Assume Breach: Why OT Remote Access Security Can't Stop at the Front Door

Why Remote Access Systems Are Becoming Prime Targets for Cyberattacks

In October 2026, two widely deployed remote access products disclosed zero-day vulnerabilities that attackers had already been exploiting.

On October 15, BeyondTrust disclosed CVE-2026-102764, a critical (CVSS 9.3) flaw in BeyondTrust Remote Support. According to Google Threat Intelligence, a suspected China-nexus threat actor had exploited the vulnerability as a zero-day in late August. The attackers gained root access to compromised appliances, attempted to extract stored credentials, and used compromised administrator accounts to open remote sessions to downstream systems. From there, they accessed internal files, exfiltrated documents, and deleted logs to cover their tracks.

Just days earlier, Volexity reported that attackers had chained three Ivanti Connect Secure zero-days to gain root access to VPN appliances that were fully patched at the time. They extracted stored credentials, collected administrator passwords, and exfiltrated Active Directory metadata, which Volexity assessed as preparation for lateral movement.

Although securing remote access is an essential first step in OT security, it’s clearer than ever that organizations also need the ability to detect suspicious activity inside authorized sessions and limit how far an attacker can move if an asset is compromised.

By the time a vulnerability becomes known, the attackers may already be inside.

Controlling Who Gets In Still Matters

If anything, these recent incidents reinforce the importance of strong access controls. Minimizing exposed entry points and tightly restricting who can connect to critical OT systems make it harder for attackers to gain a foothold in the first place.

That starts with getting the fundamentals right:

• No directly exposed OT assets. Remote access should not require exposing industrial systems or unnecessary inbound services to the internet.

• Multi-factor authentication (MFA) for every remote connection. Enforce MFA for employees, contractors, and third-party vendors, including when accessing legacy systems that don't support it natively.

• Least-privilege access policies. Give users access only to the specific assets they need, and only for as long as necessary, rather than granting extended access to an entire network segment.

• No shared or exposed credentials. Privileged credentials should be securely vaulted, never shared between users, and hidden from both employees and third-party vendors accessing OT systems.

• Keep sensitive data within trusted boundaries. Choose a remote access solution that doesn't need to decrypt or store sensitive data in the vendor's cloud to establish connections.

These practices significantly reduce the attack surface and form the foundation of an effective OT access security strategy. But on their own, are they enough?

Assume Breach: What Happens After the Initial Compromise?

One of the core principles of the Zero Trust security model is to assume breach. This isn’t pessimism. It is a design requirement: build defenses with the expectation that preventive controls may eventually fail.

CERT-EU, citing Google's M-Trends 2026, reports that the average time between vulnerability disclosure and exploitationwas negative seven days for the vulnerabilities analyzed. In other words, attackers had already begun exploiting somevulnerabilities before public disclosure.

The Ivanti case illustrates this challenge: appliances that were fully patched at the time were still compromised. Patching remains essential, but it cannot protect against every unknown vulnerability. Organizations must therefore be prepared for attackers who exploit flaws in remote access systems and may then use that access to reach other systems.

Can security and operations teams detect suspicious activity within an authorized session? Can they respond before damage occurs? And if an asset is compromised, how far can the attacker move?

Three Layers of OT Remote Access Security

Because no single control is foolproof, defenses must extend beyond the initial access point. Cyolo's approach to secure connectivity brings together three complementary layers of protection for cyber-physical systems and critical infrastructure:

1. Secure access. Control who can connect to which OT assets, under what conditions. Multi-factor authentication, protected credentials, and least-privilege policies help prevent unauthorized access and reduce unnecessary exposure.

2. In-session risk detection and response. Monitor activity within authorized remote sessions to identify suspicious or risky behavior and enable intervention while a session is still active.

3. Asset and network segmentation. Restrict which systems can communicate with one another to minimize unnecessary connectivity and limit an attacker's ability to move between assets if a compromise occurs.

Detecting Risky Behavior During Active Remote Sessions

Many organizations record remote sessions, but few have the staff to watch them live. Recordings help with investigations after the fact, but by then the damage may already be done.

Live Risk Detection, a capability within the Cyolo PRO (Privileged Remote Operations) access solution, helps close this visibility gap by monitoring active remote sessions without requiring continuous human supervision.

Using context-aware AI, Live Risk Detection identifies potentially risky activity, including activity performed by authorized users, and notifies teams in real time. It addresses two types of risk:

• Operational risk: Potentially unsafe actions, unexpected configuration changes, or activity that falls outside the scope of an assigned task.

