OT Remote Access Security Explained: Why 88% of Manufacturers Let Third-Party Vendors Into Their Networks (and How to Do It Safely in 2026)

Diagram contrasting a generic VPN granting flat, standing vendor access directly into an OT network with a purpose-built secure remote access platform that gates the same connection through identity verification, time-bound sessions, and session recording.

OT remote access security is the set of controls — identity-based authentication, time-bound session limits, session recording, and centralized monitoring — that govern how outside vendors, OEM technicians, and system integrators connect into an operational technology network, as opposed to a flat corporate VPN or a shared TeamViewer/RDP login that was never designed for industrial control system exposure. A 2025 vendor-sponsored survey found 88% of manufacturers already allow this kind of third-party remote access into their OT environments, and Gartner formalized the distinction in 2026 with a dedicated analyst category — the Market Guide for CPS (Cyber-Physical Systems) Secure Remote Access — that treats purpose-built OT remote access platforms as a genuinely different product category from generic IT VPNs. The risk isn't hypothetical: the 2021 Oldsmar, Florida water treatment plant intrusion happened through exactly the kind of unmanaged remote access this article is about. This piece walks through what separates a secure setup from an exposed one, and where it fits next to the other controls in this cluster.

By The Whitepaper Skeptic — OT security architecture reviews of vendor remote-access gaps

Quick Facts

Question	Answer
What is OT remote access security?	Purpose-built controls (identity-based access, time-bound sessions, session recording, centralized monitoring) for managing how outside vendors and engineers connect into OT/ICS networks — structurally different from a generic corporate VPN
What share of manufacturers allow third-party remote access into OT?	88%, per a 2025 study commissioned by OT remote-access vendor Cyolo and conducted by Takepoint Research — a vendor-sponsored survey, not independent research
How is a secure remote access (SRA) platform different from a VPN?	A VPN grants flat, standing network-level access; an SRA platform grants identity-verified, time-bound, recorded access scoped to a specific asset or task
What is Gartner's 2026 "Market Guide for CPS Secure Remote Access"?	A new analyst category formally distinguishing OT-specific secure remote access platforms from generic IT VPNs — a Market Guide, which describes a market category, not a ranked comparison like a Magic Quadrant
What's a documented real-world example of a remote-access-caused OT breach?	The February 2021 Oldsmar, Florida water treatment plant intrusion — attacker entered via TeamViewer using a shared password with no perimeter firewall (CISA advisory AA21-042A)

What "OT Remote Access Security" Actually Means

Every OT environment has to let someone in from outside eventually — a boiler OEM's technician needs to check a PLC after an alarm, a systems integrator needs to push a firmware update, a machine builder's support engineer needs to troubleshoot a fault the plant's own staff can't diagnose. The question isn't whether that access happens; it's how it's granted, scoped, and recorded.

"OT remote access security" describes the layer of controls purpose-built to answer that question for industrial environments specifically — as distinct from the general-purpose remote access tooling (VPNs, RDP, TeamViewer, AnyDesk) that IT teams have used for decades and that most manufacturers still default to for OT because it's already deployed and familiar. That default is exactly what's changed as a live buying decision: Gartner's 2026 Market Guide for CPS Secure Remote Access exists because enough vendors now build platforms — Cyolo, Xage Fabric, Claroty's SRA module, and Dispel among them — specifically for this problem, and enough buyers are actively evaluating whether to replace VPN/RDP-based vendor access with one of them.

Why Third-Party Access Is OT's Biggest Attack Surface

The access path into most OT networks isn't an employee credential — it's a vendor, OEM, or integrator account. A 2025 survey commissioned by Cyolo and conducted by Takepoint Research (535 qualified respondents, including CISOs, across North America and EMEA) — worth reading as vendor-sponsored market research aimed at making the case for its own product category, not as independent third-party research — found that 88% of manufacturers allow remote third-party access into their OT environments and that 60% grant that access to more than 100 distinct external parties.

