Segment Smarter, Not Harder: Automate Zero Trust Efforts for OT/IoT

Summary

Ransomware attacks on industrial organizations rose 87% in a year, and attackers increasingly start in IT networks and pivot into converged OT and IoT environments, where visibility is lowest and controls are weakest. In this webinar, Zero Networks customer engineer Bryan Ward walks through how the Akira ransomware group bypassed EDR by pivoting through an unsecured webcam, and how automated, agentless microsegmentation would have broken that attack chain: restricting remote access, blocking lateral movement by policy, and isolating unmanaged devices behind just-in-time MFA. Unlike legacy segmentation projects that take years, this approach can deliver holistic microsegmentation across IT, OT, and cloud in about 30 days.

Key takeaways

• Ransomware attacks targeting industrial organizations increased 87% in a year, and the number of ransomware groups targeting OT and ICS environments grew 60%, according to Dragos.
• Industrial organizations now allocate about 7% of IT budgets to cybersecurity, up from 6%, but spending smarter matters more than spending more.
• About 75% of attacks on manufacturing environments start in the IT layer, often at Purdue levels 4 and 5 or the level 3.5 convergence zone, and about 50% of OT systems are now connected to IT networks.
• The Akira ransomware group bypassed EDR by moving laterally to an unsecured Linux-based webcam and launching encryption from it.
• Microsegmentation stops that kind of attack by allowing only known-good communication, restricting new accounts through identity segmentation, and isolating devices like webcams behind just-in-time MFA.
• Zero Networks is fully automated and agentless, needs no professional services, and works across IT, OT, cloud, data center, and service accounts, helping teams protect legacy OT systems without ripping and replacing.

This webinar was recorded in 2025. Statistics cited reflect that time.

Why are OT environments increasingly targeted by ransomware?

[00:05] Bryan Ward, Customer Engineer, Zero Networks: I’m Bryan Ward, a customer engineer at Zero Networks. I’ve spent the last seven years focused specifically on microsegmentation and zero trust. Maybe I’m dating myself, but across 27 years in cybersecurity, I’ve worked in different positions, as a solution architect, director of security, field CTO, and CISO, always focused on reducing real-world risk with practical, scalable security. Today, we’ll dig into a growing issue that’s hitting industrial organizations particularly hard: OT cybersecurity, and more specifically, how modern microsegmentation can change the game when it comes to stopping threats before they spread.

[01:06] The numbers speak for themselves. In just the past year, ransomware attacks targeting industrial organizations increased by an alarming 87%. Even more concerning, Dragos found that the number of ransomware groups targeting OT and ICS environments grew by 60%. This surge isn’t random; it’s a trend. Attackers are shifting their focus toward industries like manufacturing because they see opportunity in outdated systems, complex environments, and historically lower levels of cybersecurity investment. IBM’s latest X-Force report states that manufacturing had the highest number of ransomware incidents in 2024, overtaking other sectors. And Dragos warns that OT is no longer a niche target; it’s becoming a prime focus for sophisticated threat actors. This is a call to action. These environments are critical to operations and to national infrastructure, and they’re now firmly in attackers’ crosshairs.

How are industrial organizations investing in cybersecurity?

[02:06] So how are organizations responding? We’re seeing a clear shift in cybersecurity investment. Industrial organizations now allocate 7% of their total IT budgets to cybersecurity, up from 6% just last year. That may seem incremental, but it reflects growing awareness of the challenges of securing both IT and OT systems as threats evolve and become more complex, especially in converged environments. Security budgets are slowly catching up. But here’s the challenge: it’s not just about spending more, it’s about spending smarter. We need solutions that adapt to complex environments and deliver meaningful security without massive, multi-year projects.

What makes OT environments so hard to secure?

[03:12] Let’s break down some of the underlying challenges that make OT environments so difficult to secure. First, compromised credentials now account for 80% of web application breaches, and we’ve seen a 71% increase in credential-related attacks year over year. Why? Quite honestly, because it’s easy. Attackers don’t need to break in if they can log in with valid credentials.

[03:43] Second, attackers are starting in IT. About 75% of attacks on manufacturing environments originate in the IT layer, often at levels 4 or 5 of the Purdue model, or in the level 3.5 convergence zone where IT and OT systems meet. That’s where visibility is lowest and controls are often weakest. Third, convergence is accelerating. Today, about 50% of OT systems are connected to IT networks, and by next year, that number is expected to reach 70%. That’s a massive increase in exposure, and it means the traditional boundaries we used to rely on are disappearing or becoming blurred.

How did the Akira ransomware group bypass EDR through a webcam?

[04:46] Let’s look at a real-world case that brings all of this together. The Akira ransomware group recently pulled off a clever but disturbing attack. They tried to deploy ransomware on Windows endpoints, but the organization had solid EDR protection. The attackers were using somewhat outdated malware that the EDR picked up, and it blocked the encryptor. So Akira pivoted. They discovered an unsecured Linux-based webcam on the same network that wasn’t protected by any controls. Through it, they bypassed the EDR entirely and successfully launched their encryption payload.