• Security risk: Suspicious attempts to access credentials, escalate privileges, or move laterally between systems.

When potentially risky behavior is identified, Live Risk Detection alerts the relevant teams while the session is still active, providing context to help them assess the situation. The response always remains in human hands: authorized personnel can observe or join the session and, if necessary, terminate it. Alerts and activity logs can also feed into existing security monitoring workflows.

The recent BeyondTrust incident shows why visibility beyond authentication is crucial. Attackers gained control of a Remote Support appliance, abused a compromised administrator account, and launched remote sessions to internal systems. Although those sessions were initiated using administrative credentials, the activity itself was malicious.

This highlights an important distinction: Authorized access does not necessarily mean authorized behavior. Real-time monitoring of remote sessions gives security and operations teams an opportunity to detect suspicious behavior and intervene before it escalates.

Limiting Lateral Movement with OT Segmentation

A single compromised asset should not put an entire plant at risk. Yet in many OT environments, flat networks and overly permissive connectivity policies create unnecessary paths between systems. If an attacker compromises an engineering workstation or another trusted asset, those connections can provide a pathway to other parts of the network.

The BeyondTrust and Ivanti incidents reveal how adversaries can seek to extend their reach beyond an initially compromised system. In one case, attackers opened remote sessions to internal systems; in the other, they gathered information assessed as preparation for lateral movement. Neither incident was identified as an attack on OT systems, but the same risks are relevant for industrial environments.

Cyolo CPS Segmentation is an OT-first microsegmentation solution that extends Zero Trust principles to machine-to-machine communication. It helps organizations reduce the risk of lateral movement by restricting connectivity to what each system needs to operate.

The solution brings together three key capabilities:

• Granular machine-to-machine access control. Building on the same platform that governs remote access for users and vendors, Cyolo applies a unified policy model to control which machines can communicate with one another. This limits unnecessary connections that an attacker could exploit.

• Policies based on the actual environment. Cyolo combines context from remote access activity with asset discovery and visibility into communication flows, helping teams define policies around how the plant actually operates.

• Incremental deployment with operational safeguards. Agentless deployment and policy simulation allow teams to validate proposed rules against observed traffic before enforcement and roll out segmentation gradually, reducing the risk of disrupting production.

These capabilities are especially important in OT, where legacy equipment, industrial protocols, and continuous production requirements make changes to network connectivity more complicated than in traditional IT environments.

Segmentation can also support security and compliance objectives, including the zones-and-conduits approach described in ISA/IEC 62443 and applicable requirements under NIS2 and NERC CIP.

The goal is straightforward: if one asset is compromised, unnecessary connections should not give the attacker an easy path to the rest of the operation.

OT Access Security Assessment: Where Are the Gaps?

The following checklist can help identify potential gaps in your OT remote access security strategy. Check each statement that reflects your organization's current practices. Any unchecked box is worth investigating.

Stage 1: Access control

☐ Our remote access architecture does not expose OT assets or unnecessary access services directly to the internet.

☐ MFA is enforced for every remote connection, including vendors and legacy systems.

☐ Privileged credentials are securely vaulted and are not revealed to users or vendors during remote access sessions.

☐ Each user reaches only the specific assets they need, for a defined period of time.

☐ We know which credentials and assets could be exposed if our remote access infrastructure were compromised.

Stage 2: Session monitoring

☐ We can see what is happening inside third-party sessions while they are active, not just review recordings afterward.

☐ We receive real-time alerts in when a connected user performs suspicious actions, such as searching for passwords, trying to escalate privileges, or attempting to access unrelated systems.

☐ We can join, warn, or terminate a suspicious session while it is active.

☐ We can associate session activity with individual users and share relevant events with our security operations center (SOC).

Stage 3: Network segmentation

☐ We know which assets can communicate with each other across our OT network.

☐ Connectivity policies restrict unnecessary communication between systems, lines, and sites.

☐ We can demonstrate segmentation policies and supporting evidence for applicable security and compliance requirements.

☐ We can test and introduce segmentation policies without unnecessarily disrupting production.

Organizations may find that their defenses are strongest at the initial access point (Stage 1), with less visibility and control during remote sessions (Stage 2) and across connected assets (Stage 3).

This is what it means to assume breach: not just working to keep attackers out, but building defenses that help organizations detect, respond to, and contain threats when they get through.

If the checklist revealed areas of remote access security that need a closer look, the Cyolo team can help you assess them and identify practical next steps. Reach out today to schedule a 1:1 conversation.