Industrial cybersecurity: zero trust in OT networks of Portuguese factories

In 2024, CERT.PT recorded 2,758 cybersecurity incidents in Portugal — a 36% increase over the previous year, with around 78% occurring in private entities (CNCS, 2024). A growing share of these incidents did not come through the office door: they came through the PLC on the cutting line, the SCADA of the finishing furnace or the weighing terminal in the warehouse. The thesis is straightforward — Zero Trust is not a corporate IT philosophy adapted to the factory. It is the only architecture that works when the OT network has equipment with 15-year-old unpatched firmware, industrial protocols without native authentication and an air gap that ceased to exist long ago. And the mistake we see repeated in factory after factory is neither lack of budget nor lack of will: it is starting with complete network segmentation when the most active attack vector — supplier remote access — could be controlled in six weeks, for a fraction of the cost.

The end of the air gap as a defence

The IT/OT convergence nobody planned

For decades, Portuguese industrial security rested on a simple premise: the production network was physically separated from the office network. The PLC of the knitting line in Guimarães did not talk to the email server. The SCADA of the plastic injection machine in Marinha Grande had no internet access. That separation — the so-called air gap — was real and it worked.

It stopped working when factories connected equipment to the ERP to feed real-time production dashboards. When maintenance technicians began accessing PLCs remotely over VPN. When machine suppliers demanded connectivity for predictive monitoring. When KORA Productivity began collecting OEE data directly from industrial terminals. The IT/OT convergence happened incrementally, project by project, without a security architecture to accompany it.

The exact moment when the air gap died is rarely documented. In a textile factory in the Vale do Ave, it was when the maintenance manager asked the supplier of the knitting machine to "check some parameters remotely" and the supplier installed a remote access client on a laptop that stayed connected to the line's switch. Nobody logged it. Nobody revoked the access when the project ended. That access still exists today — in more factories than any operations director cares to admit.

The air gap died when the first maintenance technician connected a personal laptop to the line's switch to "check some logs". It happened in every factory. Nobody logged the moment.

What NIS2 changes for Portuguese industry

The NIS2 Directive (Directive (EU) 2022/2555), transposed in Portugal by Decree-Law No. 125/2025, extends cybersecurity obligations to medium and large companies in 18 critical sectors, including manufacturing. A textile company in the Vale do Ave with more than 50 employees and turnover above 10 million euros may already fall within the scope of the directive. The obligations include risk management, business continuity, supply chain security and incident notification within 24 hours.

The article NIS2 in the Portuguese factory: from diagnosis to technical plan details the scope assessment process. What matters here: NIS2 requires technical controls over OT networks that the traditional perimeter security model cannot demonstrate. Zero Trust is the architectural answer — and the documentation it produces is simultaneously the compliance report.

The specific threat profile of Portuguese industrial SMEs

The Verizon DBIR 2025 documents that ransomware was present in 88% of data breaches in small and medium-sized enterprises, versus 39% in large organisations. SMEs are the disproportionate target: they hold valuable assets — industrial property, international customer portfolios, production data — but their security investment is far lower than that of large companies. A footwear factory in Felgueiras with German and Scandinavian buyers has data that is of interest to threat actors. This is not paranoia; it is the documented profile.

In Portuguese industrial practice, the most common attack vectors on OT networks are machine supplier remote access without MFA and without session segmentation, equipment with outdated firmware that does not support modern security agents, legacy industrial protocols (Modbus, Profibus, OPC-DA) without authentication or encryption, lateral movement from the IT network (compromised email → ERP → OT network), and USB devices introduced by operators or external technicians. Of these five, the first is the most exploited and the fastest to control. That is where you begin.

Zero Trust architecture in an OT context: what is different

The three principles and what they mean on a production line

Zero Trust rests on three principles: verify explicitly, use least-privilege access, assume breach. In the corporate IT context, these principles translate into MFA, conditional access policies and network microsegmentation. In the OT context, the application is more complex — and this is where most projects fail.

Verifying explicitly in an OT network means authenticating not only users but also devices. A Siemens S7-1500 PLC has device identity; an analogue temperature sensor from the 1990s does not. The architecture has to accommodate both — which implies different strategies for each category, not a single policy applied uniformly.

Least privilege means that the maintenance technician who remotely accesses the SCADA of line 3 should not be able to see line 7 or the quality data. It means that the ERP that reads production data should not be able to write machine parameters. Each data flow has to be explicitly authorised — and the list of legitimate flows in an average factory is shorter than it seems once you do the exercise of documenting it.

Assume breach is the hardest principle to sell internally, because it implies admitting that the architecture is designed to contain the impact of a compromise — not merely to prevent it. In a factory, this translates into segmentation by production cell, traffic anomaly detection and continuity plans that allow a line to be isolated without stopping the entire factory. It is a change of mindset, not just of technology.