A separate report — Marlink's 2026 Cyber Intelligence Report for Remote Operations — found that more than half of organizations rely on third-party remote access that isn't centrally monitored, that roughly 69% of remote-operations risk ties back to compromised credentials, that 30-40% of OT assets are initially unknown to the organizations running them, that fewer than a quarter of sites have clearly assigned OT security ownership, that around 60% run shared IT/OT infrastructure, and that more than 70% have undocumented external connections. Even without pinning down the last decimal point, the pattern both reports describe is consistent: the access path most OT security programs struggle to see and control is the one coming from outside the organization, not the one coming from an employee badge.

Secure Remote Access (SRA) vs. a Flat VPN or Shared RDP Login

The practical difference between a purpose-built OT secure remote access platform and a generic VPN or shared TeamViewer/RDP credential comes down to what gets verified and recorded at each connection, not whether a connection is technically possible.

Control	Flat VPN / shared RDP or TeamViewer login	Purpose-built OT SRA platform
Identity verification	Often a shared account or credential used by multiple people at the vendor	Individual, identity-verified login tied to a named person, typically with MFA
Access scope	Network-level — once connected, the session can often reach far more of the network than the task requires	Task-scoped — access limited to the specific asset, application, or session the work actually requires
Session duration	Standing access — the credential frequently stays valid indefinitely after the job is done	Time-bound — access expires automatically at the end of the approved session window
Session visibility	Rarely logged in detail; often no live view of what the remote user actually did	Session recording and, in many platforms, live monitoring of the connection
Centralized oversight	Often managed ad hoc per vendor relationship, with no single inventory of who has access	Centralized policy and audit trail across all third-party connections

The four controls in that right-hand column — identity-based access, time-bound sessions, session recording, and centralized monitoring — are the practical answer to "how do you do OT remote access safely in 2026." None of them require exotic technology; they require replacing standing, shared, unscoped access with access that's granted per task and expires when the task is done.

Gartner's 2026 Market Guide for CPS Secure Remote Access, Explained Plainly

In 2026, Gartner published a Market Guide for CPS (Cyber-Physical Systems) Secure Remote Access — a dedicated analyst category that formally separates purpose-built OT/ICS remote access platforms from both generic IT VPN tooling and, notably, from OT threat detection and monitoring platforms (the category covered in this cluster's OT Security Vendor Comparison spoke on Dragos, Claroty, and Nozomi Networks). The report — published February 3, 2026 and authored by Katell Thielemann, Wam Voster, and Sumit Rajput — defines the market as products that "enable employees, contractors, or original equipment manufacturers (OEMs) to safely and securely operate, maintain, or update CPS remotely," and Gartner maintains a corresponding "Cyber-Physical Systems Secure Remote Access Solutions" market category on its own Peer Insights platform. Gartner naming a "CPS Secure Remote Access" category at all is itself the useful signal for buyers: it confirms that analysts now treat OT-specific SRA as a genuinely distinct purchase decision from either "buy an OT VPN" or "buy an OT detection platform."

One clarification matters for anyone using this to shortlist vendors: a Gartner Market Guide is explicitly not a ranking format — it's a category-definition document that lists "Representative Vendors" without scoring or ranking them, unlike a Magic Quadrant. Cyolo, Xage Security, Claroty, and Dispel have each separately publicized their own inclusion as a Representative Vendor in the 2026 guide, which is the best available confirmation of the vendor list short of a paid Gartner subscription — each vendor's claim is corroborated independently by the others rather than resting on a single company's say-so.

What Goes Wrong: The Oldsmar, Florida Water Treatment Plant (2021)

The clearest documented case of unmanaged remote access causing an OT incident is the February 2021 intrusion at a water treatment facility in Oldsmar, Florida. Per CISA advisory AA21-042A, an attacker gained access to the plant's control system through TeamViewer — remote-access software that multiple facility computers shared using the same password, with no firewall protecting the perimeter. Once inside, the attacker briefly increased the sodium hydroxide (lye) setpoint from its normal level toward a dangerous concentration; a plant operator watching the screen in real time saw the unauthorized change happen and reverted it before it reached the water supply.

Oldsmar is worth studying closely because nothing about the attack was technically sophisticated — no zero-day, no custom malware, no supply-chain compromise. The access path was a shared remote-desktop credential with no perimeter control, which is precisely the "flat VPN / shared RDP or TeamViewer login" column in the comparison table above. An identity-verified, time-bound, recorded SRA session would have made this specific intrusion path meaningfully harder to exploit, and would have surfaced the unauthorized session to a monitoring system rather than relying on an operator happening to be watching the right screen at the right moment.

