- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is undergoing a rapid digital transformation. Factories that once ran entirely on isolated operational technology (OT) networks — PLCs, SCADA systems, DCS controllers — are now deeply integrated with corporate IT infrastructure, cloud services, and remote monitoring platforms. This convergence unlocks real gains in efficiency, predictive maintenance, and supply chain visibility. But it also tears down the air gap that historically kept OT systems safe from the internet-borne threats plaguing IT environments.
For Indian enterprise IT and security leaders, this is no longer a theoretical risk. CERT-In and sector regulators for power, oil & gas, and critical infrastructure have published advisories explicitly calling out the rising threat to industrial control systems. In 2024 and 2025, several high-profile incidents across Asia demonstrated that attackers are moving laterally from corporate VPNs into plant-floor networks — causing production shutdowns, data theft, and in some cases, safety events.
This guide examines the specific threat landscape at the OT/IT boundary, the security architecture required to defend it, and how Indian organisations can build a practical roadmap without halting operations.
Operational technology predates modern cybersecurity by decades. Many PLCs and SCADA systems were engineered in the 1990s or early 2000s, with protocols like Modbus, DNP3, and PROFIBUS that transmit data in plaintext, lack authentication, and assume a closed network. Vendors prioritised uptime and determinism over confidentiality and integrity — entirely rational choices when these systems were air-gapped.
Three structural problems persist today:
When IT connectivity is layered onto these networks without compensating controls, the result is a large, poorly segmented attack surface that defenders have limited visibility into.
Threat actors targeting OT environments fall into three broad categories, each with different motivations and techniques:
Groups with strategic interests in Indian infrastructure — particularly energy, telecommunications, and defence supply chains — have been documented conducting long-dwell intrusions into OT networks. The objective is often pre-positioning: gaining persistent access that can be activated during geopolitical escalation. These actors are patient, methodical, and skilled at evading traditional signature-based detection.
Ransomware gangs have discovered that encrypting OT historian servers, engineering workstations, or HMI systems creates far more leverage than encrypting office desktops. A manufacturing plant that cannot run production is losing lakhs per hour. Several Indian manufacturers have faced this scenario in the past two years. The attackers do not need specialised OT knowledge — they only need to reach the OT network from an already-compromised IT environment.
Internet-exposed industrial systems remain a persistent problem. Shodan and similar search engines routinely index Indian SCADA HMIs, Modbus-enabled devices, and remote desktop sessions on plant-floor machines. Opportunistic attackers exploit default credentials or known vulnerabilities to gain access — sometimes purely to demonstrate capability, but increasingly to sell access to more sophisticated actors.
The regulatory backdrop for OT security in India is tightening. CERT-In’s 2022 directions mandate six-hour incident reporting for a wide range of entities, including power, telecom, and financial sector operators — many of whom operate OT infrastructure. The directions also require logging and log retention for 180 days, a requirement that OT environments are often poorly positioned to meet.
Sector-specific guidance from the Central Electricity Authority (CEA) for power utilities and the Petroleum and Natural Gas Regulatory Board (PNGRB) for energy infrastructure adds further obligations. These frameworks converge on common themes: network segmentation, access control, incident detection, and response capability — all areas where most Indian OT environments have significant gaps.
The forthcoming Digital Personal Data Protection (DPDP) Act implementation also touches OT environments indirectly wherever plant-floor systems collect or process worker biometric data, visitor records, or CCTV feeds.
A sound OT security architecture addresses the convergence challenge in layers. There is no single control that makes an OT network secure; defence in depth is the only realistic approach.
The industrial security reference architecture most widely adopted is the Purdue Enterprise Reference Architecture, which defines discrete network zones from the enterprise (Level 4/5) down through site operations (Level 3), supervisory control (Level 2), and the plant floor (Level 1/0). The critical principle is that traffic between levels should be controlled, inspected, and minimised.
In practice, this means deploying next-generation firewalls at the IT/OT boundary — typically between Level 3 (site operations, historian servers) and Level 2 (SCADA/DCS) — with strict allow-lists for permitted traffic flows. FortiGate NGFWs deployed by PJ Networks are specifically suited to this boundary role: they support industrial protocols including Modbus, DNP3, and OPC-UA with deep packet inspection, allowing security policy enforcement without blocking legitimate OT communications.
Traditional IT IDS/IPS signatures are largely irrelevant in OT environments. What is needed is a system that understands the baseline behaviour of industrial protocols — which engineering workstation communicates with which PLC, what commands are normal versus anomalous, when a new device appears on the network. Passive monitoring (via SPAN ports or network taps) allows this without any risk of disrupting production traffic.
