IT/OT Convergence Attacks: What CISA Advisories Reveal About Small Business Risk

IT/OT convergence attacks are no longer reserved for pipeline operators and power grids. CISA’s 2024 and 2025 advisories document a clear, accelerating pattern: threat actors are actively probing the gap between standard business networks and the operational or physical systems connected to them — and small manufacturers, engineering firms, and professional services practices are showing up on that targeting map with increasing frequency. The belief that a 25-person shop is invisible to nation-state actors or organized criminal groups is not just wrong. It is a liability.

1. What “Operational Technology” Actually Means for Small Firms
2. The Convergence Gap: Where Attacks Enter
3. What 2024 and 2025 CISA Advisories Actually Say About IT/OT Convergence Attacks
4. Who Is Affected: It Is Not Just Factories
5. How These Attacks Play Out in Practice
6. What a Sound Defense Posture Looks Like
7. What to Ask Your IT Firm Right Now
8. How the NIST Cybersecurity Framework Applies to IT/OT Convergence

What “Operational Technology” Actually Means for Small Firms

Operational technology (OT) is any hardware or software that monitors or controls physical processes, devices, or infrastructure. For a large energy company, that means turbine control systems. For a small business, it is usually something far more ordinary — and far more overlooked.

Here is what falls under the OT umbrella for a typical small-to-midsize operation:

• Building management systems that control HVAC, lighting, and physical access
• Networked security cameras and badge readers
• Manufacturing equipment with embedded controllers that communicate over Wi-Fi or Ethernet
• Medical devices in healthcare-adjacent practices that connect to the practice network
• Environmental monitoring sensors in laboratories or clean rooms
• Point-of-sale and payment kiosks connected to back-office systems
• Uninterruptible power supplies with remote management interfaces

None of these systems was originally designed with cybersecurity as a priority. Most run firmware that is rarely updated. Many ship with default credentials that are never changed. And in the vast majority of small business environments, these devices sit on the same flat network as the computers handling payroll, email, and client data. That flat network is the convergence gap.

The Convergence Gap: Where Attacks Enter

Over the past decade, businesses connected operational devices to IP-based networks for convenience and remote monitoring. The benefit was real: a facilities manager could adjust building temperature from a laptop; a production supervisor could check line output from a phone. The cost was equally real: every connection point became a potential entry vector.

Traditional OT environments were physically isolated from internet-connected networks. That isolation was imperfect, but it created meaningful friction. Convergence removed most of that friction in exchange for operational efficiency. Threat actors noticed.

The attack pattern CISA has documented repeatedly follows a predictable sequence:

• An attacker gains initial access through a phishing email, a compromised remote desktop session, or an exposed internet-facing device
• Once inside the IT environment, they conduct internal reconnaissance — mapping what else is reachable on the network
• OT devices, which rarely have detection or monitoring software installed, are discovered and targeted
• The attacker either disrupts the OT device directly (ransomware, destructive malware) or uses it as a persistent foothold to maintain access after the IT-side infection is cleaned up

That last point is particularly dangerous. Many businesses clean up a ransomware incident on their computers and consider the threat gone. If an attacker has also compromised a building access controller or an embedded manufacturing device, they retain access through a vector no one is watching.

What 2024 and 2025 CISA Advisories Actually Say About IT/OT Convergence Attacks

CISA has been explicit and consistent. The agency’s Industrial Control Systems advisory program issued more than 200 advisories in 2024 alone, covering vulnerabilities in devices from dozens of manufacturers — devices that appear in small businesses as often as in critical infrastructure.

Four themes stand out from the 2024–2025 advisory cycle:

Default credentials remain the most exploited entry point for OT devices. CISA’s advisories on Unitronics programmable logic controllers documented Iranian-affiliated threat actors scanning the public internet for these devices using factory-default passwords. Unitronics devices are used in water treatment, yes — but also in small food production facilities, commercial HVAC systems, and light manufacturing operations across the country.

Remote access tools are the preferred pivot point. The 2024 Volt Typhoon advisory — covering a Chinese state-sponsored group focused on pre-positioning in U.S. critical infrastructure — found that attackers were not using exotic malware. They were using legitimate remote access tools already installed in target environments. Small businesses that allow remote access without strict controls (multi-factor authentication, access logging, session time-outs) are handing threat actors exactly what they need.

“Living off the land” techniques specifically target under-monitored environments. CISA’s 2025 advisories continue to highlight attackers using built-in operating system tools rather than custom malware — deliberately, because built-in tools generate alerts that are easy to ignore in environments where no one is watching alerts at all.

Ransomware groups are explicitly targeting OT as a leverage mechanism. Encrypting office computers is disruptive, but a business can sometimes keep operating. Disabling a manufacturing line, shutting down building access, or corrupting environmental controls creates an immediate operational crisis. CISA’s 2024 ransomware advisories covering manufacturing and food and agriculture documented this pattern in businesses with fewer than 50 employees.