Colonial Pipeline (2021) is sometimes cited alongside Oldsmar as a second example of remote-access-related compromise. Per CEO Joseph Blount's June 2021 testimony to Congress, attackers are believed to have gained access using a compromised password for a legacy VPN account that was no longer intended for use but had never been deactivated; the account had only single-factor authentication, with no MFA in place.

Where This Fits in the OT Security Stack

This is a companion piece to two other spokes in this cluster, and it's worth being explicit about how it's different from each. Zero Trust for OT Industrial Networks covers zero trust as the architectural philosophy — never trust, always verify, for every connection regardless of network location. This article covers the specific control that operationalizes that philosophy for the third-party access path: a purpose-built SRA platform is what "never trust, always verify" actually looks like when a boiler OEM's technician needs 20 minutes of PLC access twice a year, instead of a permanent VPN credential that sits active for years between visits.

The OT Security Vendor Comparison spoke covers a different buying category entirely — Dragos, Claroty, and Nozomi Networks in that piece are primarily threat detection and monitoring platforms, watching network traffic for anomalies after something is already on the wire. An SRA platform's job is upstream of that: controlling whether and how an outside party gets onto the network in the first place. Gartner's decision to create a separate Market Guide for CPS Secure Remote Access, rather than folding it into its OT detection/monitoring coverage, reflects that these are genuinely different product categories, not overlapping marketing terms for the same thing.

Two more pieces in this cluster are worth reading alongside this one: OT Asset Management covers the prerequisite problem — an SRA platform can only scope access to known assets, and an accurate inventory is what makes that scoping possible in the first place. IEC 62443 Zones and Conduits covers the network segmentation design that determines where a remote-access session can actually terminate once it's authenticated — the two controls are meant to work together, not substitute for each other.

FAQ

Q: What is OT remote access security?
A: OT remote access security is the set of purpose-built controls — identity-verified logins, time-bound session limits, session recording, and centralized monitoring — used to manage how outside vendors, OEM technicians, and system integrators connect into an operational technology or industrial control system network, as distinct from a generic corporate VPN or shared remote-desktop credential.

Q: How is OT secure remote access different from a regular VPN?
A: A flat VPN or shared RDP/TeamViewer login typically grants broad, standing, network-level access tied to a shared credential. A purpose-built OT secure remote access (SRA) platform grants identity-verified access scoped to a specific asset or task, limited to a defined time window, and recorded for audit — reducing both the blast radius of a compromised credential and the time that access stays valid after the job is finished.

Q: What happened in the Oldsmar, Florida water treatment plant attack?
A: In February 2021, an attacker accessed the plant's control system through TeamViewer, which multiple facility computers shared using the same password with no perimeter firewall in place, per CISA advisory AA21-042A. The attacker briefly increased the sodium hydroxide setpoint toward a dangerous level before a plant operator, watching the screen in real time, reverted the change.

Q: What is Gartner's Market Guide for CPS Secure Remote Access?
A: It's a 2026 Gartner analyst report that formally defines OT/ICS-specific secure remote access as a distinct product category, separate from generic IT VPNs and from OT threat detection/monitoring platforms. A Market Guide lists "Representative Vendors" in a category but, unlike a Magic Quadrant, does not rank or score them — it should be read as a category-definition document, not a buyer's ranked shortlist.

Q: How many manufacturers allow third-party remote access into their OT networks?
A: A 2025 survey commissioned by OT remote-access vendor Cyolo and conducted by Takepoint Research found that 88% of manufacturers allow some form of remote third-party access into their OT environments, with 60% granting that access to more than 100 distinct external parties. Because the study is vendor-sponsored, treat it as directional market research rather than independent, peer-reviewed data.

Sources

Author Bio

The Whitepaper Skeptic has direct, customer-facing experience running OT security architecture reviews for industrial and smart-factory clients, where third-party vendor and OEM remote-access paths — not employee accounts — were consistently the largest uncontrolled attack surface found during the review, plus TCB/IR-preparation work assembling the kind of access-control documentation that regulators and cyber insurers now expect to see on paper.

Search This Blog

Beyond the Whitepaper