Vendor and remote access accounts into OT networks should never use shared credentials or always-on VPN tunnels. A jump server or privileged access workstation with session recording, MFA, and time-limited access tokens reduces the risk of compromised vendor credentials turning into an OT breach. Every session should be logged and reviewable.
You cannot defend what you cannot see. Many Indian manufacturers have no complete inventory of their OT assets — especially legacy devices added informally over years. Passive network discovery, combined with integration of vendor advisories and ICS-CERT bulletins, provides a vulnerability view without the risk of active scanning disrupting sensitive OT devices.
One of the persistent operational challenges in OT/IT convergence security is that IT and OT teams use entirely separate toolsets, with no common operational picture. SOC analysts monitoring SIEM alerts for the corporate environment have no visibility into plant-floor anomalies. NOC teams watching network performance dashboards may see a spike in PLC polling traffic but have no way to correlate it with a security event.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks deploys and operates it for clients as its primary field deployment and operations partner. The platform addresses the multi-domain visibility gap that OT/IT convergence creates, through four integrated pillars:
SIEM — Correlated Threat Detection Across IT and OT Sources. Ora ingests log and event data from heterogeneous sources — FortiGate firewalls, Windows endpoints, Active Directory, and increasingly, OT historian servers and SCADA event logs. Correlation rules mapped to the MITRE ATT&CK for ICS framework enable detection of techniques specific to industrial environments: reconnaissance of engineering workstations, anomalous SCADA command sequences, and lateral movement from IT into OT segments. Graph-based attack storyline reconstruction helps analysts understand the full attack chain rather than triaging isolated alerts. For organisations subject to CERT-In’s 180-day in-country log retention direction, tiered hot/cold/archive storage supports compliance without requiring on-premises storage expansion at each plant site.
NMS — Single-Pane Observability for Fragmented Multi-Vendor Estates. Indian manufacturing sites often run a patchwork of network infrastructure: legacy managed switches, wireless APs, WAN links, and plant-floor networking from different vendors with no common view. Ora’s NMS delivers unified observability across firewalls, switches, APs, and WAN/SD-WAN links through LLDP/CDP topology discovery and network path tracing. ML-based anomaly detection flags unusual traffic patterns — a sudden surge in inter-VLAN communication that might indicate lateral movement, or an engineering workstation establishing new outbound connections. This is particularly valuable for multi-site manufacturing and retail estates where NOC visibility has historically been fragmented by vendor and geography.
Video Surveillance (VMS) — Physical and Network Security Under One Roof. For manufacturing plants, retail chains, and multi-site organisations, physical security is inseparable from network security. A sophisticated attacker may gain initial access by physically connecting to an exposed port in a warehouse or substation. Ora’s video surveillance (VMS) module manages ONVIF, Hikvision, and Dahua cameras with video analytics — motion detection, perimeter alerts, and object recognition — integrated into the same operations console used by the SOC. Security teams gain a unified view of physical access events and network security events, enabling faster correlation when both indicators are present. This is especially relevant for manufacturing and retail estates managing hundreds of distributed camera endpoints.
SOAR — Automation to Meet CERT-In’s Six-Hour Reporting Window. CERT-In’s mandatory six-hour incident reporting window is operationally tight, particularly for organisations without mature security automation. Ora’s SOAR module provides pre-built playbooks and automated response actions — including pushing blocklists directly to FortiGate firewalls to isolate compromised hosts within minutes of detection. For OT environments, playbooks can trigger network isolation of specific plant-floor segments without requiring manual analyst intervention, reducing mean time to contain while preserving production safety. Automation is not a luxury at the six-hour threshold — it is what makes that timeline achievable.
Organisations exploring how the platform can address their OT/IT visibility gaps can contact PJ Networks for a scoping discussion and demonstration.
For most Indian organisations, a full OT security transformation is a multi-year journey. The following phased approach prioritises high-impact, lower-disruption steps first.
India’s industrial sector faces a moment of genuine urgency. The same digital transformation that drives competitive advantage — remote monitoring, cloud-connected ERP, smart manufacturing — creates attack surface that adversaries are actively exploiting. The air gap that once protected OT environments is largely gone, but the security controls appropriate for converged environments have not yet been widely deployed across Indian industry.
The organisations that move first — building visibility, segmentation, and detection capability before an incident occurs — will be significantly better positioned than those who wait for a production shutdown to prompt action.
PJ Networks works with Indian manufacturers, energy companies, and critical infrastructure operators to design and operate OT security programmes. Our managed security services combine FortiGate NGFW deployment at the OT/IT boundary, 24/7 NOC/SOC monitoring, and the PrahiX Ora platform for unified threat detection and response. If you are assessing your current OT security posture or planning a segmentation project, contact our team for a no-obligation scoping discussion.