Who Is Affected: It Is Not Just Factories

Coverage of IT/OT convergence attacks almost always focuses on energy, water, and large manufacturing. That framing leaves a wide category of smaller, more vulnerable organizations without useful guidance.

These business types carry meaningful OT exposure that rarely gets discussed in the context of cyber risk:

• Small and mid-size manufacturers — Any company running computer-controlled equipment, even basic CNC machines or programmable assembly equipment, has OT on its network. The convergence risk is direct.
• Professional services firms in regulated industries — Pharmaceutical consulting firms that work with contract manufacturers or research facilities often maintain network connections to partner environments where OT is present. A breach at the consulting firm can become a pivot point into the partner’s operational environment.
• Engineering and architecture firms — Firms managing building systems or facilities work often have remote access into client OT environments. Compromising the consulting firm’s network gives an attacker a door into every client they touch.
• Healthcare-adjacent practices — Diagnostic equipment, infusion pumps, imaging systems, and environmental controls all qualify as OT. Practices with fewer than 20 clinicians routinely have these devices on the same network as billing and records systems.
• Commercial real estate and property management companies — Building management systems controlling access, HVAC, and elevators are networked, remotely managed, and rarely monitored from a security standpoint.
• Food production and distribution — Temperature monitoring, conveyor controls, and cold chain management systems all represent OT exposure. CISA specifically named food and agriculture as a target sector in its 2024 ransomware guidance.

The common thread is not industry. It is the presence of networked physical systems combined with limited security resources and the assumption that size equals invisibility.

How These Attacks Play Out in Practice

Threat intelligence is useful. Concrete scenarios are more useful. Here are three patterns drawn from the types of incidents documented in CISA advisories and FBI reporting, applied to the small business context:

Scenario 1: The building as the backdoor. A professional services firm cleans up a phishing-delivered malware infection on employee computers. The cleanup was thorough — on the computers. What it missed was the building access controller, compromised using its default credentials during the same intrusion. Three months later, the attacker uses the controller’s remote access interface as a persistent foothold to re-enter the network, this time targeting financial data.

Scenario 2: The trusted vendor connection. A small manufacturer allows a machine vendor to remotely access production equipment for maintenance. That connection uses a shared password unchanged for four years and has no multi-factor authentication. A threat actor who compromises the machine vendor gains direct access to the manufacturer’s floor network — and from there, to the office network on the same flat infrastructure.

Scenario 3: Ransomware with OT leverage. A food distribution company is hit with ransomware. The attackers encrypted office computers — and deployed a secondary payload targeting the company’s temperature monitoring system for cold storage. Restoring computers from backup takes two days. Determining whether temperature data is trustworthy enough to release perishable inventory takes three more. The operational disruption cost exceeds the ransom demand by a factor of four.

None of these scenarios require nation-state sophistication. All three reflect patterns documented in advisory and incident data from the past 24 months. IT/OT convergence attacks succeed because the conditions that enable them — flat networks, default credentials, unmonitored devices — are standard features of under-resourced environments, not edge cases.

What a Sound Defense Posture Looks Like

Closing the IT/OT convergence gap does not require a complete infrastructure rebuild. It requires a clear-eyed inventory of what is on the network and deliberate decisions about how those devices are protected and segmented.

A sound starting posture for any small business with OT exposure includes:

• Network segmentation — OT devices should not share network segments with computers handling sensitive data. A firewall or managed switch with properly configured network zones can isolate operational devices from business systems without significant cost.
• Credential hygiene on all networked devices — Every device on the network — including cameras, building controllers, and embedded equipment — needs a unique, strong password. Default credentials are indefensible in 2025.
• Firmware and patch management that includes OT — Most small businesses patch computers reasonably well and patch OT devices almost never. CISA advisories repeatedly flag known, patched vulnerabilities being exploited months or years after fixes were available.
• Remote access controls — Any remote access to the network — whether for employees, vendors, or IT support providers — should require multi-factor authentication and generate logs that are actually reviewed. Vendor access should be time-limited, not permanently open.
• Monitoring that sees beyond computers — Endpoint protection software installed on computers provides zero visibility into a building controller running proprietary firmware. Network-level monitoring that watches traffic patterns across all devices is necessary to detect lateral movement through OT vectors.
• Incident response planning that accounts for OT — A business continuity plan that only addresses data backup and computer restoration will fail when the disruptive event targets physical systems. Plans need to explicitly address what happens when operational systems are compromised, not just data systems.

This is not a checklist most small businesses can execute internally. It requires expertise in both conventional IT security and the behavior of industrial and embedded devices — two disciplines that rarely coexist in a single internal hire.

