IT-OT convergence has been a stated priority for industrial organisations for more than a decade. Progress has been slower than the technology would suggest it should be. The hardware and software to connect OT systems to enterprise networks exists, works reliably, and is widely deployed. The obstacle is not technical interoperability — it is human and organisational interoperability.

IT departments and OT engineering teams have fundamentally different definitions of success, different risk appetites, and different accountability structures. IT measures performance against security metrics, patch compliance rates, and uptime of business systems. OT measures performance against production throughput, process stability, and equipment availability. When a proposed network integration requires taking a production system offline for a change window, these two cultures collide directly — and in most organisations, OT wins, because a production stoppage has an immediate, visible cost, while a security gap has a deferred, uncertain one.

What is changing this dynamic is not technology — it is regulation and AI. NIS2 places cybersecurity obligations on industrial operators that cannot be met with OT and IT teams operating in silos. And the AI capabilities that manufacturing and energy companies want to deploy — predictive maintenance, autonomous optimisation, real-time analytics — require seamless data access to OT systems that isolated network architectures cannot provide.

The Cultural Divide: How Each Team Sees the World

Diagram 1 — The IT-OT Cultural Gap: Different Priorities, Different Risk Models
flowchart TD subgraph IT["IT Department Priorities"] ITN["Security First — patch immediately\nChange = Improvement · Agile deployment · Cloud-first\nKPIs: security compliance · incident count · patch age\nRisk model: unpatched = exposed"] end subgraph OT["OT Engineering Priorities"] OTN["Availability First — uptime above all\nChange = Risk · Conservative updates · Long validation cycles\nKPIs: OEE and throughput · MTBF · Safety incidents\nRisk model: change = potential disruption"] end subgraph Gap["⚡ Where Conflict Happens — Decisions Neither Team Can Resolve Alone"] G1["Network Access Requests\nFirewall rule changes · New device connections\nIT wants fast approval · OT wants risk assessment first"] G2["Patching and Updates\nMaintenance window timing · System availability risk\nIT urgency vs OT validation cycle length"] G3["Remote Access\nVPN policies · Vendor credentials · Session recording\nIT least-privilege vs OT operational convenience"] end IT --> Gap OT --> Gap style IT fill:#eff6ff,color:#1e3a5f,stroke:#1e3a5f,stroke-width:2px style OT fill:#f0fdf4,color:#14532d,stroke:#16a34a,stroke-width:2px style Gap fill:#fff1f2,color:#991b1b,stroke:#fca5a5,stroke-width:2px style ITN fill:#dbeafe,color:#1e3a5f,stroke:#3b82f6,stroke-width:1.5px style OTN fill:#bbf7d0,color:#14532d,stroke:#22c55e,stroke-width:1.5px style G1 fill:#fee2e2,color:#991b1b,stroke:#fca5a5 style G2 fill:#fee2e2,color:#991b1b,stroke:#fca5a5 style G3 fill:#fee2e2,color:#991b1b,stroke:#fca5a5

This is not a failure of either team. OT's caution is rational: an unexpected system interruption on a production line can cost €100,000–€150,000 per hour in lost output, plus the safety implications of an uncontrolled process state change. IT's urgency around patching is also rational: unpatched systems with known vulnerabilities are exposed. The problem is that neither team has the mandate, the authority, or the language to resolve the conflict at the level where it actually occurs — in the decisions about individual change requests, firewall rules, and network integrations.

The Three Root Causes of Stalled Convergence

1. No Shared Governance

In most organisations, IT security reports to the CISO. OT engineering reports to the Head of Operations or Plant Manager. These two reporting lines converge at the CEO or COO level — and that is where conflicts escalate to when they cannot be resolved lower. The result: security decisions that should take days take months, because every disagreement requires escalation to leadership level. The absence of a shared governance forum — with representatives from both IT and OT, empowered to make binding decisions on convergence issues — is the most common root cause of stalled programmes.