The Purdue Model and its current limitation

The reference model for industrial network architecture is the Purdue Model (ISA-99/IEC 62443). It defines five levels — from the sensor/actuator (level 0) to the ERP and management systems (level 4/5) — with security zones between them. For years it was the de facto standard, and it remains the common vocabulary between automation engineers and security specialists.

The problem is structural: the Purdue Model was designed for a world with an air gap. When connectivity exists between levels — and today it always does — the perimeter model associated with it is insufficient. Zero Trust does not replace the Purdue Model; it complements it, adding continuous verification within each zone and in the flows between zones. Anyone trying to choose between the two is asking the wrong question.

Technical components of a Zero Trust OT architecture

The order below is also the recommended sequence of implementation. It is not arbitrary: each phase reduces risk and creates the technical basis for the next.

1. OT asset inventory and classification: identify all devices on the industrial network, their firmware, protocols and criticality. Without a complete inventory, there is no Zero Trust — there is the illusion of Zero Trust.
2. Network segmentation by zones and conduits (IEC 62443): physically or logically (VLANs + industrial firewalls) separate the production cells, the supervision network (SCADA/HMI) and the IT network. Each boundary has an explicit control point.
3. Identity and Access Management (IAM) for OT: strong authentication for all human access (MFA), including remote supplier access. Privileged Access Management (PAM) for control system administration accounts.
4. Microsegmentation and east-west flow control: within each zone, limit communication between devices to strictly what is necessary. An HMI that communicates with three PLCs should not be able to communicate with the remaining twelve.
5. Passive OT traffic monitoring: anomaly detection tools specific to industrial protocols (Claroty, Dragos, Nozomi Networks). Passive because active inspection assets can interfere with critical equipment in operation.
6. Secure remote access management: replace generic VPNs with OT-aware remote access solutions with session recording, per-session authorisation and automatic expiry.
7. Patch management and vulnerability management: inventory of applicable CVEs, compensating mitigation plan for equipment that cannot be patched — isolation, reinforced monitoring, communications whitelist.

Real technical options: a comparison of approaches

Physical vs. logical vs. software-defined segmentation

OT detection platforms: what to evaluate

Passive OT traffic monitoring is the component most frequently missing in Portuguese factories — and the one that most quickly detects lateral movement after a compromise. The main platforms (Claroty, Dragos, Nozomi Networks, Microsoft Defender for IoT) differ across three dimensions critical to the Portuguese industrial context.

The first is protocol coverage: support for Modbus, Profinet, EtherNet/IP, OPC-UA, BACnet. Older equipment in textile factories in the Vale do Ave frequently uses Modbus RTU over RS-485 — check support before starting any formal assessment, because discovering the gap after purchase is a problem with no quick solution. The second is the deployment model: on-premises versus cloud. Many factories with sensitive OT networks prefer on-premises by internal policy or by customer requirement — international clothing and footwear brands with supply chain security audits frequently require that production data does not leave the perimeter. The third is integration with SIEM/SOC: the platform has to export alerts to the corporate SIEM or to the security partner's SOC. An isolated OT tool that does not integrate with the IT security operation is not a solution — it is a blind spot with a screen.

Decision matrix: which approach for which factory size

What works in practice

Pattern 1: start with remote access, not with complete segmentation

The most common mistake we see in Portuguese factories is trying to implement Zero Trust "all at once" — redesigning the entire OT network in an 18-month project that never gets off the ground because the budget does not clear the October meeting and returns to the table in March, already in a different context. The pattern that works is different: start with the remote access of suppliers and external technicians, which is the most critical attack vector and the fastest to control.

A plastic injection factory in the Aveiro/Marinha Grande region can, in a first phase, implement only the replacement of generic VPNs with an OT-aware remote access solution — Claroty xDome Remote Access, Zscaler Private Access for OT, or equivalent — with mandatory MFA, session recording and per-session authorisation with automatic expiry. This phase is implemented in 6 to 8 weeks, does not interfere with production and eliminates the most exploited attack vector in industrial SMEs. Network segmentation comes in the following phase, with the operation already more secure and management already having evidence that the project is progressing.

Pattern 2: the inventory as a standalone project

No Portuguese factory with more than 10 years of activity has a complete and up-to-date inventory of its OT assets. This is not a criticism — it is an operational fact. Equipment accumulates, switches grow, PLCs are replaced without formal record, and the engineer who knew the topology of line 2 by heart left three years ago. Before any Zero Trust architecture, the inventory has to be done — and it can be done non-intrusively with passive discovery tools that do not disturb production.

