Every Operational Interaction Can Become an Access Path

Distributed operations create value by connecting the people, systems, software, data, and workflows that keep critical infrastructure running. Those same connections also expand the places where users, vendors, applications, machines, and workflows can gain access, extend reach, obscure activity, or leave access unmanaged.

The access surface no longer stops at a device, controller, workstation, or exposed service. It extends across internal users, third-party support, system integrations, operational applications, cloud workflows, AI and machine access, remote workflows, and telemetry data moving across tools, teams, vendors, and platforms. Public exposure data makes the problem visible: researchers found more than 200,000 exposed ICS and OT IPs per month in 2025.

That shift changes the role of vulnerability management. Operators still need to identify and remediate known flaws in devices, software, and exposed services. But distributed exposure does not come only from vulnerabilities. It also comes from legitimate users, trusted vendors, remote sessions, standing privileges, service accounts, integrations, cloud workflows, and operational data paths that can reach or influence critical systems. In OT environments, where patching can be slow, expensive, or operationally constrained, a vulnerability-by-vulnerability approach cannot govern every pathway. One analysis of OT-relevant known-exploited vulnerabilities found that only 13% included a fix path other than patching.

”

“In distributed operations, exposure is not only a vulnerable asset. It is any pathway that can reach, expose, or influence operational systems.”

Attackers also abuse pathways that look legitimate. SANS-cited findings show that 56% of network penetration tests revealed detection gaps for adversary activity using native administration tools. That means the control question cannot stop at “Is this asset vulnerable?” Operators also need to ask what each credential, tool, session, application, integration, and data flow can reach after authentication.

Visibility creates another gap. Monitoring often improves in higher-level operations systems, but it can weaken closer to controllers, field equipment, and remote sites. As exposure moves toward the operational edge, operators may lose visibility into the pathways they most need to validate, limit, monitor, and revoke.

Access decisions can no longer depend only on who sits “inside” the network. Operators need to understand each pathway: who or what uses it, what it can reach, what data it exposes, what actions it can initiate, and how quickly the organization can limit or revoke access. Interaction rather than boundary is the key unit of focus for your security and governance.

The diagnostic checklist at the end of this chapter reflects Neeve’s work helping critical infrastructure operators and their Systems Integrator partners govern remote and third-party access in distributed environments. It applies a pathway-based method: identify each access path, define who or what uses it, determine what it can reach, assess what it can expose or initiate, and confirm how the organization can limit, monitor, and revoke access.

Rather than granting broad network entitlements, operators must govern every individual connection by identity, resource, session, policy, and action. In chapter 7, we will explain how to secure this expanding surface by shifting focus from the network perimeter to the 7 Dimensions of Interaction Governance.