Securing Critical Infrastructure Operations Ch. 02: Distributed Operations Report Chapters Securing Critical Infrastructure Operations Report Landing Hub 01 Overview 02 Distributed Operations 03 The Expanding Access Surface 04 Named Threat Patterns 05 Quantum-Ready Access 06 Agent Proliferation 07 From Zero Trust Remote Access to Secure Operations 08 Vertical Outcomes 09 Operator Call to Action 02 CHAPTER 02 2026 Report Critical Infrastructure Operations Are Becoming Distributed Application and Data Platforms Industrial sites, building portfolios, data centers, utilities, campuses, and field operations now depend on connected systems, applications, vendors, cloud services, analytics, and data flows that extend beyond any single network boundary. Operating Model Shift Operations No Longer Happen in One Place Critical infrastructure work now spans sites, networks, applications, data flows, vendors, and automated workflows. Critical infrastructure operations used to center on local assets, local networks, and local operators. That model has changed. Modern operations now depend on remote teams, third-party vendors, cloud applications, analytics platforms, connected devices, centralized monitoring, mobile workflows, and operational data moving across sites and organizations. The scale of that shift shows up in the numbers. The global IoT market is projected to grow more than 5x by 2032. Industrial software is projected to more than double by 2029, while building automation systems are projected to grow nearly 90% by 2030. Control Engineering’s 2025 State of Industrial Automation Report also found that 72% of organizations are either rapidly or steadily increasing their technology deployment. ” “Every stage of operational modernization adds new interactions to govern.” Together, these signals point to a larger pattern: more operational work now runs through connected devices, software platforms, automation systems, analytics tools, and cloud-connected workflows that monitor, control, analyze, secure, and optimize physical environments. This shift creates substantial operational value. Teams can monitor more sites, respond faster, support equipment remotely, analyze performance, optimize energy use, and coordinate vendors at scale. It also changes the access model. Even operators that keep their own systems and data out of the cloud increasingly work with vendors, OEMs, service providers, and software platforms that connect operational workflows to cloud environments. The result is a shared operational fabric where access no longer starts and ends inside the operator’s network. When operations become distributed, access decisions can no longer focus only on who is inside the network. They must account for every person, application, vendor, OEM, service account, automation, workflow, machine, cloud platform, and data flow that can reach operational systems or influence operational data. Governance has started to follow the shift. 52% of organizations reported that the CISO or CSO owns OT responsibility, up from 16% in 2022. And in 2025, CISA, NSA, FBI, and international partners published OT-specific guidance for integrating AI into operational technology, organized around four security principles for essential-service operators. The direction is clear: critical infrastructure operations are becoming distributed application and data operations. The access model has to follow the work. What Changed Operational responsibility is distributed Operators, vendors, OEMs, contractors, and service providers share responsibility for keeping systems running across sites and organizations. Applications run much of the work Cloud dashboards, analytics tools, engineering applications, ticketing systems, and vendor platforms help teams monitor, maintain, and optimize critical infrastructure. Data drives operations Telemetry, alarms, maintenance records, performance metrics, energy data, logs, and configuration data feed dashboards, analytics tools, vendor workflows, compliance processes, and operational decisions. Workflows cross many boundaries Diagnostics, maintenance, approvals, vendor support, incident response, reporting, and optimization require handoffs across OT systems, IT tools, cloud platforms, vendors, service providers, and operational teams. Evidence Signals Signals of Distributed Operations The shift toward distributed operations shows up in connected systems, data-driven workflows, executive OT ownership, and new guidance for AI-enabled operational environments. Connected Operations $ 4 T by 2029 projected global IoT market value up 370% from $714B in 2024 Connected systems are scaling Operators are connecting assets, sensors, applications, analytics platforms, and remote workflows to improve visibility, uptime, productivity, and operational control. IoT growth spans manufacturing, energy, transportation, healthcare, government, agriculture, and more. Why it matters As connected operations scale, access extends across devices, applications, vendors, data flows, cloud platforms, and remote support workflows. Source: Fortune Business Insights, Internet of Things (IoT) Market Size, Share & Industry Analysis, 2025–2032 (2025) Software-Controlled Operations $ 246 B by 2030 composite of Industrial and Building automation markets up 94% from 2025 Software increasingly runs operations Industrial software and building automation platforms increasingly define how operators monitor, control, analyze, secure, and optimize physical environments. Why it matters When software coordinates operational work, access no longer comes only from employees logging into systems but also from vendors, OEMs, applications, machines, cloud platforms, service accounts, and automated workflows. Operators need governance that authorizes and limits each interaction. Source: Composite signal based on MarketsandMarkets forecasts for industrial software and building automation systems. (2025) Third-Party Operations 77 vendors average number of third parties with OT environment access 25% give OT access to more than 100 vendors Operations rely heavily on third parties At just five users per vendor, 77 third parties can represent nearly 400 external users, and over 1000 counting shared accounts, subcontractors, service accounts, former users, machines, cloud platforms, or automated workflows Why it matters Operators need governance that authorizes each interaction, limits what it can reach, and preserves visibility across the outside parties that keep operational environments running. Source: Ponemon Institute / Cyolo research (2024) OT Governance 52 % of organizations assign OT responsibility to the CISO or CSO up from 16% in 2022 OT security moved up the org chart Operational technology security has become an enterprise governance issue, not only a site-level engineering concern. Why it matters Critical infrastructure operators need access models that satisfy enterprise security requirements while still supporting local operational workflows. Source: Fortinet 2025 State of Operational Technology and Cybersecurity Report (2025) AI in OT 4 CISA AI-in-OT principles 4 security principles for critical infrastructure operators 2025 was the first OT-specific AI integration guide from CISA+ AI now has OT-specific AI security guidance CISA, NSA, FBI, and international partners published OT-specific guidance for AI integration in critical infrastructure environments for the first time covering four core principles. Why it matters As AI tools and agents enter operational workflows, operators need governance for non-human interactions — including service accounts, APIs, automations, AI agents, and machine-driven requests that can reach or influence OT systems. Source: New Joint Guide Advances Secure Integration of Artificial Intelligence (2025) Operating Model Modern Operations Run Through Distributed Interactions Critical infrastructure operations no longer happen only inside a site, network, or control room. They depend on interactions among internal teams, vendors, OEMs, software platforms, machines, cloud systems, data flows, and automated workflows. Infrastructure Operations Internal Vendors Operational Software AI Mobile Analytical Contributing Operator Internal Operators Employees, engineers, SOC teams, IT teams, OT teams, and site personnel monitor, maintain, approve, and respond across operational environments. Takeaway Distributed operations create value by connecting the people, systems, software, and data needed to run critical infrastructure at scale. They also create more interactions to govern. Next: The Expanding Access Surface Distributed Operations Create More Access Paths As operations spread across sites, vendors, applications, cloud platforms, machines, service accounts, and data flows, the access surface expands. The next chapter examines how those pathways become exposure points — and why traditional remote access models struggle to govern them. Revisit the Evidence Signals