The result of the inventory always surprises. It is common to find devices with network access that nobody knew existed, equipment with factory credentials (admin/admin), and open management protocols — Telnet, SNMPv1 — on equipment thought to be "secure" simply because it was "on the production network". There is a detail that manuals rarely mention: in factories with multiple line refits over the years, it is common to find unmanaged switches cascaded together that create network paths invisible to any monitoring tool that does not perform active discovery. Those paths are exactly where lateral movement happens undetected. This inventory is also the starting point for the NIS2 compliance report — see Industrial IT infrastructure: a guide for operations directors.

Pattern 3: separate the production data network from the control network

In a typical textile factory in the Vale do Ave with real-time production data collection, there is frequently an architectural confusion that no ERP project has resolved: the data collection terminals that feed KORA Productivity share the same network as the PLCs and control systems. This means that a vulnerability in the data terminal — which has internet access for synchronisation with the ERP — can be used as an entry point into the control network. It is not a theoretical vulnerability; it is the real topology of most factories that made the transition to real-time data collection without reviewing the network architecture.

The separation is conceptually simple: production data network (terminals, barcode readers, scales, printers) on one VLAN; control network (PLCs, HMIs, SCADA) on another VLAN; communication between the two only through an explicit control point with minimal firewall rules. In most cases, this separation does not require additional hardware — it requires configuration on the existing switches and the discipline not to create "temporary" exceptions that become permanent.

The most dangerous OT network is not the one with lots of old equipment. It is the one everyone thinks is secure because "we've never had any problems".

Operational trade-offs the manuals do not mention

The problem of the maintenance technician at 11pm

Zero Trust implies that every access is verified. In practice, this means that the maintenance technician who receives a call at 11pm to fix a breakdown on line 4 will have to go through an authentication and authorisation process before accessing the SCADA. If that process takes 10 minutes — because the PAM system is misconfigured, because the session approver does not respond, because MFA does not work without network coverage on the shop floor — Zero Trust will be circumvented. Always. The technician will connect directly to the PLC with the personal laptop he has in the van, because the line cannot be down until 7am.

The solution is not to eliminate the controls; it is to design them for the real operational context. This includes pre-authorisation of planned maintenance sessions, documented break-glass procedures for emergencies — with mandatory subsequent auditing, not optional — and adequate industrial WiFi network coverage so that MFA works throughout the factory, including in the corridor between line 3 and the electrical panel. A Zero Trust project that does not test these scenarios under real conditions before go-live will discover them in the worst possible way.

Legacy equipment without authentication capability

A significant part of the equipment in Portuguese factories — especially in textiles and footwear — is 10 to 20 years old and has firmware that does not support modern authentication. There is no patch available. The manufacturer may no longer exist. Applying Zero Trust directly to these devices is impossible.

The correct approach is compensating isolation: the device is placed on an isolated VLAN with communication only to strictly necessary systems, passive traffic monitoring to detect anomalies, and a communications whitelist that only allows traffic to the specific IP addresses and ports the device legitimately uses. It is not pure Zero Trust — it is Zero Trust applied to the device perimeter. The distinction matters because it defines the level of residual risk the organisation is consciously accepting, and that risk has to be documented for NIS2 compliance purposes.

The real cost: 3-year TCO vs. the cost of an incident

The investment case for Zero Trust OT has to be made with real numbers. The IBM Cost of a Data Breach Report 2024 documents a global average cost of 4.88 million dollars per breach — a historic record, 10% more than in 2023. For a Portuguese industrial SME, even a fraction of this figure — production downtime, systems recovery, notification of international customers, potential NIS2 fines — justifies the investment in segmentation and monitoring. The same report documents that organisations that made extensive use of AI and automation in prevention saved, on average, 2.2 million dollars per breach: the early detection that passive OT monitoring provides has measurable value, not just regulatory value.

The TCO of a Zero Trust OT architecture for a medium-sized factory (50-200 employees) includes network hardware (industrial firewalls, managed switches), software licences (OT monitoring platform, PAM), implementation and configuration, and ongoing operation (policy management, alert response). This cost is spread over 3 to 5 years and is measurable before you begin. The cost of a ransomware incident that stops production for a week — with international customer orders at risk and a German buyer on the phone asking about the state of the delivery — is not measurable before it happens. Only afterwards.

For a more detailed analysis of the technology risk assessment process, the article Technology due diligence in an industrial merger: what to validate offers a framework applicable also to OT security assessments.

Regulatory compliance: what Zero Trust OT demonstrates

NIS2 and IEC 62443: two frameworks, one architecture

NIS2 (Decree-Law No. 125/2025) requires that entities within its scope implement "appropriate technical and organisational measures to manage the risks to the security of networks and information systems". For OT networks, the de facto technical framework is the IEC 62443 standard — which defines security zones, conduits and security levels (SL1 to SL4) for industrial automation and control systems.

A well-documented Zero Trust OT architecture — with asset inventory, zone topology, access policies and monitoring records — provides the technical evidence needed to demonstrate NIS2 compliance. They are not two parallel projects with two separate budgets; they are the same project with two recipients: the operation and the regulator. Anyone who separates them is paying twice for the same work.

