Most OT security vendors are IT security with an OT paintjob. A PLC from 2009 has no agent. A remote substation has no SOC. A pipeline RTU can't be patched without a maintenance window months away. The question: does it work when the lights go out and nobody is watching?

Agentless OT security is table stakes now. Good. But segmentation doesn't scale. One-to-one rules become group rules. Group rules spider web. Policy sprawl nobody wants to touch. A friendlier UI doesn't fix a thousand interdependent rules.

95% of orgs confident in detection. Nearly half still can't stop attacks in time. The industry's answer: AI-powered breach containment. The problem: containment assumes the attacker is already inside. That's cleanup. Not prevention.

The 2026 Gartner CPS MQ just dropped. Great list of vendors who can see everything. Missing question: when an attacker touches your network, does it enforce inline -- or only alert? The MQ tells you who can see. Ask separately who can stop.

OT security leaders are naming it: the 'minutes that matter' gap. Alert fires. By the time someone responds -- the damage is done. In OT, minutes don't mean data loss. They mean physical consequences. The right question: what if enforcement was automatic, at first touch?

Forescout 2026: network infrastructure now outranks endpoints as highest-risk. Routers, switches, PDUs, BACnet controllers -- unmanaged, no agent, no telemetry. TXOne: 96% of OT incidents start at the IT layer. They don't hack the PLC. They walk through the IT door.

Attackers need time. To scan your network. Map your services. Find the gaps. Build the path in. That reconnaissance phase is where most attacks are won or lost -- before a single piece of malware is deployed. Static defenses hand them that time for free.

Iran was inside US networks for six months before anyone noticed. Not because the tools failed to detect it. Because detection without enforcement is just expensive surveillance. The one question that separates real security from theater: Does it enforce inline, or only alert?