had known vulnerabilities, with 68% of these also linked to ransomware.
However, the most serious finding is not about the vulnerabilities themselves, but about how devices are connected to the internet: 40% of the organizations analyzed had assets with exploitable vulnerabilities insecurely exposed to the internet, while 12% had OT devices communicating with malicious domains.
In other words, the issue is not simply how many security gaps an organization has, but how easily attackers can exploit them from outside. And unsecured remote access provides exactly that entry point.
A more secure model does not rely on opening a hole in the firewall and hoping no one exploits it. Instead of a permanent network tunnel, it uses brokered access to a specific device, for a limited period, under a clearly verified identity.
In practice, the process works as follows:
A technician requests access to a specific device, rather than the entire network.
Their identity is verified, including through multi-factor authentication (MFA).
The owner of the device or production line approves access for a defined time window.
The system establishes a session and automatically injects the device credentials. The vendor never sees or knows them.
The operations team monitors the session and can record it if required.
Once the approved time window expires, access is automatically revoked.
This is exactly how Claroty xDome Secure Access (formerly Secure Remote Access) works. It is a zero-trust solution designed specifically for cyber-physical systems (CPS) environments, rather than an IT tool adapted for industrial use.
It requires no inbound open ports: a connector within the OT zone initiates an outbound encrypted connection, while vendors and employees access systems through a single portal with full auditability.
"We have one portal for vendors and employees to access operations, with full control over access and complete auditability."
— Pascal Viala, Head of Digital Manufacturing, Hydrovolt
For organizations in regulated sectors—including energy, manufacturing, healthcare, and critical infrastructure—secure remote access is not just a cybersecurity concern. It is also a matter of regulatory compliance.
NIS2 requires demonstrable access controls, privileged account management, and supply chain risk management. Non-compliance can result in fines of up to €10 million or 2% of annual worldwide turnover for essential entities.
ISA/IEC 62443 is based on a zone-and-conduit architecture, requiring identification, authentication, use control, and logging at zone boundaries. These are precisely the requirements that device-specific brokered access naturally addresses.
The Czech Cybersecurity Act (ZKB) and DORA impose similar requirements for controlled and auditable third-party access to operational systems.
Secure remote access is therefore not just a technical security measure. It also provides essential evidence during audits. Today, having records of who accessed which systems, when, and for how long is just as important as maintaining your firewall rules.
VPN access to operational networks was rarely introduced with bad intentions. At the time these connections were established, VPNs were a standard and sufficient solution. Today, however, they have become one of the weakest links, attracting increasing attention from both attackers and auditors.
At BIT SERVIS, we help customers in regulated industries identify all external access paths into their OT networks and replace open VPN tunnels with controlled access built on the Claroty platform—from asset inventory and visibility to the implementation of Secure Access.
If you don't know how many remote access connections currently exist in your OT network, that's a good place to start.