Why Air Gapped OT Networks Are a Myth in 2026

Ask a plant manager whether the control network is connected to anything, and the answer is usually immediate: no, it is air gapped. Ask the same question to the integrator who commissioned the line, the vendor who maintains the turbine, and the engineer who pulls production data into the ERP every morning, and you get three different answers, none of which matches the first one.

The air gap is not a lie people tell deliberately. It is a belief inherited from a network diagram drawn during commissioning and never reconciled with what the plant became over the following fifteen years. Every project since then added a path. Nobody removed one.

What the Air Gap Was Supposed to Mean

The concept comes from the Purdue Enterprise Reference Architecture, which stacks industrial systems into levels: field devices and sensors at Level 0 and 1, supervisory control and HMIs at Level 2, site operations and historians at Level 3, and enterprise IT at Levels 4 and 5. The industrial DMZ sits between Level 3 and Level 4, and the original discipline was simple. Nothing crosses that boundary without terminating in the DMZ first, and nothing at Level 2 or below ever touches a routable path to the internet.

A true air gap goes further than the Purdue model requires. It means no network path exists at all, in either direction, by any medium. That is an extremely strong claim. It is also one almost no operating plant can support once you look at the traffic rather than the drawing.

IEC 62443 quietly acknowledges this. Part 3-2 does not ask you to declare a network isolated. It asks you to define zones and the conduits between them, then assess the risk of each conduit. The standard assumes connectivity exists and forces you to enumerate it. That framing is more honest than the air gap language most organizations still use in their own documentation.

Where the Connectivity Actually Hides

In practice, the paths across a supposed air gap fall into a handful of recurring categories. Every one of these is something we can point to in public incident records, not a hypothetical.

Vendor remote access. Equipment suppliers need to troubleshoot without flying an engineer to site, so remote support was negotiated into the maintenance contract. Sometimes it is a documented jump host. More often it is a cellular router installed in a cabinet, a VPN client on an engineering workstation, or a remote desktop tool with a shared password. The February 2021 intrusion at the Oldsmar, Florida water treatment facility went through exactly this kind of path: a remote access tool reachable from outside, shared credentials, and a direct line to an HMI where a sodium hydroxide setpoint could be altered. The plant was not air gapped. It was remotely administered, which is close to the opposite.

Removable media and engineering laptops. Stuxnet remains the canonical demonstration that a physical air gap is a speed bump rather than a wall. The Natanz facility was genuinely isolated in the network sense. The malware still arrived, carried across on removable media and propagating through engineering workstations to reach Step 7 project files and ultimately the PLCs driving the centrifuges. Sixteen years later, the same laptop that connects to a corporate VPN in the morning still plugs into a controller in the afternoon at most sites. That laptop is a conduit whether or not any diagram shows it.

Northbound data flows. Production data has to reach somebody. Historians replicate to a corporate instance. OPC servers publish tags to an analytics platform. MES pulls batch records. Each of these is a legitimate business requirement, and each opens a session that crosses the boundary. The direction is often described as outbound only, which is true of the intended data flow and irrelevant to the attack path: a TCP session established outbound is bidirectional once it exists, and a compromised historian sits on both sides.

Shared infrastructure. Virtualization consolidated the HMI, the historian, and the domain controller onto the same hypervisor cluster. Backup traverses the same storage fabric as corporate systems. The network diagram shows two separate networks. The hardware shows one.

Safety and auxiliary systems. Fire suppression, building management, physical access control, and CCTV are frequently installed by different contractors on separate schedules, and they routinely land on the same VLANs as process equipment while being managed from the IT side.

The Incidents Were Never About the Gap

Look at the intrusions that actually damaged industrial operations and a pattern emerges. None of them required breaking an air gap in the Hollywood sense. They walked through doors that were documented, forgotten, or both.

The December 2015 attack on Ukrainian distribution utilities began with spearphishing on the business network, harvested VPN credentials that reached the SCADA environment, and used legitimate remote access to open breakers at substations. The operators watched their own cursors move. The follow up was targeted at recovery: firmware on serial to Ethernet converters was overwritten so field devices could not be reached remotely, and the utilities fell back to manual operation.

Triton, discovered in 2017 at a petrochemical facility in Saudi Arabia, is the case that should end the air gap conversation permanently. The attackers reached a Triconex safety instrumented system, the layer specifically designed to be independent of everything else. They got there by pivoting from IT into the DMZ and then onto an engineering workstation that had a path to the safety network. The safety system was isolated in policy. In practice, it was reachable from a Windows host that somebody needed for configuration work.

Colonial Pipeline in May 2021 makes a different point about interdependence. The ransomware landed on IT systems, not on operational technology. The pipeline stopped anyway, because the business could not measure and bill for what it was moving. Perfect network isolation would not have kept the product flowing. The dependency was operational, not just electrical.

Why the Diagram Diverges From Reality

The drift is structural, not careless. Commissioning documentation is produced once, at the moment a system is handed over, by an integrator whose contract ends shortly afterward. Every change after that is made by somebody solving an immediate problem: a vendor needs access this week, a new analytics initiative needs tag data this quarter, a spare switch port is available and the cable run is short.

Each individual decision is defensible. The aggregate is a network nobody has a current picture of. And because the original document says air gapped, every subsequent risk assessment inherits that assumption without retesting it. This is how a plant ends up with a Modbus TCP session on port 502 traversing what the drawing shows as an isolated segment, discovered only when somebody finally looks at the wire.

Replace the Claim With Evidence

The useful move is not to defend or debunk the air gap. It is to stop treating isolation as an assertion and start treating it as a measurement.

Start from what devices actually do. A PLC has an extremely narrow behavioral envelope: it talks to a known set of peers, over one or two industrial protocols, at intervals set by a scan cycle, in packet sizes that barely vary. Modbus TCP on 502, DNP3 on 20000, EtherNet/IP on 44818 and 2222, S7comm on 102, OPC UA on 4840. These protocols carry no authentication in their classic forms, which is exactly why the physics of the traffic is so informative. A device that has spoken to four peers every day for two years and suddenly opens a session to a fifth has told you something concrete, regardless of what any policy document claims about its network.

That kind of observation requires seeing the traffic, not surveying it. Active scanning is a poor fit here: many controllers respond badly to unexpected probes, and a scan tells you what a device answers, not what it habitually does. Passive collection from a SPAN or mirror port with full packet inspection gives you protocol level detail without introducing a single frame onto the process network. Flow telemetry such as sFlow or NetFlow from the switches complements it, filling in coverage where mirroring is impractical and showing conversation patterns across the whole fabric.

Point that at your boundary and the questions answer themselves. Which assets have sessions that terminate outside the zone. Which conduits carry traffic nobody documented. Which vendor path is live right now. Which host talks to both the process VLAN and the corporate domain. You will find paths. Every site does. The value is that you find them before they appear in an incident timeline.

From Isolation to Observed Containment

The honest position for 2026 is that the air gap, as a security control, is gone at almost every operating site, and it has been gone longer than most programs admit. What remains achievable is something more useful: a boundary whose crossings are enumerated, monitored, and justified.

That is a smaller claim than isolation and a far stronger one, because it can be verified on any given Tuesday. Zones and conduits from IEC 62443 give you the vocabulary. Passive observation of the traffic gives you the evidence. The combination replaces a belief that was never tested with a picture that updates itself.

Ask your team one question this week: if we asserted the air gap in an incident review, what would we show to prove it. If the answer is a diagram, you already know what the next project should be.