At Xact IT Solutions, this kind of holistic environment design is exactly what we do for managed clients — building environments where IT and operational infrastructure are both accounted for in the security architecture, not treated as separate problems. We have maintained zero client breaches across every engagement since 2004, and disciplined network architecture is a large part of why. Learn more about our managed IT services designed to close gaps like these before they become incidents.

What to Ask Your IT Firm Right Now

If you have any operational or physical systems connected to your network, these questions will tell you quickly whether your current IT partner understands the risk you are carrying:

• “Have you inventoried every device on our network, including non-computer devices?” — If the answer is no, or if the inventory excludes cameras, access systems, HVAC controllers, or production equipment, your attack surface is larger than your IT firm knows.
• “Are our operational devices on a separate network segment from our business computers?” — If the answer is no, or if your IT firm does not understand the question, you have a flat network. That flat network is the convergence gap.
• “When did we last change the credentials on our building access system, cameras, and any embedded equipment?” — If the answer is “never” or “I don’t know,” you likely have devices running default credentials — the most common exploitation vector CISA documented in 2024.
• “How would we detect an attacker who has compromised a device that does not run standard endpoint protection software?” — This tests whether your IT firm has network-level monitoring. Many do not.
• “Does our incident response plan address what happens if a physical or operational system is compromised, not just our computers?” — Most small business continuity plans are data-centric. An OT-aware plan requires different preparation.
• “Are all vendor remote access connections to our environment logged and protected with multi-factor authentication?” — Vendor connections are among the most commonly exploited access vectors in documented IT/OT convergence attacks.

Strong answers to these questions require an IT partner who thinks about your environment as a whole system — physical infrastructure, network architecture, data systems, and human behavior together. Weak or evasive answers are a signal worth acting on.

If you want a direct conversation about where your environment stands, Book a Free Cybersecurity Strategy Call with our team. It is 20 minutes, no obligation, and no sales pressure — just a clear look at what you are actually carrying.

How the NIST Cybersecurity Framework Applies to IT/OT Convergence Attacks

The NIST Cybersecurity Framework provides a structured vocabulary that maps directly onto the IT/OT convergence problem — and using it helps small businesses have more productive conversations with IT vendors and insurers alike.

The five core functions — Identify, Protect, Detect, Respond, and Recover — apply to OT environments just as they do to traditional IT infrastructure. The execution, however, looks different:

Identify: Before you can protect OT assets, you have to know they exist. A complete asset inventory that includes embedded controllers, building systems, and networked physical devices is the non-negotiable starting point. Most small businesses have never done one that goes beyond computers and servers.

Protect: Network segmentation, credential management, and firmware patching fall here. These are the controls most frequently cited in CISA advisories as absent or inadequate in organizations that experienced IT/OT convergence attacks — and in most cases, they are achievable without enterprise-scale budgets.

Detect: This is where the OT gap is most acute. Standard endpoint detection tools provide no visibility into devices running proprietary or embedded firmware. Network-level behavioral monitoring — watching for anomalous traffic patterns between segments — is required to detect lateral movement through the OT environment. Without it, attackers can persist in OT systems for months after IT-side remediation.

Respond: Incident response plans that do not account for physical and operational system compromise will fail at the worst possible moment. A documented, tested plan that explicitly addresses OT scenarios — including who owns operational continuity decisions when systems are down — is an operational necessity, not a compliance exercise.

Recover: Recovery from an OT-targeted incident is fundamentally different from recovering from a data breach. Restoring a temperature monitoring system, validating that production equipment has not been tampered with, and confirming that building access logs are trustworthy all require specialized knowledge and pre-planned procedures. Organizations that think through recovery in advance recover faster and at lower total cost.

Mapping your environment against these five functions — even informally — will surface gaps that no checklist exercise reveals on its own. For small businesses with meaningful OT exposure, working with an IT partner who has direct experience in OT-aware security architecture is the fastest path from awareness to action.

The “Too Small to Matter” Assumption Is the Risk

The most dangerous belief in small business cybersecurity is not a technical misunderstanding. It is a strategic one: that size confers protection. CISA’s 2024 and 2025 advisory data is unambiguous. Threat actors do not check a company’s LinkedIn page before deciding whether to attack. They scan the internet for exposed, misconfigured, or unpatched devices — and they find them in small businesses as readily as in large ones.

IT/OT convergence attacks succeed not because attackers are sophisticated, but because the gap between IT and operational infrastructure is wide, unmonitored, and almost universally underestimated by the businesses carrying it. The Volt Typhoon advisory, the Unitronics warnings, and the ransomware sector advisories targeting food, manufacturing, and healthcare are not background noise. They are a direct description of the threat environment small businesses are operating in right now.

The businesses that get this right are not necessarily the ones with the largest security budgets. They are the ones that stopped assuming invisibility is a defense strategy and built environments where the gap simply does not exist. Book a Free Cybersecurity Strategy Call to find out exactly where your environment stands — and what it would take to close it.