Why IT/OT Convergence Is a Business Decision, Not a Technology Project
- GPA
- 2 days ago
- 5 min read
Industrial control system vulnerabilities are rising, not falling. In 2025 alone, more than 2,000 new vulnerabilities affecting industrial environments were publicly disclosed, marking the highest volume on record.
These are not abstract numbers buried in research reports. They represent weaknesses in the very systems that run production lines, manage utilities, and control critical processes inside manufacturing facilities.
For decades, the factory floor operated separately from the rest of the business. IT teams managed email, servers, and enterprise applications. Operations teams focused on keeping lines running and orders moving. The separation created a sense of safety.
Today, that separation barely exists.
Manufacturers are connecting machines to enterprise networks to gain real time visibility, compare performance across plants, and improve decision making. The business case is strong. Greater visibility improves efficiency and protects margin. Digital transformation has become a competitive requirement.
However, most plants were never designed for that level of exposure. Connectivity creates measurable business value, but without disciplined architecture and cybersecurity strategy, that value can erode quickly. Growth and protection now have to move together.
Why IT-OT Convergence is Accelerating
Executive teams are asking harder questions than they were five years ago.
Why does production data take hours to consolidate?
Why are maintenance teams still reacting to failures instead of predicting them?
Why is enterprise-wide visibility across plants still fragmented?
Disconnected systems are increasingly the bottleneck.
Recent research from the Manufacturers Alliance Foundation1, based on a 2025 survey of U.S. manufacturers, shows that 71 percent of companies have already begun IT-OT convergence efforts. Organizations further along in that journey report stronger competitive positioning and greater confidence in their cybersecurity readiness than peers who remain siloed. For many organizations, convergence has moved from pilot programs to board-level planning discussions.
Convergence is accelerating because fragmented architectures slow decision speed, limit visibility, and increase risk exposure. Manufacturers facing margin pressure, labor constraints, and rising cyber threats cannot afford that drag. In short, IT-OT convergence is moving faster because the cost of staying disconnected is becoming more visible.
The Opportunity Executives Cannot Ignore
When IT and OT convergence is executed deliberately, the benefits extend well beyond technical integration.
Organizations gain something far more valuable than connectivity:
Visibility that arrives in time to influence decisions rather than explain them after the fact
Production intelligence becomes real time
Cross-functional conversations move faster because everyone is looking at the same operational picture
Asset utilization improves because performance gaps are no longer hidden inside isolated systems
Supply chain coordination tightens
Operational resilience strengthens because the organization understands its exposure.
This shift explains why convergence discussions are no longer confined to infrastructure teams. They are appearing in operating reviews and board-level strategy sessions. Convergence is increasingly viewed as a lever for margin protection, growth, and competitive positioning.
However, opportunity without discipline introduces a second reality that executives must confront directly.
The Cyber Risk Multiplier
Every time a new OT system connects to the enterprise network, it adds not just visibility, but exposure.
Operational technology environments were not originally built with cybersecurity in mind. Many were designed decades ago to run reliably, often in isolation, without the expectation of interacting with broader enterprise systems.²
That isolation is disappearing, and the data shows the risk surface is expanding rapidly. Vulnerability tracking for industrial control systems reached record levels in 2025, with more than 2,000 documented vulnerabilities affecting industrial environments.³
At the same time, threat intelligence analysts continue to identify manufacturing as one of the most frequently targeted sectors. In a 2025 assessment of cyberattacks where industry attribution was possible, manufacturing accounted for roughly 22 percent of incidents, making it the most targeted industry.⁴
Many of the devices now being connected to enterprise networks were engineered for longevity and uptime, not defensive depth. Without proper architectural and governance controls in place, organizations can unintentionally extend enterprise risk directly onto the plant floor, turning what was once isolated infrastructure into a strategic entry point for attackers.
From an adversary’s perspective, exposed OT systems are high value territory precisely because they sit at the intersection of reliability requirements, legacy design, and operational criticality.
When Cyber Incidents Become Production Incidents
In a converged environment, cybersecurity stops being a back-office issue.