2. Fragmented Vendor Ecosystem

The automation vendors who supply DCS, PLC, and SCADA systems to OT teams have historically competed on capability, not interoperability. Each vendor's proprietary historian, proprietary protocols, and proprietary configuration tools create data silos that make IT-OT data integration a custom engineering project for every connection. The landscape is improving — OPC-UA is becoming a common standard, and cloud connectivity is now a standard feature of most modern platforms — but the installed base of legacy systems still speaks proprietary languages that require vendor-specific adapters.

3. Legacy Infrastructure with No Upgrade Path

A PLC installed in 2005 to control a critical process will run for twenty to thirty years if the plant allows it. It was not designed for network connectivity, does not support modern authentication, and cannot be patched without a software upgrade that may require a full production line validation. The asset simply does not fit the IT change cadence. Meanwhile, the IT team sees an unmanaged device on a connected network and flags it as a risk. Both assessments are correct — and the resolution requires a risk-based approach that acknowledges the operational constraints.

The technology required for IT-OT convergence largely exists. The capability gap is governance: shared ownership of decisions, shared metrics for success, and a common risk framework that both IT and OT teams can work within.

Legislation as the Ultimate Catalyst

While culture is slow to change, legal liability is not. NIS2 creates a non-negotiable driver for IT-OT convergence by holding management bodies personally accountable for cybersecurity outcomes across the entire operational environment — including OT systems that IT teams have previously had no visibility into.

When the CISO's NIS2 gap assessment reveals that critical OT systems are unmonitored, unpatched, and running with shared vendor credentials, the response is no longer "OT will handle it." The directive makes both IT security and OT operations jointly accountable to the same regulatory framework. This forces the governance conversation that organisations have been deferring.

Convergence DriverWhat It ForcesWhy It Works Now
NIS2 DirectiveJoint IT/OT accountability for cybersecurity compliance; management liabilityLegal and financial consequences that override cultural hesitancy
AI and Predictive AnalyticsOT data must be accessible to enterprise AI systems for predictive maintenance, optimisationBusiness case is now compelling and measurable
Energy Cost PressureEnergy optimisation AI requires real-time OT data access to production systems10–15% energy cost reduction justifies the integration investment
Vendor ModernisationNew OT platform releases (ABB 800xA 7.0, Siemens PCS neo, Emerson DeltaV v16) include native IT connectivityNew deployments can connect securely without custom adapters

AI: The New Driver — and the New Risk

The emergence of AI as a core operational capability is creating a new kind of urgency around IT-OT convergence. Predictive maintenance AI that can reduce unplanned downtime by 20–40% depends on access to OT historian data. Energy optimisation algorithms that can cut energy cost by 10–15% depend on real-time visibility into production load and equipment state. Quality control AI that detects early signs of process deviation depends on SCADA data.

All of these capabilities require the OT network to be accessible — to data pipelines, to analytics platforms, and ultimately to AI agents that will act on what they learn. An organisation that keeps OT isolated cannot deploy industrial AI at scale. Convergence is no longer optional for companies that want to compete on operational efficiency.

The risk dimension is equally real. As AI becomes embedded in critical infrastructure — managing energy systems, optimising production, and providing situational awareness to operators — the OT systems that AI depends on become high-value targets. Disrupting the data pipelines that feed an AI-managed energy grid is a new class of attack. Securing the IT-OT integration is as important as building it.

Diagram 2 — IT-OT Convergence Maturity Model
flowchart TD M1["Stage 1 — Isolated\nIT and OT fully separated · No shared visibility · Manual data exchange"] M2["Stage 2 — Connected\nData historian accessible · Basic IT/OT firewall · One-off integrations"] M3["Stage 3 — Integrated\nOPC-UA standard interfaces · Shared SOC visibility · Joint governance forum"] M4["Stage 4 — Converged\nUnified data platform · AI analytics running · Zero Trust across IT and OT"] M1 -->|"First OPC-UA/historian link"| M2 M2 -->|"Common standards + joint governance"| M3 M3 -->|"DMK data lake + AI deployment"| M4 style M1 fill:#fee2e2,color:#7f1d1d,stroke:#1e3a5f style M2 fill:#fff7ed,color:#7c2d12,stroke:#1e3a5f style M3 fill:#dbeafe,color:#1e3a5f,stroke:#3b82f6 style M4 fill:#dcfce7,color:#14532d,stroke:#22c55e

