What Is OT? IT/OT Convergence and Factory Security 2026

If you run a factory in Thailand or elsewhere in ASEAN, the line between the technology that moves your equipment and the technology that handles your information keeps getting blurrier. OT is the umbrella term for the systems that monitor and directly control the physical equipment and processes on a plant floor, and for decades it lived in a world walled off from the corporate network. This article walks through what OT is, how it differs from IT, why IT/OT convergence is accelerating, the security risks that come with it, and how OT relates to MES and ERP.

What Is OT? Definition and How It Differs from IT

The scope of Operational Technology

OT stands for Operational Technology. It refers to the whole body of technology used to monitor and physically act on real-world assets such as factories, plants, and infrastructure. Holding an injection molding machine at temperature, changing conveyor speed, raising an alarm when boiler pressure approaches its limit: this is the domain of OT, and its best known components are PLCs, SCADA systems, and DCS platforms.

The important point is that OT is not just a list of hardware names. It is a world that includes the devices, the networks, the operating rules, and the roles of the people responsible for them. Changing one line of PLC logic is not the same kind of act as pushing an application update in the IT world. The former touches physical motion and safety directly, and every change tends to require trial runs and verification. Understanding OT means understanding that it is always in contact with the physical world.

IT and OT optimize for different things

IT exists to raise business value through information processing. Accounting, sales management, human resources, collaboration platforms. What it handles is information, and its top priority is confidentiality: keeping data from leaking and keeping it away from people without authorization.

OT, by contrast, puts availability and integrity first. The line must not stop, and control commands and measured values must be accurate. Put bluntly, in the OT world a stoppage is itself an incident. A safety device that misfires can injure someone, and in a chemical plant the consequences can extend to the environment. This difference in priorities is the root cause of the security difficulties described later in this article.

Aspect	IT	OT
Primary purpose	Information processing and business value	Monitoring and control of physical equipment and processes
Typical components	Servers, PCs, business applications, databases	PLCs, SCADA, DCS, sensors, industrial networks
Top priority	Confidentiality	Availability and integrity
Refresh cycle	Short, with replacement every few years	Long, with the same device often running for more than 10 years
Impact of an outage	Business processes stall	Production stops, with direct effects on safety and quality
Owning department	Information systems	Production engineering or maintenance

The time gap that the refresh cycle creates

The row most often overlooked in that table is the refresh cycle. In IT, hardware and software turn over every few years. OT equipment keeps running for 10 years and sometimes 20. Capital equipment is depreciated over long periods, and there is little incentive to stop something that works simply to replace it.

That gap in time horizons is more than a cultural difference. A controller installed 10 years ago was designed around the security assumptions of 10 years ago. Back then, connecting it to an external network was outside the design case, so devices with no encryption and no authentication are still in active service today. IT staff often react with surprise when they find an unsupported operating system on the plant floor, but from the OT side there is a very real constraint: you cannot stop something that is running.

OT in Practice on the Plant Floor with PLC, SCADA, and DCS

What Is OT? IT/OT Convergence and Factory Security 2026 - figure 1

PLC, the programmable logic controller

A PLC takes inputs from sensors and drives outputs to actuators according to logic that has been programmed in advance. “Advance the cylinder when the proximity sensor triggers.” “Cut the heater when the set temperature is exceeded.” It repeats these decisions with millisecond-level reliability. When people talk about OT in a factory, the PLC is usually the first thing they mean.

What defines a PLC is that it is optimized for repeating a defined action with extreme stability. It is not designed to handle a wide variety of workloads the way a general purpose computer is. It reads inputs on a fixed scan cycle, computes, and writes outputs. That simplicity is what underpins its reliability.

SCADA, supervisory control and data acquisition

SCADA collects information from multiple PLCs and instruments, presents it to operators as a supervisory display, and sends control commands back when needed. Picture the monitors in a central control room showing line status as a schematic diagram, and you have the idea.

SCADA is well suited to viewing widely distributed equipment as a whole, and it typically provides alarm management, trend graphs, and historical data storage. The data accumulated there is the very source that IT will later ask for when the business wants factory data for decision making.

DCS, the distributed control system

A DCS targets continuous processes in industries such as chemicals, petroleum, and food, distributing control functions while operating them in an integrated way. It differs from SCADA in that the plant is designed as a single system with control and supervision tightly integrated. In process industries it is the core platform.

