This article identifies and evaluates real-world environments that function as Operational Technology (OT) systems but are typically treated as standard IT infrastructure. It outlines the cyber-physical risks of this misclassification and calls for a shift in risk posture, governance, and tooling to reflect the real operational realities of these spaces.

Contents

Introduction

While Operational Technology (OT) has traditionally been associated with manufacturing lines, utilities, and industrial control systems, its core principles—real-time control, physical impact, and safety-critical operations—are increasingly present in other domains. However, many of these environments remain misclassified as IT simply because they involve computers, networks, or screens. This is a mistake.

As digital transformation pushes embedded control systems into everything from hospitals to smart buildings, we are faced with a new category of cyber-physical environments that operate like OT, but are governed like IT. This misalignment leads to poor risk modelling, inappropriate controls, and an underprepared incident response.

Below is a curated list of environments that exhibit OT-like characteristics but are typically managed as IT assets, despite their real-world impact.

1. Broadcast Studios and Media Production Facilities

• Why OT-like: Live editing rigs, AV switchers, audio mixers, robotic cameras, and signal chains are latency-sensitive and safety-critical (in terms of broadcast continuity).
• Risks: Signal manipulation, timing attacks, ransomware on production machines during live events.
• Reality: Often treated as just “high-performance desktops,” despite requiring OT-like resilience and control.

2. Building Management Systems (BMS) and Smart Buildings

• Why OT-like: Control HVAC, lighting, lifts, security systems, and fire suppression—all in real time.
• Risks: Attackers can manipulate temperatures, disable alarms, or cause physical disruption.
• Reality: Managed by facilities teams, rarely monitored by security ops. Often on flat networks with default credentials.

3. Universities and Research Labs

• Why OT-like: Scientific equipment (e.g. electron microscopes, gene sequencers, laser arrays) runs on bespoke systems with uptime and calibration as core requirements.
• Risks: Data integrity, safety of physical experiments, and IP theft.
• Reality: Security seen as a barrier to experimentation, with weak enforcement across decentralised departments.

4. Retail Point-of-Sale and In-store Systems

• Why OT-like: POS terminals, barcode scanners, inventory sensors, and connected payment systems behave like OT—critical to business operation and interfacing with the physical world.
• Risks: POS malware, payment card theft, denial-of-service at tills.
• Reality: Often bundled into IT helpdesk support, not treated as part of critical infrastructure.

5. Transport Hubs: Airports, Rail Terminals, Ports

• Why OT-like: Gate control systems, baggage handling, signalling equipment, ticketing infrastructure, and CCTV are all interdependent and safety-critical.
• Risks: Cascading delays, sabotage, and public safety incidents.
• Reality: Managed in fragmented ways—operations handle one part, IT another. Cybersecurity sometimes seen as secondary to logistics.

6. Logistics and Warehousing

• Why OT-like: Conveyor belts, automated picking robots, inventory control, loading dock systems.
• Risks: Operational halts, incorrect fulfilment, lost goods.
• Reality: Often bundled under “smart warehouse” initiatives, but without OT-grade security models.

7. Theme Parks and Entertainment Venues

• Why OT-like: Ride control systems, animatronics, ticketing turnstiles, crowd management tools.
• Risks: Safety compromise, operational disruption, targeted sabotage.
• Reality: Managed like facilities IT with minimal security-by-design, despite direct interaction with the public.

8. Banking ATMs and Physical Financial Infrastructure

• Why OT-like: ATMs are embedded devices with physical interfaces, often running legacy OSes connected to backend banking systems.
• Risks: Jackpotting, data exfiltration, service disruption.
• Reality: Still governed by IT security teams, though the operational risks resemble OT.

9. Cinemas and Theatres (Live or Digital)

• Why OT-like: Projector control, lighting boards, stage machinery, and AV synchronisation are all tightly coordinated in real time.
• Risks: Show disruptions, copyright misuse, or timing failures.
• Reality: Operated by production staff with little cybersecurity oversight.

10. Agricultural Tech (AgriTech) and Precision Farming

• Why OT-like: Automated irrigation, GPS-guided tractors, drone systems, and soil sensors.
• Risks: Crop sabotage, sensor jamming, GPS spoofing.
• Reality: Often seen as just “rural tech” rather than high-stakes OT systems.

11. Military Theatres, Battlefield Tech, and Drone Systems

• Why OT-like: Real-time command systems, drones, targeting platforms, and embedded mission-critical devices define the battlefield as a cyber-physical environment.
• Risks: Drone hijacking, fire control disruption, compromised logistics, mission failure, and kinetic harm from cyber compromise.
• Reality: Still treated under ICT compliance regimes, despite behaving like high-stakes, embedded OT systems with real-world consequences.

12. Humanitarian Crisis Zones and Disaster Response Infrastructure

• Why OT-like: Mobile water, power, and medical systems rely on real-time sensors, drones, and comms in harsh conditions, and availability is critical.
• Risks: Disrupted aid, supply chain failure, misinformation, or physical harm from system outages in volatile environments.
• Reality: Often improvised, with security sidelined; treated as short-term IT setups rather than critical OT deployments in the field.