An incident no longer affects only data systems. Rather, it can:
halt production lines
create safety implications
disrupt revenue flow
interrupt customer delivery commitments
The motivation is straightforward. Disrupting production creates immediate financial pressure and increases the likelihood of ransom payment. As IT and OT environments integrate, the operational blast radius of an attack expands.
For executive teams, this reframes the risk conversation. Cyber exposure is now directly tied to operational continuity and enterprise value.
What Leading Manufacturers are Doing Differently
Organizations navigating convergence successfully tend to share consistent patterns.
They begin with visibility.
Federal cybersecurity guidance from CISA identifies asset inventory as a foundational control in industrial environments.⁵ Without knowing what exists across IT and OT, leaders cannot meaningfully manage risk.
They align leadership early.
Recent research from the Manufacturers Alliance Foundation shows that organizations further along in convergence treat IT/OT collaboration as a strategic business initiative rather than a narrow technology project.¹
They design security into architecture from the outset.
Standards such as NIST SP 800-82 and ISA/IEC 62443 emphasize segmentation, access control, monitoring, and incident response planning as core components of secure industrial environments.⁶ ⁷
Most importantly, they move deliberately.
Mature programs follow a phased, risk-based approach instead of accelerating connectivity faster than governance can support.
Organizations that treat convergence as disciplined transformation, rather than accelerated integration, position themselves to capture value without amplifying unintended risk.
Where GPA Sees the Market Moving
At GPA, conversations around IT-OT convergence are increasing across manufacturing sectors. Urgency is clear: executive teams understand the need for greater connectivity, improved visibility, and faster decision cycles. Therefore, the business case is rarely questioned.
What remains challenging is execution.
Many organizations are still building the alignment and architectural foundation required to converge IT and OT securely. The technical components are available, but the difficulty lies in coordinating engineering, cybersecurity, operations, and leadership around a unified strategy.
The gap between intent and disciplined execution is where risk often emerges. Convergence is frequently initiated as a technology initiative when it must be governed as a business transformation.
Organizations that manage convergence successfully resist the urge to move fast without structure. They establish architectural standards, clarify cross-functional accountability, and expand connectivity in controlled phases so operational gains do not outpace risk management.
When approached with that discipline, convergence delivers measurable improvements in visibility, operational performance, and executive confidence. When rushed, it can expand risk faster than value.
The Bottom Line
The separation between enterprise systems and the plant floor is not coming back.
Most manufacturers have already crossed that line.
IT and OT are integrating because the business demands it. Leaders want faster visibility into performance, fewer surprises in maintenance, and clearer insight across multiple facilities. In that environment, connectivity is no longer a differentiator; it is part of staying competitive.
What separates organizations now is not whether they connect systems, but how thoughtfully they do it.
Some move quickly and discover later that risk expanded faster than value. Others slow down long enough to define architecture, clarify ownership, and build security into the foundation. The difference shows up when something goes wrong.
Convergence creates opportunity, but it also removes buffers that once limited exposure. How that tradeoff is managed will shape operational stability and long-term performance.
Sources
Manufacturers Alliance Foundation. “New Research Emphasizes Necessity of IT/OT Collaboration for Digitalization Success.”https://www.manufacturersalliance.org/newsroom/new-research-emphasizes-necessity-itot-collaboration-digitalization-success
Cybersecurity and Infrastructure Security Agency (CISA). “Industrial Control Systems.”https://www.cisa.gov/topics/industrial-control-systems
SOCRadar. “CISA Industrial Control Systems Advisories 2025.”https://socradar.io/blog/cisa-industrial-control-systems-ics-advisories-2025/
Bitsight. “Inside Cyber Threats in Manufacturing 2025.”https://www.bitsight.com/blog/inside-cyber-threats-in-manufacturing-2025
Cybersecurity and Infrastructure Security Agency (CISA). “Cross-Sector Cybersecurity Performance Goals.”https://www.cisa.gov/cross-sector-cybersecurity-performance-goals
National Institute of Standards and Technology (NIST). Special Publication 800-82 Rev. 2: Guide to Industrial Control Systems (ICS) Security.https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final
International Society of Automation (ISA). “ISA/IEC 62443 Series of Standards.”https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
