Operational Technology (OT) networks were never built with modern IT security in mind. The systems that power industrial control environments, manufacturing facilities, building automation, and critical infrastructure all share one important limitation: you can't install security agents on them.
These devices often run proprietary firmware, follow rigid maintenance schedules, and in many cases cannot be patched or rebooted without disrupting production. Taking a controller offline may mean stopping an entire manufacturing line or interrupting a critical operational process.
This reality immediately rules out many of the security tools commonly used in enterprise IT environments. There are no endpoint detection and response (EDR) agents, no host-based logging, and no vulnerability scanners that can safely interact with these systems. For security teams responsible for OT and Industrial Control System (ICS) visibility, the challenge isn't deciding which endpoint agent to deploy—it's determining what passive, non-intrusive telemetry is already available from the surrounding infrastructure.
In most OT environments, the answer is the network itself.
Routers, switches, and firewalls positioned between IT and OT segments continuously export NetFlow and IPFIX telemetry. When that flow data is collected, enriched, and forwarded into a SIEM, it provides meaningful visibility into network activity without requiring any interaction with the OT devices themselves.
This blog explains where NetFlow Optimizer (NFO) fits within an OT/ICS security architecture, what visibility it provides, and just as importantly, where its limitations begin.
Why Traditional Security Tools Don't Work in OT
The Purdue Model remains the primary architectural framework for OT and ICS network design. It separates industrial control systems from enterprise IT through multiple security zones and a demilitarized zone (DMZ).
Levels 0 through 2 contain the physical process and industrial equipment, including PLCs, DCS, and SCADA systems. Level 3 represents the manufacturing operations network. Between Level 3 and the enterprise network at Level 4 sits the IT/OT DMZ, introduced in later versions of the Purdue Model and formalized in IEC 62443.
Most enterprise security tools assume conditions that simply don't exist inside OT environments. They expect IP reachability, open management ports, and endpoints capable of running security software.
Industrial devices provide none of these assumptions.
A PLC controlling a water treatment facility, a historian server inside a power substation, or an HMI operating a production line cannot accept endpoint agents. Many continue running operating systems that have remained unpatched for years—not because of poor security practices, but because vendor support agreements or the operational risks associated with downtime make patching impractical.
Active scanning creates another challenge.
Sending probe traffic into an OT network can trigger unexpected behavior in devices that were never designed to receive unsolicited requests. Certain industrial protocols may respond to unfamiliar traffic by faulting, restarting, or entering a safe-stop state. As a result, tools that IT security teams routinely rely on—such as vulnerability scanners, network mapping utilities, or SNMP walkers directed at OT devices—can introduce genuine operational risk.
That leaves passive monitoring as the safest approach.
Among all available passive data sources, network flow telemetry exported by the infrastructure carrying the traffic provides the richest and least intrusive visibility.
What NetFlow Telemetry Can—and Cannot—See in OT Networks
NetFlow Optimizer (NFO) collects flow telemetry exported by routers, switches, and firewalls located at key points throughout the OT environment, including the IT/OT boundary, the DMZ, and the perimeter of OT network segments. Understanding this collection boundary is essential.
NFO gathers NetFlow and IPFIX records from infrastructure devices capable of exporting flow data. It does not collect information directly from OT endpoints, nor does it perform packet capture or deep packet inspection (DPI) for industrial protocols such as Modbus, DNP3, or EtherNet/IP.
What Flow Telemetry from Boundary Devices Provides
Traffic crossing zone boundaries
Every connection between enterprise IT and OT environments passes through a boundary device. Flow records capture the source, destination, protocol, port, byte count, and session duration for each network conversation.
New or unexpected endpoints
If a device that has never previously communicated outside its segment suddenly appears in the flow records, it becomes immediately visible. NFO provides the source IP, destination IP, destination port, and traffic volume, allowing the SIEM or security analyst to determine whether the activity is expected.
Protocol and port deviations
OT networks are highly predictable. The same systems typically communicate with the same destinations using the same protocols and ports every day. When that pattern changes—for example, if a historian server suddenly initiates outbound HTTPS connections to an external IP address, or a device located near a PLC begins communicating over an unexpected port—those deviations are visible through flow telemetry.
Volume anomalies
A sudden increase in traffic leaving an OT segment toward the enterprise network or an external destination can be detected using flow volume information alone, even without visibility into the actual packet contents.
East-west traffic within visible segments
Where switches export NetFlow or IPFIX (although not all OT switches do), NFO also provides visibility into east-west communications occurring within those network segments.
What Flow Telemetry Does Not Provide
Industrial protocol contents
Flow records do not reveal Modbus function codes, DNP3 commands, EtherNet/IP payloads, or any other industrial protocol content. Inspecting protocol-level communications requires a dedicated OT security platform connected through SPAN or TAP access that can perform deep packet inspection.
OT endpoint inventory
NFO uses SNMP polling for network infrastructure devices only. It does not discover or inventory OT endpoints. Organizations requiring comprehensive OT asset discovery need purpose-built OT asset management platforms.
