I know that statement will make some people in OT uncomfortable.
The future of OT is IT.
I do not mean that a plant, substation, pipeline, water facility, or manufacturing line should be managed like another enterprise IT environment. I don't mean we should take every IT security practice and push it into a live industrial process without understanding the consequences. In fact, I mean almost the opposite.
I have spent much of my career in industrial automation, operations, and cybersecurity. I have seen why the distinction matters. A control system is not simply a collection of endpoints. It is part of a physical process with operating limits, safety functions, maintenance windows, production commitments, and people who must be able to respond when something does not behave as expected.
But we also need to be honest about what is happening underneath that process.
Windows and Linux. Ethernet networks. Virtual machines. Enterprise identity. Remote-access platforms. APIs. Cloud services. Centralized security monitoring. Data platforms. Edge computing. And now AI.
These are no longer technologies sitting outside the industrial environment. They are increasingly part of the environment that supports them.
That is why I believe the future of OT is IT from a technology-foundation perspective. The mistake would be to assume that this means OT should simply become IT from a risk, governance, or operating perspective. It should not.
The technology may look like IT. The consequence does not.
A Windows server in a control room can look very similar to one in a corporate data center. A switch, firewall, virtual machine, remote-access connection, or user account may all use familiar enterprise technologies.
The difference is not the operating system, device, or protocol. The difference is what the technology is supporting.
If an enterprise application is unavailable, the organization may lose access to a business service. That can be serious.
If a system supporting an industrial process is unavailable or behaves unpredictably, the effect may reach production, equipment, reliability, safety, the environment, or an essential public service. The operational impact depends on the process and its design, but it is never enough to judge the change only by the technology involved.
This is why I have never been comfortable with the idea that OT cybersecurity will eventually become another enterprise IT security function.
The tools will continue to converge. The infrastructure will continue to converge. IT and OT teams will need to work more closely than ever.
But physical consequences will remain. That is the distinction leaders must protect.
The old question is losing value
In many meetings, the discussion still comes down to the same question: Is this IT or OT?
It is often the wrong place to stop.
Consider a cloud-connected HMI. Operations uses it. Engineering maintains it. IT may provide the server, identity service, firewall, and network. Cybersecurity may govern the external connection. A vendor may support the application. A digital team may have introduced the cloud service.
Who owns it?
The usual answer is that everyone owns part of it. When that remains the only answer, nobody owns the full consequence.
The better questions are more difficult:
Who understands what this technology is doing in the process? Who has the authority to approve a change? Who owns the architecture? Who accepts the residual risk? And who is accountable if the operation is affected?
That is where convergence becomes real. Not at the network diagram, but at the point where a technical dependency can alter an operational outcome.
We have spent years drawing network boundaries. We now need to draw accountability boundaries with the same discipline.
The Control Room Test
This is why I keep returning to a simple question I call The Control Room Test:
Would I still make this cybersecurity recommendation if I were personally accountable for keeping the process safe, available, and running?
The test does not weaken cybersecurity. It makes cybersecurity executable in the environment it is intended to protect.
Take patching. A recommendation to remediate a critical vulnerability may be technically correct. Before making a change, someone still needs to understand the operational function, the availability of redundancy, vendor support, the required outage, the test evidence, the rollback plan, and the recovery path if the system does not come back as expected.
The same applies to segmentation, endpoint protection, identity changes, remote access, vulnerability scanning, and security monitoring.
The security objective can be right. The implementation can still be wrong for the operating conditions. That is not resistance to cybersecurity. That is an engineering discipline.
Convergence is not the problem. Unexamined convergence is.
OT teams should not treat every enterprise technology entering an industrial environment as a threat simply because it came from IT. Cloud connectivity, enterprise identity, virtualized infrastructure, centralized SOCs, and remote collaboration can all deliver real operational value when properly designed and governed.
The problem begins when a connection, service, or new dependency is inherited by the plant without a clear reason, known owner, or tested failure mode.
I'd prefer a well-understood connection with a defined purpose, least privilege, strong authentication, monitoring, and a tested method for removal or recovery, rather than an informal connection justified by the outdated belief that OT is a closed environment. It rarely is.
Modern industrial operations exchange data with enterprise systems, vendors, cloud platforms, remote specialists, regulators, and customers. The right response is not to deny that reality. It is to design the integration deliberately.
Architecture before prescription.
Understand the assets, data paths, trust relationships, identities, and dependencies before deciding which control to apply. A firewall rule is not just a rule if it creates a path to a critical system. A remote-access account is not just an account if it becomes the only way to support an engineering workstation at 2 a.m. A cloud service is not just a service if its loss changes the operator's ability to see or act.
Those are as much operational design questions as cybersecurity questions.
AI makes the accountability gap impossible to ignore
Industrial AI will make this conversation more urgent because it can expand both data flows and authority faster than most traditional OT change processes were designed to handle.
An AI system that reads historical data, summarizes alarms, or helps an analyst investigate an event is not the same as one that can initiate a workflow, change a configuration, or influence an operating decision.
The technology may be called an AI assistant, agent, model, or platform. The label is not the important part.
The important question is: what authority have we given it?
The path is no longer a network to the system. It is: Data to model to recommendation to workflow to authority to physical consequence.
At every step, the assurance requirement should rise. An AI system can be useful at the advisory level while still being unsuitable for autonomous process action. A human approval button alone does not solve that problem if the human has incomplete context, cannot challenge the recommendation, or lacks time to review it properly.
This is why I believe AI must enter industrial environments through progressive authority. Start with visibility and assistance. Establish identity, access boundaries, traceability, oversight, and recovery. Increase authority only when the evidence, governance, and engineering controls justify it.
The model can advise. The human remains accountable for the operational decision.
An Enterprise OT Cybersecurity Program is the operating model
This is also why OT cybersecurity cannot be a collection of disconnected projects.
Asset inventory, segmentation, remote access, identity, monitoring, vulnerability management, incident response, backup, and recovery all matter. But a list of projects does not automatically become a resilient program.
An Enterprise OT Cybersecurity Program provides the operating model that connects them.
Cybersecurity defines the risk and security objectives. Engineering understands how a change affects the process. Operations explains the actual operating conditions and the consequences of downtime or loss of view. IT owns the technology services it increasingly provides to the industrial environment. Safety and reliability leaders ensure that critical constraints are visible. Executive leadership decides who has the authority to accept the remaining risk.
That is not shared ownership in the vague sense. It is clear ownership, coordinated across the people whose decisions shape the same operation.
Without that model, organizations can spend heavily on tools while leaving the most important questions unanswered: who owns the asset, who owns the decision, and who can safely recover when technology fails?
The future is integrated, not interchangeable
So, is the future of OT really IT?
Yes, in the sense that the technology foundation of industrial operations will increasingly use the same computing, networking, identity, cloud, and data capabilities that support the enterprise.
No, if the statement is used to erase the operational context that makes OT different.
- IT must understand the consequences of the systems it helps operate.
- OT must accept that enterprise technology is now part of its environment.
- Cybersecurity must work across both worlds without treating either one as an afterthought.
- Engineering must remain central whenever a security decision can affect the physical process.
And leadership must ensure that accountability does not disappear between teams, vendors, and technology platforms.
The most useful question is no longer where IT ends and OT begins.
It is this: Who understands the consequence, who has the authority to decide, and who is accountable when the decision affects the operation?
The technology will keep changing. The physical consequence will not.
Do you think the future of OT is IT? Or is there a boundary between the two that we should never allow to disappear?