How to Govern 40 Isolated OT Tenants Centrally

Your identity governance model works perfectly for IT. Point it at OT, and it can shut down a pipeline, crash a controller, or worse — because the two environments don't just need different tools, they need opposite priorities. Antivirus, vulnerability scanners, centralized identity — everything you'd normally do to secure a system is exactly what breaks an OT environment. This episode is why the IT playbook fails here, and what actually works instead. In this episode, Ernie and Josée trace why active defense is physically impossible in industrial environments — endpoint agents introduce latency that can throw a chemical process out of tolerance, and standard vulnerability scanners can crash a legacy controller's network interface outright. With detection off the table, the only real option is passive visibility and rigid isolation instead. We walk through the 40-tenant silo model: completely separate identity environments per facility, with zero trust relationships between them, connected back to headquarters only through outbound-only sync agents so a compromise in one facility can never become a master key into the rest. We close on the hardest tension in the entire model — how to keep zero standing privilege everywhere, while still guaranteeing an engineer can act immediately during a 2 a.m. physical emergency. You'll leave knowing exactly why IT security instincts fail in industrial environments, and the architecture that actually holds up in their place. If you're responsible for identity in an OT or critical infrastructure environment, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott