(July 14): The convergence of information technology (IT) and operational technology (OT) has become essential for industrial organisations seeking to innovate and excel. However, this integration brings a critical challenge that is often overlooked: Cybersecurity. 

IT/OT convergence is not new and while it is already a well-established conversation, the level of readiness among businesses to manage its complexities continues to evolve. 

I have witnessed first-hand the hurdles organisations face and the significant progress made by those who have embraced change and strengthened their cybersecurity posture. Drawing from my own experiences, this article provides practical insights and strategies to help organisations confidently navigate the cybersecurity dimensions of IT/OT convergence.

Embarking on IT/OT convergence is very much like venturing into uncharted waters — full of opportunity but fraught with challenges. 

One of the most common pitfalls is a fragmented understanding of the cybersecurity landscape across both IT and OT domains. 

Hence, a unified perspective is essential for identifying vulnerabilities, assessing existing defences and recognising gaps that need to be addressed. Without a clear picture of their security landscape, organisations’ risk chasing convergence goals may unintentionally expose them to significant cyber threats.

From what I’ve observed, the organisations that thrive share a common trait: a steadfast commitment to fostering collaboration between IT and OT teams, especially when it comes to cybersecurity. 

This begins with establishing a strong “operating model” that defines how personnel from both domains interact and clarify their roles and responsibilities in cybersecurity. Some would even take a step further by introducing intermediary roles, professionals with a unique blend of IT and OT cybersecurity expertise. 

These roles will help bridge the cultural divide that often exists between the two specialisations, thereby facilitating smoother operations and a more cohesive security strategy. 

The critical role of IT/OT leadership lies in promoting a cybersecurity-conscious culture and encouraging alignment between IT and OT teams to achieve operational harmony. Their support in promoting seamless teamwork and facilitating open communication enables more holistic protection strategies. 

More importantly, effective leaders prioritise shared security goals over individual interests, ensuring that cybersecurity strategies align with operational objectives and empowering their teams to embrace innovative security practices. Those who foster a culture of security and collaboration will not only inspire effectively but also lay the foundation for robust initiatives that safeguard the organisation’s critical assets.

The journey of IT/OT convergence is not just a technical transformation, it involves deep organisational change and a shift in how people collaborate. Proactively embracing change management from the start, or even before the project begins, can significantly enhance cybersecurity efforts by mitigating resistance, building awareness and ensuring smooth adoption of new cybersecurity measures. 

In my experience, organisations that initiate change management early will reduce resistance and foster greater acceptance of new security protocols and technologies among employees. These organisations are also more likely to remain open to evolving technologies, adapt to new processes, and embrace cybersecurity measures within the integrated IT/OT environment.

By addressing change head-on, organisations can turn transformations into an opportunity to strengthen their security posture, but also accelerate integration and long-term sustainability.

A critical but often overlooked aspect of convergence is the early engagement of original equipment manufacturers (OEMs) and technology partners. These stakeholders pay a vital role as information enablers that offering invaluable insights and unbiased perspectives on security challenges.

However, the diversity of vendors within the OT environment often adds layers of complexity. One visit to any OT facility today may reveal an overwhelming mix of contrasting and sometimes, overlapping cybersecurity solutions from different OEMs. This can lead to operational perplexity, adding further management burden for operators. 

To tackle this effectively, it is essential to establish clear cybersecurity requirements early on, aligning OEM vendors towards a unified security approach. 

By clearly articulating specific technical requirements from the outset, an organisation can prevent misinterpretations and promote collaborative efforts among vendors to achieve the desired security outcomes.

As IT/OT convergence progresses, equipping OT engineers with targeted cybersecurity training is essential. 

The landscape of cyber threats is constantly changing, and certifications such as the IEC62443 series and GICSP provide vital or specialised knowledge tailored for OT security. 

Investing in such training helps OT teams to bridge critical skill gaps, enhance threats awareness among IT/OT teams and reinforce a unified defence across the organisation.

A roadmap to success in cybersecurity Every organisation’s path to IT/OT convergence, especially in terms of cybersecurity, may look different, but the ultimate goal remains the same: enhanced efficiency, innovation and protection against cyber threats. 

By prioritising collaboration between IT and OT teams, reinforcing cybersecurity measures, embracing operational changes and nurturing forward-thinking leadership, companies can create a clear roadmap for the seamless integration between IT and OT.

As we look ahead, navigating the journey of IT/OT convergence requires not just technical expertise but also a deep understanding of the cybersecurity challenges involved.

It’s crucial for organisations to approach this transformation with a spirit of collaboration, adaptability and innovation. 

At the end, it all goes back to one critical question: Is your business well prepared for the next wave of cybersecurity threats in an increasingly digital world? 

Arivindran Saidoo, Partner – Technology, Risks and Cybersecurity, KPMG in Malaysia