Overcoming the Divide: Practical Steps

Start with the Pitch, Not the Network

Convergence programmes that lead with IT security requirements typically meet resistance from OT teams who see the initiative as IT imposing constraints on operations. Programmes that lead with an OT-valued business case — "this integration enables predictive maintenance that reduces your unplanned downtime" — create an ally in the OT team rather than an adversary. The same technical work is required in either case; the framing determines whether OT engineering is a partner or an obstacle.

Prove It in a Lab Before the Plant

OT teams are risk-averse because the cost of a production mistake is high. Allowing them to test IT-OT integrations in an off-site lab or digital twin environment — with their own engineers in control of the testing — builds the trust necessary for production deployment. One vendor who does this well is ABB, whose customer demonstration centres allow operators to test new integrations on representative process configurations before committing to their live system.

Establish Shared Governance with Joint KPIs

The most effective convergence programmes create a joint IT-OT governance forum — typically chaired by the Head of Operations or a newly created role (OT Security Manager, Digital Operations Director) — with representation from both teams and the authority to make binding decisions on integration requests. This forum measures itself against shared KPIs:

Diagram 3 — Unified IT-OT Governance Structure for Convergence
flowchart TD CEO["CEO / Managing Director\n(NIS2 management liability)"] JFORUM["Joint IT-OT Governance Forum\nChaired by COO or Digital Ops Director\nMeets monthly — binding decisions"] CISO["CISO\nIT Security"] COO["Head of Operations\nPlant Management"] OTSEC["OT Security Manager\nShared accountability\n— reports to both"] ITSEC["IT Security Team\nSOC / Vulnerability Mgmt"] OTENG["OT Engineering\nDCS / PLC / Instrumentation"] ARCH["OT Security Architect\nNetwork design / Zero Trust"] CEO --> JFORUM JFORUM --> CISO JFORUM --> COO CISO --> OTSEC COO --> OTSEC OTSEC --> ITSEC OTSEC --> OTENG OTSEC --> ARCH style CEO fill:#dbeafe,color:#1e3a5f,stroke:#1e3a5f,stroke-width:2px style JFORUM fill:#dbeafe,color:#1e3a5f,stroke:#0f172a,stroke-width:3px style CISO fill:#dbeafe,color:#1e3a5f,stroke:#3b82f6 style COO fill:#dcfce7,color:#14532d,stroke:#22c55e style OTSEC fill:#fff7ed,color:#7c2d12,stroke:#1e3a5f,stroke-width:2px style ITSEC fill:#e2e8f0,color:#1e3a5f,stroke:#94a3b8 style OTENG fill:#e2e8f0,color:#1e3a5f,stroke:#94a3b8 style ARCH fill:#fff7ed,color:#92400e,stroke:#1e3a5f

Simplify the First Integration

The first IT-OT integration in an organisation should not be the most ambitious one. A read-only data connection from the OT historian to an enterprise analytics platform — requiring no changes to the OT control system, no new devices in the OT network, and no modification of control logic — demonstrates the value of integration with minimal risk. Use the first success to build momentum and trust before proposing integrations that require deeper OT network access.

The Future Is Integrated

The industrial companies that will lead in the next decade — in manufacturing efficiency, in energy performance, in operational resilience — will be those that have successfully integrated IT and OT into a coherent operational architecture. NIS2 removes the option of continued separation. AI makes integration economically compelling. The question is not whether IT-OT convergence will happen, but whether it will be designed deliberately or forced by circumstances.

The organisations that succeed will be those that treat convergence as a governance programme first and a technology programme second — starting with shared ownership, shared metrics, and a joint forum empowered to make decisions. The technical work follows; the human and organisational work is the harder part, and it has to come first.