ISO 27001 and the OT extension

ISO 27001 covers information systems — historically interpreted as corporate IT. Extension to OT is possible and increasingly demanded by international customers of Portuguese factories, especially clothing and footwear brands with supply chain security requirements. The article The role of certified consultancy (ISO 27001 and GDPR) details the certification process.

An international footwear customer auditing the supplier factory in Felgueiras does not ask whether they have antivirus. They ask whether they know who accessed the line's control system in the last 90 days. Zero Trust is the only architecture that answers that question with evidence.

How to measure success after implementation

Operational metrics of Zero Trust OT

The implementation of Zero Trust OT does not end at go-live. Five metrics define whether the architecture is working or merely installed.

Inventory coverage — the percentage of OT assets identified and classified versus the estimated total — should be above 95%. Below that, there are zones of the network operating outside the Zero Trust model without anyone knowing. The mean time to detect (MTTD) OT anomalies should be measured in minutes with active passive monitoring, not in days; if the detection platform is generating alerts that nobody reads, the real MTTD is infinite. Remote access sessions with MFA and recording should cover 100% of external supplier sessions — any exception is a documented risk, not an operational convenience. The number of critical unmitigated CVEs in OT assets should be tracked quarterly, with the trend mattering more than the absolute value. And the OT incident response exercises — at least one per year, with simulation of zone isolation and control systems recovery — are the only real test that the plans work before they are needed.

The OT security report as a management tool

An OT security dashboard — integrated with the corporate SIEM and visible to management — transforms industrial security from an opaque cost into a management indicator. The Qlik Sense tools allow this type of dashboard to be built on data exported from OT monitoring platforms, making security KPIs accessible to the CEO and the CFO without requiring specialised technical training. When management can see the number of unauthorised remote access sessions

Frequently asked questions

What is Zero Trust and why is it necessary in Portuguese factories?

Zero Trust is a security architecture that explicitly verifies every access, applies least privilege and assumes constant breach. In Portuguese factories, it is essential because the traditional air gap has disappeared with IT/OT convergence — supplier remote access, real-time dashboards and predictive monitoring have created entry points that perimeter segmentation cannot protect.

What was the impact of IT/OT convergence on Portuguese industrial networks?

IT/OT convergence happened incrementally when factories connected equipment to the ERP, allowed remote access via VPN, integrated supplier monitoring and collected production data in real time. Without an accompanying security architecture, it created uncontrolled entry points — such as remote accesses installed and never revoked, or personal laptops connected directly to the line's switches.

What obligations does NIS2 bring for Portuguese manufacturing?

The NIS2 Directive, transposed by Decree-Law No. 125/2025, extends cybersecurity obligations to medium and large companies in 18 critical sectors, including manufacturing. It requires risk management, business continuity, supply chain security and incident notification within 24 hours. It requires technical controls over OT networks that the traditional perimeter model cannot demonstrate.

What is the most common attack vector in OT networks of Portuguese factories?

Machine supplier remote access without multi-factor authentication (MFA) and without session segmentation is the most exploited vector and the fastest to control. Other vectors include outdated firmware, legacy protocols without authentication, lateral movement from the IT network and USB devices. The article recommends starting with the first, which can be controlled in six weeks for a fraction of the cost of complete segmentation.

Why are industrial SMEs a disproportionate target of ransomware?

SMEs hold valuable assets — industrial property, international customer portfolios, production data — but their security investment is far lower than that of large companies. Ransomware was present in 88% of breaches in SMEs, versus 39% in large organisations. A Portuguese factory with international buyers has data that is of interest to threat actors, making it a priority target.

How is the "least privilege" principle applied in an OT network?

Least privilege means that each user or system accesses only what it needs. A remote maintenance technician of line 3 does not see line 7 or quality data. The ERP that reads production data does not write machine parameters. Each data flow is explicitly authorised, creating a list of legitimate accesses far shorter than expected once documented.

What is the main mistake Portuguese factories make when implementing Zero Trust?

The most common mistake is starting with complete network segmentation when the most active attack vector — supplier remote access — could be controlled in six weeks for a fraction of the cost. It is not lack of budget or lack of will, but lack of prioritisation. Implementation should start with the most exploited and immediate risks.

Sources

• Decree-Law No. 125/2025 of 24 January — Transposition of Directive (EU) 2022/2555 (NIS2) in Portugal
• Directive (EU) 2022/2555 (NIS2) — Directive on measures for a high common level of cybersecurity across the Union
• CNCS (National Cybersecurity Centre) — Report on Cybersecurity Incidents in Portugal 2024
• ENISA (European Union Agency for Cybersecurity) — Guidelines on Operational Technology (OT) Security
• ISO/IEC 27019:2020 — Information security, cyber security and privacy protection for power and energy utility systems