Sensors and industrial networks

Supporting all of the above is the mesh of sensors and industrial networks laid out across the site. Temperature, pressure, flow, vibration, current: physical quantities of every kind are converted into electrical signals and sent to controllers. In recent years IIoT sensors have been added on top, producing data at a granularity nobody used to collect. That change is the starting point of the convergence discussed next.

Why IT/OT Convergence Is Accelerating Now

Management now needs data that only OT holds

Factory data used to stay inside the factory. Maintenance owned the equipment records, production results were aggregated into daily reports, and a monthly summary went up to management. For a long time that was enough.

Industry 4.0, the smart factory, and DX changed both the granularity and the freshness of the data that management wants. Not “last month’s utilization rate” but “how much loss is happening on which line right now.” When a quality defect appears, the business wants to trace which lot was produced under which equipment conditions. Meeting those demands requires pushing data that exists only on the OT side into IT systems.

IT/OT convergence is the name for that flow of using OT data in an IT context. It is not purely a technical matter of connecting networks. It is also an operational matter of connecting shop floor data to management decisions.

Staying disconnected is no longer a realistic option

The second driver is that external connectivity has become hard to avoid. Remote maintenance by equipment vendors, cloud based analytics services, remote status checks from headquarters in Japan: all of them assume connectivity. There is a ceiling on the convenience you can obtain while keeping a fully isolated network, and the gap between that ceiling and the speed management expects has become impossible to ignore.

For a more concrete look at how this convergence proceeds in a real plant, see how to advance OT and IT convergence in the factory.

The Security Risks That IT/OT Convergence Raises

What Is OT? IT/OT Convergence and Factory Security 2026 - figure 2

Manufacturing accounts for roughly 40% of ransomware damage

As connectivity widens, so does the attack surface. According to the report published by Japan’s National Police Agency on the state of threats in cyberspace in 2025, manufacturing accounted for approximately 40% of ransomware damage cases by industry, the largest share of any sector. Manufacturing has become a preferred target, and that fact deserves to be faced directly.

The reasons are layered. Losses from halted production are large, which makes payment look more likely. Manufacturers sit at junction points in supply chains, so one company stopping ripples outward. And, as described below, OT environments are structurally hard to defend.

Vulnerabilities tend to stay in place

Traditional OT ran on isolated networks. If nothing external can reach a device, there is little pressure to build strong authentication or encryption into the device itself. As a result, a great many environments still run production equipment that has no such protection.

When IT/OT convergence then adds network connectivity, the assumption that nothing from the outside can reach the device collapses. The equipment has not changed at all. Only the environment around it has.

The patching dilemma

Worse, even when a vulnerability is confirmed, acting on it is difficult. Because OT prioritizes continuous operation, taking equipment down to apply a patch is not an easy call. In many plants the only opportunity is a planned shutdown, and those come only a few times a year.

On top of that, updating controller software can void a vendor’s warranty and can force a full round of functional revalidation. A long period in which the team knows about a vulnerability but cannot patch it is not negligence. It is a structural constraint.

Security expertise does not naturally accumulate in the owning team

There is an organizational issue as well. In most plants, OT devices are managed by maintenance or production engineering. Those teams are deeply skilled at keeping equipment running, but cybersecurity knowledge is not necessarily accumulated there in any systematic way. Conversely, the information systems department may know security well while lacking a full grasp of control system practice and the “we cannot stop it” constraint.

If you connect the networks while leaving that gap in place, you create territory that neither department believes it owns. For an attacker, that seam is exactly the opening.

A staged approach

So where should a plant start? Practical guidance on the topic points to a staged approach rather than an attempt at perfect defense from day one: first understand the current state, then build a comprehensive defensive posture, and only then move on to monitoring and analysis. Japan’s Ministry of Economy, Trade and Industry takes a similar staged view in its cyber-physical security guidelines for factory systems, starting from organizing requirements and assets into protection zones before defining and executing countermeasures.

There is sound logic to that order. If you do not know what is connected to the network, you cannot decide what to protect. In practice, an OT asset inventory taken for the sake of understanding the current state very often turns up devices that nobody on the team knew about.

For a step by step view of running OT security as day to day practice, see OT security for factories in Thailand.

How to Think About OT Security with the Purdue Model and IEC 62443

The Purdue Model as a shared language

Any discussion of OT security runs through the Purdue Model, also known as PERA. It organizes factory systems into a hierarchy from Level 0 to Level 5 and makes clear what belongs where. Level 0 covers field sensors and actuators, Level 1 the controllers, Level 2 supervisory control, Level 3 manufacturing operations management, and Level 4 and above the business systems.