[05:17] This is what modern ransomware looks like. Attackers don’t just hit the obvious targets. They look for weak links, moving around the environment and doing reconnaissance, and if one wall goes up, they pivot to look for a weaker point. They escalate privileges, move laterally, disable defenses, and exfiltrate data using common tools like AnyDesk. Once they’ve mapped your environment through reconnaissance, it’s only a matter of time. And this highlights something critical: attackers aren’t just relying on brute force, as we’ve seen in previous years. They’re using your own infrastructure against you.

[06:21] So while OT and IoT systems weren’t the initial point of access, they were a key vector in this attack after the ransomware group moved laterally from the IT network. The attack chain started with initial access, exploiting exposed remote access solutions like VPNs. Then came privilege escalation and lateral movement, using various tools to move around and do reconnaissance. The attackers got creative in bypassing EDR, in this case with an unsecured webcam running a Linux-based OS. They stole sensitive data from sources like OneDrive, file servers, and applications, using the remote desktop software AnyDesk for remote access. And then they encrypted, deploying ransomware from the webcam to encrypt files across the network and bypass EDR protections.

Why does the attacker playbook keep succeeding?

[07:26] Regardless of where they gain access, we know attackers generally follow the same playbook. They find a way in through any of a variety of vulnerabilities, phishing, or other means. Once in, they can typically move undetected through a wide-open internal network, and then either ransom every machine or carry out a more targeted attack on sensitive assets. Most organizations have extensive detection and response measures in place, yet this playbook keeps succeeding. Why?

[07:57] MITRE now believes the root of the problem is the open network. As a result of its own breach last year, MITRE now recommends that organizations focus on segmentation as a top strategy. Before that breach, MITRE was heavily focused on detection and response, not preventive measures. The problem is that segmentation to any adequate level of maturity is incredibly challenging. But there’s good news: we can stop this.

How does microsegmentation break the attack chain?

[08:27] The tools are available, with microsegmentation that actually works. By works, I mean practical to deploy, adaptive, enforceable, and easy to operationalize. That’s how we break the attack chain. When communication is restricted to only what’s necessary and known good, attackers can’t move; they’re stuck. Microsegmentation turns your network into a maze. Even if attackers get in, they can’t see or reach anything else, so it becomes very hard for them to move laterally further into the network and reach the crown jewels they want to encrypt, or the data they want to exfiltrate. It’s containment at scale, and it fundamentally changes the outcome of an attack.

How would Zero Networks have stopped the Akira attack?

[09:29] If we go back to the Akira example, here’s how it would have played out differently with Zero Networks in place. First, remote access like VPNs would be controlled: only explicit, authorized, and validated connections would be allowed through dynamic policy creation. Second, lateral movement would be blocked by policy. Even if attackers created a new domain account, it wouldn’t have access beyond what’s needed in the environment. And third, the unsecured webcam would be isolated and protected with just-in-time MFA. Just because a device is on the network doesn’t mean it can talk to everything, and it shouldn’t. The ransomware wouldn’t have had a chance to spread. The attacker would have been contained at the very first step, and would probably have left the company for an easier target.

[10:36] That’s the power of the Zero Networks approach. In a traditional network, one compromised asset can take down the entire domain: the whole corporate network, or the OT and IoT environment. With Zero Networks in place, compromise doesn’t mean breach. Even if a device is compromised, the attacker has no path forward: no command and control, no lateral movement, no exfiltration. One compromised can mean none compromised, and that’s the outcome we want.

How is Zero Networks different from legacy segmentation?

[11:08] Let’s talk briefly about how we do it. Legacy segmentation approaches often require agents, massive services engagements, manually tagging and labeling the environment, and months, sometimes years, of rollout. Many customers have told me they started a microsegmentation project with a legacy vendor and, after a year or two, never got a very small number of assets into segmentation. That leads to siloed controls, high costs, and limited success.

[12:14] Zero Networks takes a different approach. We’re fully automated and agentless, with no professional services required, and we work across IT, OT, cloud, the data center, and even service accounts and web applications. You get full segmentation that’s practical, scalable, and fast to deploy. It’s modern security for the environments we actually operate in today.

What outcomes can industrial organizations expect?

[12:47] Our goal as an organization is simple. We want to help you do three things: reduce risk, improve resource and cost efficiency, and enable the business. To reduce risk, we deliver automated microsegmentation at scale, so attackers can’t move in your network, and automated least privilege at scale, with MFA on every privileged port. That means closing the ports attackers commonly use to move laterally, exfiltrate data, and gain access to your environment, and putting just-in-time MFA in front of them to add another layer of authentication. That locks down the domain controller threat vector, stops ransomware, and reduces reliance on vulnerability management and EDR.

[13:17] For resource and cost efficiency, holistic microsegmentation can be done in 30 days, with very fast time to value and a hands-off implementation based on policy automation and automated tagging and labeling within your infrastructure. Automation lowers the risk of human error to next to nothing, removes the need for 24/7 availability to manage the environment, and reduces security operating costs, which helps enable your business.

[14:21] We’ve helped industrial organizations of all sizes deploy segmentation successfully, often in a matter of weeks, not months or years. Whether you’re looking to protect legacy OT systems, cloud workloads, or high-risk service accounts, our approach adapts to your environment without requiring you to rip and replace what you already have. And because it’s agentless and automated, it fits even the most constrained or sensitive environments. So you can limit the blast radius, app owners can move faster to meet the demands of the business, and you can eliminate the risk of downtime due to security issues. Thank you. That’s all I have for the presentation.