Visibility into isolated OT segments
If an air-gapped OT segment is served by switches that do not export NetFlow or IPFIX, NFO has no visibility into that portion of the network. This remains a common limitation within Levels 0 and 1 of the Purdue Model.
Where NFO Fits in the OT Security Architecture
The IT/OT DMZ is the highest-value deployment point. Traffic crossing between enterprise and OT environments passes through these boundary devices, and they almost always run enterprise-grade networking equipment that exports standard NetFlow or IPFIX. Deploying NFO to collect from firewalls, layer 3 switches, and routers at this boundary gives security teams visibility into every cross-zone conversation without any contact with OT endpoints.
NFO enriches that flow data with context that makes it actionable in a SIEM:
| Enrichment | What Raw NetFlow Shows | What NFO Adds |
| User identity | Source IP: 10.4.1.15 | User: ops-engineer@company.com (resolved from AD/Entra ID) |
| Threat intelligence | Destination IP: 185.220.101.1 | Threat score: malicious / Category: known C2 infrastructure |
| Application context | Port: 502 | Application: Modbus (via NFO application catalog) |
| Bidirectional flow | Separate ingress/egress records | Single stitched record with full conversation context |
That enriched, CIM-compliant telemetry lands in Splunk ES, Sentinel, Exabeam, or any other downstream SIEM where security teams have built detection logic. The detection, alerting, and investigation happen in the SIEM. NFO delivers the data layer those workflows depend on.
Air-Gapped and Zero-Egress Deployment
OT environments in critical infrastructure, defense, and other regulated industries often prohibit any data from leaving the network perimeter. To support these requirements, NFO is a software-only solution that deploys entirely on-premises with zero data egress.
User identity resolution is performed against on-premises Active Directory or Entra ID, while custom application catalogs are maintained locally. Threat intelligence feeds and GeoIP databases are updated from external sources on a configurable schedule, after which NFO caches the data on-premises. All enrichment is then performed locally using the cached information during flow processing.
This architecture is particularly important in OT environments where even a management-plane connection to a cloud service raises compliance concerns.
NFO has been deployed in air-gapped federal and Department of Defense (DoD) environments since 2016. The same architecture that meets those stringent security requirements can be deployed directly into air-gapped industrial control system (ICS) networks without modification.
Organizations pursuing CMMC compliance or operating under FISMA frameworks can also use NFO to support evidence collection for network flow logging requirements without introducing external data dependencies. As discussed in The Unsung Hero of CMMC Compliance and OMB M-21-31 and Network Flow Logging, network flow telemetry is a specific evidence requirement under both frameworks. NFO provides the collection, enrichment, and delivery pipeline needed to help satisfy those requirements.
The Practical Starting Point
Most organizations looking to improve OT network visibility do not begin by deploying a dedicated OT security platform.
Instead, they start with the infrastructure they already have: network devices at the IT/OT boundary that are already exporting flow data, along with the SIEM their security operations team already relies on.
NFO collects that existing flow telemetry, enriches it, and delivers it to the SIEM in a format that integrates with existing detection content.
The result is a significant improvement in visibility without touching a single OT device, deploying endpoint agents, installing additional sensors within the OT network, or requiring the security operations team to manage a separate OT-specific platform or console.
For organizations with stricter security requirements and the budget for dedicated OT tooling, NFO complements those investments by providing the network-layer data foundation they do not cover. It collects multi-vendor flow telemetry from the broader network infrastructure, enriches it, and delivers it to the SIEM, extending visibility across enterprise and cloud-connected environments that OT-focused platforms are not designed to address.
The Bottom Line
OT and ICS security begins with accepting a fundamental constraint: you cannot install agents on these devices.
What you can do is collect, enrich, and deliver flow telemetry from the infrastructure surrounding them. NFO transforms that telemetry into actionable security data without touching OT endpoints, introducing cloud egress, or adding another console for the security operations team to manage.
The network boundary is visible. The conversations crossing it are recorded. NFO provides the enrichment that turns those records into actionable security intelligence.
About DT Asia
DT Asia began in 2007 with a clear mission to build the market entry for various pioneering IT security solutions from the US, Europe and Israel.
Today, DT Asia is a regional, value-added distributor of cybersecurity solutions providing cutting-edge technologies to key government organisations and top private sector clients including global banks and Fortune 500 companies. We have offices and partners around the Asia Pacific to better understand the markets and deliver localised solutions.
How we help
If you need to know more about Agentless Security for OT/ICS Networks: How NetFlow Telemetry Covers the Devices You Cannot Touch, you’re in the right place, we’re here to help! DTA is Netflow Logic’s distributor, especially in Singapore and Asia, our technicians have deep experience on the product and relevant technologies you can always trust, we provide this product’s turnkey solutions, including consultation, deployment, and maintenance service.
Click here and here and here to know more: https://dtasiagroup.com/netflowlogic/