The practical heart of the model is the industrial DMZ placed at Level 3.5. By inserting a buffer zone between IT and OT so that the two never communicate directly but always pass through the DMZ, you build a structure in which a compromise on the IT side does not reach OT directly.

The zone and conduit model of IEC 62443

The second pillar is IEC 62443, the international standard for the security of industrial automation and control systems. It divides a system into zones according to role and risk, defines the communication paths between zones as conduits, and then sets a target security level for each zone on a risk basis across the range SL-T 0 to SL-T 4.

The advantage of this approach is that it does not try to protect everything to the same degree. Zones tied to personal safety get a high target level, zones with limited impact get a proportionate one. It works as a tool for setting protection priorities inside a finite budget.

Why the hierarchy alone is not enough in 2026

That said, as of 2026 the vertical hierarchy of the Purdue Model no longer captures reality on its own. Direct cloud connections, edge computing placed on the floor, remote access by equipment vendors, and the growth of IIoT devices all create traffic that jumps across levels and breaks the clean pyramid.

This does not make the Purdue Model obsolete. The practical direction is to keep hierarchical organization as the foundation while using the zones and conduits of IEC 62443 to define the level-crossing traffic that the hierarchy cannot express. The point is not to discard the model but to combine it with something that covers its limits.

Sorting Out How OT Relates to MES and ERP

What MES is

Anyone studying OT eventually runs into MES. MES stands for manufacturing execution system, and it handles the real-time work of issuing plan instructions to the shop floor and collecting actual results back from it. It sits between OT and IT, corresponding to Level 3 in the Purdue Model.

What MES owns is the round trip: translating the plan set above it into something the floor can execute, and returning the outcome upward. It tells you which part number to build on which machine and when, then collects how many were actually produced, when, and where things stopped. Only with that round trip can plan and actual be reconciled.

The division of roles with production management and ERP

MES is easily confused with production management systems and with ERP. A production management system handles planning, including materials procurement and cost management. ERP is enterprise resource planning, covering accounting, sales, and human resources with a company-wide optimization perspective.

So MES is shop floor execution, production management is planning, and ERP is company-wide optimization. Holding that division of roles in mind makes it far easier to decide what to expect from which system.

Layer	Main role	Time granularity	Position
OT	Monitoring and control of the equipment itself	Milliseconds to seconds	Field control layer
MES	Issuing plan instructions and collecting results	Seconds to minutes	Between the floor and IT, Level 3
Production management	Planning, procurement, cost management	Days to weeks	Planning layer
ERP	Enterprise resource planning	Weeks to months	Company-wide optimization layer

Because the roles are distinct, the order and scope of any implementation naturally differ as well.

What changes when MES goes in

The benefits usually cited for MES fall into four areas. First, automatic collection of process data allows abnormalities to be detected early. Instead of waiting for daily reports to be tallied, the team can act the same day.

Second, equipment utilization and bottlenecks become visible, which shows where investment belongs. When “that process is the one backing up” moves from intuition to a number, cost reduction measures become concrete.

Third, real-time data improves the ability to meet delivery dates. When progress is visible immediately, customer inquiries can be answered with evidence behind the answer.

Fourth, work procedures become standardized, reducing the dependence on the one person who knows how a task is done.

For criteria and comparison points when selecting an MES, see how to compare MES options for factories in Thailand.

What to Watch For at Sites in Thailand and ASEAN

The demand for remote monitoring from Japan

Japanese manufacturers operating in Thailand and ASEAN face one demand in particular: headquarters in Japan wants to see plant status remotely. The fewer Japanese staff stationed locally, the stronger that demand becomes.

But remote monitoring also means adding another inbound path. Allowing connections without designing who can access which route and how far they can see simply stacks up risk. This is exactly the area where a control-capable path gets opened for a use case that only needed read access.

Aging equipment and mixed environments

In ASEAN plants it is common to find equipment that was relocated from Japan and has been in service for a long time. A machine finishes its role at the parent plant in Japan, moves to the local site, and runs for another 10 years or more. Naturally, the controllers of that era come with it.

The result is a mixed environment of old and new equipment with inconsistent protocols and interfaces. Even when you set out to extract data, some machines simply have no port through which to send it. Handling that reality is the first hurdle for OT visibility at a local site.

The constraint of local security talent

The other constraint is people. Talent that spans both OT and security is scarce worldwide, and securing it at a local site in Thailand or ASEAN is not easy. It is not unusual to find a single IT person covering everything from company PCs and networks to plant equipment.