13. Railways, Tracks, and Signalling Infrastructure

• Why OT-like: Real-time signalling, track switches, interlocking systems, and station automation operate as tightly-coupled control networks.
• Risks: Service disruption, collision, routing manipulation, or denial-of-service attacks on signalling nodes.
• Reality: Core signalling is treated as OT, but many digital systems (passenger info, station control, diagnostics) are mismanaged as basic IT.

14. Smart Grid Components (Distribution, Not Generation)

• Why OT-like: Smart meters, substation automation, and load balancing tech use sensors and real-time control to manage demand and grid health.
• Risks: Manipulated consumption data, localised blackouts, or exploitation of demand-response signals.
• Reality: Often governed by IT teams or third-party vendors, with inadequate segmentation from core OT.

15. Water Distribution & Remote Pumping Systems

• Why OT-like: Pumps, valves, and flow regulators are driven by SCADA systems and telemetry, vital for safe water delivery and pressure regulation.
• Risks: Water contamination, overflows, or pressure loss caused by remote compromise or lateral access.
• Reality: Core SCADA is often OT-governed, but remote field systems (e.g. over cellular or satellite) lack proper OT security oversight.

16. Telecoms Exchange Hardware and Cell Towers

• Why OT-like: Baseband units, switching hardware, and microwave relay systems rely on embedded control, timing, and real-time communication.
• Risks: Signal hijack, traffic rerouting, service blackouts, or passive surveillance through compromised hardware.
• Reality: Handled by telecoms engineers with IT-style governance models; core OT risks poorly integrated into national cyber planning.

Common Traits Across These OT-like Environments

• Long-lived assets (10–30 years lifespan)
• Availability and uptime are prioritised over confidentiality
• Custom software and legacy operating systems
• Weak or non-existent patch management
• Disconnected from central IT governance

Table of OT Comparative Environments

Environment	OT-Likeness (1–10)	Key OT Characteristics Present	Common Misclassification
Medical Theatres & Hospitals	10	Cyber-physical, real-time, safety-critical, legacy systems	Treated as standard IT by CIO and InfoSec teams
Building Management Systems (BMS)	9	Embedded control, environmental impact, legacy protocols	Managed by facilities, rarely integrated into IT security
Broadcast & Media Studios	8	Real-time control, AV synchronisation, fragile signal chains	Treated as creative workstations, not industrial systems
Research Labs & University Equipment	8	Long-lifecycle assets, embedded software, precision control	Academic freedom model, not secured or inventoried properly
Smart Warehousing & Logistics	8	Conveyor belts, automation, low-latency coordination	Treated as inventory software, not industrial infrastructure
Airports & Transport Terminals	9	Gate systems, signalling, CCTV, physical process coupling	Fragmented ops ownership, security overlooked
Theme Parks & Public Venues	7	Ride control, stage tech, robotic systems	Managed as entertainment tech rather than critical systems
Retail POS and In-Store Systems	7	Payment control, physical interaction, business continuity dependency	Bundled under IT helpdesk or outsourced vendors
Cinemas & Digital Theatres	6	Projectors, timing, automation	Seen as simple AV setups
AgriTech & Precision Farming	7	Sensor networks, real-world actuation, GPS-guided systems	Seen as rural IoT rather than safety-critical OT
ATMs and Banking Terminals	7	Embedded control, public access, payment security	Lumped under finance IT governance
Military Theatres & Battlefield Tech	10	Real-time control, embedded systems, kinetic consequences	Treated under ICT compliance, not OT mission systems
Humanitarian Crisis & Disaster Infrastructure	8	Mobile sensors, drones, power/water systems, uptime-critical	Seen as temporary IT, not critical OT field systems
Railways & Signalling Systems	9	Real-time control, embedded systems, safety-critical	Embedded control, public access, and payment security
Smart Grid Components (Distribution)	9	Real-time load balancing, remote telemetry, embedded control	Treated as IT-managed smart devices, not critical OT layers
Water Distribution & Pumping Systems	9	SCADA-driven flow control, remote access, field automation	Remote sites often insecure; treated as low-priority IT
Telecoms Exchange & Cell Infrastructure	8	Embedded hardware, low-latency systems, physical effect	Governed by IT ops, not treated as critical OT

Conclusion

Misclassifying OT environments as IT isn’t just a taxonomical error, it has real-world consequences. From safety risks and downtime to regulatory non-compliance and patient harm, the impact of applying the wrong security model can be severe.

A more mature risk posture means recognising when environments require OT-style thinking: uptime-first, fail-safe design, layered isolation, and risk assessments rooted in physical impact. It’s time to bridge the governance gap, equip cyber teams with domain-specific OT knowledge, and rethink how we secure the edge, because increasingly, the edge is not a laptop; it’s a life-critical system quietly doing its job in a theatre, terminal, or test lab.