For most of their history, IT and OT had little reason to talk. IT departments ran email, finance systems and websites, and their security teams focused on protecting data. Operational technology belonged to engineering: control systems, safety systems and plant networks run by people trained in process control, electrical engineering and instrumentation. The two worlds used different vendors, different protocols and different budgets.
Why Did IT and OT Security Teams Develop Separately?
Their cultures diverged too. IT teams are used to frequent change: monthly patch cycles, regular software releases and systems replaced every few years. OT teams value stability above almost everything else, because a plant that runs reliably is a plant that runs safely. A change that IT would treat as routine maintenance can look to an OT engineer like an unnecessary risk to production.
Convergence has removed the physical separation but not the organisational one. Plant networks now connect to corporate systems, cloud platforms and remote vendors, yet many organisations still have two teams with separate reporting lines and little shared language. Organisations reviewing the OT security companies UAE operators work with often find the same split among providers, with some strong on IT and others on industrial systems, which is why the ability to work across both has become a selection criterion in its own right.
Where Do IT and OT Objectives Genuinely Conflict?
Some friction between the teams comes from misunderstanding, but some reflects real differences in priorities. The most common points of conflict are:
- Patching, where IT expects fast updates and OT must wait for vendor approval and scheduled shutdowns
- Continuous operation, where OT measures success by how long the process runs without stopping and IT accepts planned outages for maintenance
- Scanning and testing, where IT tools that are safe on office networks can disrupt controllers
- Change control, where OT requires engineering sign-off and IT works to faster release cycles
- Incident response, where IT may isolate a compromised system immediately and OT must first confirm the process stays safe
- Budget ownership, where security spending on plant networks can fall between the two departments
None of these conflicts has a single right answer. Each needs an agreed rule that both teams accept, written down before an incident forces a decision under pressure.
Which Operating Models Actually Work?
Organisations have tried several ways of bringing the teams together, and three models appear most often.
The first places OT security under the chief information security officer, with dedicated OT specialists inside the security team. This creates one line of accountability for cyber risk and lets the organisation use shared tools such as a single security operations centre. Its weakness is that OT specialists can end up outnumbered and overruled if the security function treats industrial systems as just another network.
The second keeps OT security inside engineering or operations, with a dotted line to the CISO for policy and reporting. Engineers keep control over decisions that affect production, which builds trust on the plant floor. The risk is inconsistent standards and weak visibility for the board.
The third is a joint team, sometimes called an OT security centre of excellence, staffed by people from both sides with a shared charter and shared metrics. It takes more effort to set up, but it builds the common language that the other models often lack. Many organisations combine elements of all three, placing accountability with the CISO while giving engineering a formal veto over changes that could affect safety or production.
Whatever the structure, a few practices make it work. Cross-training helps IT analysts understand industrial protocols and helps engineers understand modern threats. Shared exercises, such as tabletop simulations of an attack that crosses from IT into OT, show both teams where their assumptions differ. Shared metrics, such as time to detect activity at the IT and OT boundary, give both sides a common goal.
Who Should Own the Boundary Between IT and OT?
The boundary is where convergence creates the most risk and where silos do the most damage. It includes the industrial demilitarised zone, the firewalls between corporate and control networks, remote access gateways and the historians and engineering workstations that sit between the two worlds.
Responsibility for OT security is shifting quickly. Fortinet’s 2025 State of Operational Technology and Cybersecurity Report, based on a survey of more than 550 OT professionals, found that 52% of organisations now say the CISO or chief security officer is responsible for OT, up from 16% in 2022, and 80% plan to move OT security under the CISO within a year. The same report found that only 30% of organisations claimed full visibility of their OT assets, down from 61% in 2022.
Those figures suggest that moving accountability to the CISO does not by itself fix visibility. The most effective arrangement gives the boundary a named owner with authority over the rules between IT and OT, backed by a joint review process in which engineering can block changes that threaten safety. Neither team can secure the boundary alone, because each understands only half of what crosses it.
Frequently Asked Questions
Why do IT and OT teams struggle to work together?
They grew up with different priorities. IT focuses on confidentiality and fast change, while OT prioritises safety, availability and stability.
Should the CISO be responsible for OT security?
A growing majority of organisations think so, but the CISO needs OT specialists and engineering input to make good decisions about industrial systems.
What is an OT security centre of excellence?
A joint team of IT security and OT engineering staff with a shared charter, metrics and authority over OT security standards.
How can organisations start bridging IT and OT teams?
Begin with a shared asset inventory, a joint tabletop exercise and agreed rules for patching, testing and incident response at the boundary.