Under those conditions, a sophisticated system will not survive contact with daily operations. It is more realistic to judge what the local team can actually sustain and to design outside support for part of the monitoring and operations from the very beginning.

OT security is a management issue in Thailand too

This is not only a Japanese-company concern. On 20 August 2026, at the Anantara Siam Bangkok Hotel, Netmarks (Thailand), Fortinet, and SIS held a seminar titled “Securing Production Line: Fortinet AI-Powered OT Security for Thai Manufacturing.” Aimed at Thai manufacturers, it covered the latest OT security trends, strengthening production line visibility, and a roadmap for cyber defense.

That is a clear sign that OT/IT convergence and its security have become board-level concerns inside Thailand as well, and it suggests that local customers and suppliers will increasingly expect the same standards from you.

What TOMAS TECH Can Do

What Is OT? IT/OT Convergence and Factory Security 2026 - figure 3

TOMAS TECH is based in Bangkok and supports Japanese manufacturers across Thailand and ASEAN with factory IT implementation. Around our PEGASUS production and energy management system, we design data collection from shop floor equipment, visualization of actual results, and traceability as one connected flow.

In the OT domain, the first obstacle is usually not choosing a security product. It is the state of not knowing what is connected to what, or what data can even be obtained. That is the “understand the current state” step of the staged approach described above, and while it stays vague, no investment decision can be justified.

Our team works on site in Japanese, Thai, and English, checking the connection method and data extraction path for each machine and building the collection scheme from there. Where older equipment has no communication interface, we look at signal tapping and add-on sensors as alternatives. Once the collected data is visualized in PEGASUS, operating status and per-lot production conditions become traceable, which is exactly what you need when a quality problem calls for a retrospective investigation.

On security, we recommend starting with an accurate picture of the network configuration and an inventory of the contact points between IT and OT. Nothing has to be solved all at once. Beginning with a shared map of where the risks actually are usually turns out to be the shortest path.

Frequently Asked Questions

What does OT stand for?

OT stands for Operational Technology. It is the umbrella term for the technology that monitors and controls the physical equipment and processes of factories and plants, and it includes PLCs, SCADA, DCS, sensors, and industrial networks. It is used as the counterpart to IT, which stands for Information Technology and handles information processing.

Where should we start with OT security measures?

Start by understanding the current state. Japan’s Ministry of Economy, Trade and Industry’s guidelines likewise begin with organizing what needs protecting before defining zones and countermeasures. Begin with an inventory of what equipment exists in the plant and which network each device sits on, then map how many contact points exist with the IT side. Choosing a product before you know what you are protecting rarely produces value proportional to the spend.

What is MES and how does it differ from OT?

MES is a manufacturing execution system that issues plan instructions to the shop floor and collects actual results in real time. Where OT is the layer that physically drives the equipment, MES is the layer above it that says what to build and gathers what was built. In the Purdue Model it sits at Level 3 and acts as the bridge between OT and IT.

When starting IT/OT convergence, what should we make visible first?

Two things take priority: equipment operating status and the communication paths between IT and OT. The first produces improvement effects that show up as numbers, which makes investment decisions easier to justify. The second is indispensable for understanding security risk. Once those two are in hand, extending the scope to quality data and energy data follows in a manageable order.

Summary

OT is the umbrella term for the technology that monitors and controls the physical equipment and processes of factories and plants. It differs sharply from IT in that it puts availability and integrity first and assumes operating cycles of more than 10 years. Smart factory and DX initiatives have pushed IT/OT convergence forward, making OT data a management concern, while environments built on the assumption of an isolated network are now exposed and carry higher security risk. Statistics from Japan’s National Police Agency show manufacturing accounting for approximately 40% of ransomware damage, compounded by the OT-specific dilemma of not being able to patch quickly.

As frameworks, the Purdue Model hierarchy from Level 0 to Level 5 with an industrial DMZ at Level 3.5, and the zones and conduits of IEC 62443 with risk-based targets from SL-T 0 to SL-T 4, form the practical foundation. Sorting out the division of roles between OT, MES, production management, and ERP is equally useful for deciding where to begin. At sites in Thailand and ASEAN, the design has to account for remote monitoring from Japan, a mix of aging equipment, and a shortage of local security talent.

If you are weighing where to start with OT visibility or security at your own site, feel free to reach out through the TOMAS TECH contact page even at an early stage of consideration. From our base in Bangkok we will listen to the situation on your floor and work through the options with you.