OT Exposure Intelligence · 2025 · Inaugural Edition
The State of OT Security in Cement & Mining
An intelligence report built not from platform telemetry, but from a full year of hands-on OT network assessments and managed support across an active multi-plant cement operation. Every figure came off a plant floor.
82%
of 267 OT network switches assessed were End-of-Life or Discontinued — outside vendor support, patches, and spare-part guarantees.
Switch lifecycle — 267 assessed
- Discontinued
- 122 · 46%
- End-of-Life
- 97 · 36%
- Active (Mature)
- 16 · 6%
- Active
- 18 · 7%
- Unclassified
- 14 · 5%
275 OT support activities were required over the year just to hold the line — the operational tax of deferred modernization. (76 incidents + 199 planned services)
Seven conditions, as observed
The exposure is structural, not exotic — obsolescence, weak segmentation, and ungoverned access allowed to persist.
01
OT switching is largely obsolete
The majority of the assessed fleet sits outside vendor support — no patches, no guaranteed spares.
82% EOL / Discontinued
02
Current, supported equipment is the exception
Only a thin minority of the fleet remains in active, fully supported status.
~7% Active
03
The installed base concentrates in a few vendors
Three vendors hold roughly three-quarters of the fleet — lock-in by default, where one vendor's lifecycle decisions ripple across the whole plant.
3 vendors ≈ 75%
The full report
Unlock the rest of the report
The first three findings are above. Enter your work email to unlock the rest of this page, and we’ll send the PDF to your inbox.
- •Findings 04–07 in full: fieldbus still carrying production traffic, IT/OT separation only just begun, unmanaged switches in critical paths, and the 275-activity operational tax
- •The four-stage OT Maturity Model, and where the assessed fleet entered the year
- •The five-control Cement & Mining OT Baseline, mapped to ISA/IEC 62443 and NIST SP 800-82r3
- •The PDF, including which three vendors hold roughly three-quarters of the 267-switch fleet
04
Obsolete fieldbus still carries production traffic
Legacy fieldbus segments remained in production, mid-migration to modern industrial Ethernet.
in production
05
IT and OT were not yet physically separated
A baseline control was still being established for the first time in 2025 at sites that had run for years without it.
just begun
06
Unmanaged & consumer-grade switches in OT paths
Consumer-grade and unmanaged switches sat in critical OT paths — no segmentation, no monitoring, no management plane.
present
07
Obsolescence carries a continuous operational tax
Keeping the networks stable took 76 incidents plus 199 planned services across the year.
275 activities / yr
The framework
The Potenza OT Maturity Model
A diagnostic of what an operator can see and control — not which products they own. The assessed fleet entered the year largely between Blind and Aware; the year’s work moved priority systems toward Controlled.
Stage 1 · No visibility
Blind
No reliable inventory, topology, or lifecycle visibility. Basic questions about the OT network can't be answered.
Stage 2 · On paper
Aware
Inventory and topology exist on paper. Gaps and obsolescence are known, but not yet controlled.
Stage 3 · Maintained
Controlled
Segmentation, governed access, and lifecycle management are in place and maintained for priority systems.
Stage 4 · Continuous
Resilient
Controls are continuous and tested. The environment degrades gracefully under stress rather than failing silently.
Not sure where your plant sits? Take the twelve-question self-assessment →
“The OT service owner cannot be the OT vendor.”
The Cement & Mining OT Baseline
Five controls form the minimum defensible baseline. They are ordered — each enables the next. Maps cleanly onto ISA/IEC 62443 and NIST SP 800-82r3 for operators who need framework alignment.
- 1
Inventory & lifecycle of record
You can't secure or budget what you can't see. Lifecycle status turns obsolescence from a surprise into a plan.
- 2
Topology of record
The authoritative map of assets, VLANs, flows, and remote paths — the artifact every later decision depends on.
- 3
Purdue-aligned segmentation
Separate IT from OT and zone the plant floor so one compromise can't traverse the whole network.
- 4
Governed remote & privileged access
Brokered, logged, least-privilege access — no single tool whose failure cuts off all support.
- 5
Independent governance
An operator-side owner that assesses and prioritizes in the operator's interest, not a vendor's roadmap.
See where your plant sits
The report describes the pattern; an assessment locates your plant on it. Start with a scoped Topology Assessment of your OT network.
Schedule a ConversationOT security for cement & mining
See how the model and the baseline translate into an engagement — independent assessment, documentation, and governance for your plant.
See our approach