OT Threat Modeling: Mapping the Three Real-World Access Vectors onto the Purdue Model

Operational technology (OT) environments power the physical world and every modern business: manufacturing lines, power grids, water systems, oil and gas processes, and the critical infrastructure that underpins your business. Unlike IT with data processing, a compromise here can cause equipment damage, safety incidents, environmental harm, or prolonged downtime with real-world consequences. Effective OT threat modeling starts with understanding the architecture of these systems and the real-world ways adversaries actually get in, so you can prioritize defensive risk reduction.

OT Architecture with Purdue

The Purdue Enterprise Reference Architecture (PERA), commonly called the Purdue Model, is the standard way to visualize and segment industrial control systems. It organizes systems into hierarchical levels based on function and time sensitivity:

▪  Level 0 – Physical Process: Sensors, actuators, valves, motors, and field instruments that interact directly with the physical world.

▪  Level 1 – Basic Control: PLCs, RTUs, DCS controllers, and safety instrumented systems that execute real-time control logic.

▪  Level 2 – Area Supervisory Control: HMIs, SCADA servers, operator stations, and engineering workstations that supervise and monitor processes.

▪  Level 3 – Site Operations: Historians, Manufacturing Execution Systems (MES), OT domain controllers, and plant-wide management systems.

▪  Level 3.5 – Industrial Demilitarized Zone (IDMZ): The buffer zone containing jump hosts, patch servers, data brokers, replicated historians, and remote-access systems.

▪  Level 4 – Site Business Planning and Logistics: ERP systems, production scheduling, and site-level IT.

▪  Level 5 – Enterprise Network: Corporate IT, email, internet connectivity, and cloud services.

Levels 0 through 3 constitute the core OT environment. Levels 4 and 5 are enterprise IT. The critical boundary between OT and IT sits at Level 3.5. In a well-designed architecture, no traffic passes directly from IT into OT. Sessions terminate in the DMZ and a new session is initiated southbound into core OT. This design principle exists precisely because some form of connectivity between the business network and the plant is nearly always required.

The Three Common Threat Access Vectors

Real-world OT incidents and industry surveys (including multi-year SANS ICS/OT data) consistently show that most compromises enter through a relatively small set of pathways. For practical threat modeling, these can be grouped into three primary access vectors.

1. IT Protects OT

There is almost always a connection from IT into OT. Business systems need production data. Vendors and engineers need remote support. Patches, antivirus updates, and backups must reach OT systems. Even organizations that claim an "air gap" usually maintain some controlled path for these reasons.

The beachhead is typically Level 3 or Level 3.5 as noted above. These zones often run Windows or Linux systems (historians, engineering workstations, jump servers, and domain controllers) that are older, less frequently patched if the OS is even still supported, and easier for adversarial living-off-the-land techniques than modern enterprise endpoints. Once an attacker reaches these systems (usually after compromising the corporate network through phishing, credential theft, or an exposed VPN), they can leverage native tools such as PowerShell, WMI, remote services, or existing credentials to move deeper into the OT network.

This vector remains the most frequently cited path in incident data. Classic examples include the 2015 Ukrainian power grid attacks, in which BlackEnergy malware entered via spear-phishing on the IT side, moved laterally into SCADA environments, and enabled operators to be locked out while attackers opened breakers and caused blackouts affecting hundreds of thousands of customers. Colonial Pipeline (2021) followed a similar pattern: a single compromised VPN account without multi-factor authentication provided IT access; the subsequent ransomware forced a precautionary shutdown of the OT-controlled pipeline even though the control systems themselves were not directly encrypted. Norsk Hydro's 2019 LockerGoga incident and the 2014 German steel mill attack (spear-phishing leading to loss of blast-furnace control and physical damage) further illustrate how IT footholds become OT problems because the IT environment is a much flatter topology than realized.

2. Direct Internet Access to OT

Not every path requires pivoting through IT. Many environments still have devices or services that are directly reachable from the internet. Common examples include exposed HMIs or SCADA interfaces, PLCs or controllers with open ports, vendor remote-access tools that terminate inside OT rather than in a properly brokered DMZ, and cellular gateways.

A striking recent example is the October 2026 wave of attacks against Danfoss refrigeration controllers (primarily AK-SM and AK-SC series, many end-of-life or running outdated firmware) at hundreds of French supermarkets, roughly 500 stores across chains including Intermarché, Netto, Coopérative U, and Carrefour. Attackers forced continuous defrost cycles, driving temperatures as high as 50 °C (122 °F). The result was massive food spoilage, financial losses in the tens of millions of euros, and in some cases electrical fires. CERT-FR issued alerts covering Danfoss and later expanded them to related Copeland/Dixell systems. Scans showed thousands of these supervisory controllers exposed on the public internet (Shodan, Censys, and similar tools routinely indexed them): many used weak or predictable authentication, including date-derived passwords in some models (linked to issues such as CVE-2025-41450). Follow-on activity affected stores in other European countries. Similar patterns appeared in U.S. water systems this past year, where groups such as CyberAv3ngers (IRGC-affiliated) have repeatedly targeted internet-exposed Unitronics and Rockwell Automation PLCs with default or missing credentials, causing disruptions and public concern.

3. Close Access and Supply Chain Compromise

The third major vector involves physical or trusted proximity. This includes USB and removable media introduced by engineers, contractors, or maintenance staff; transient cyber assets (vendor laptops that connect directly to engineering workstations or controllers); supply-chain compromise of firmware, software updates, or hardware before it reaches the site; insider actions (malicious or accidental); and physical access to control rooms, panels, or network infrastructure.

Stuxnet (2010) remains the canonical example: the malware was introduced via infected USB drives (and upstream supply-chain elements) into an air-gapped Iranian nuclear enrichment facility, then manipulated Siemens PLC logic controlling centrifuges while feeding operators false normal readings, ultimately damaging roughly 1,000 centrifuges. Triton/Trisis (2017) targeted a safety instrumented system in a Saudi petrochemical plant via an engineering workstation, aiming to disable safety functions. Havex/Dragonfly campaigns used trojanized vendor software and watering-hole attacks against energy sector organizations to gain OT reconnaissance. These cases show that even well-segmented networks remain vulnerable when the entry point is a trusted person, device, or software update that is already inside the physical or logical perimeter.

Implications for OT Threat Modeling

When modeling threats against an OT environment, start with these three vectors and map them onto the Purdue levels:

▪  Assume the Level 3/3.5 boundary will be tested. Model living-off-the-land movement, credential reuse, and protocol bridging from the DMZ or site operations layer downward (Ukraine 2015, Colonial Pipeline). This is the intersection between most of the common attack vectors with IT and OT internet connectivity, and should be the goal where you progress your risk testing.

▪  Watch the internet-reachable edge. Inventory and continuously monitor any internet-reachable OT assets or remote-access paths that do not terminate in a properly controlled IDMZ (Danfoss supermarket attacks, Unitronics water-system incidents).

▪  Physical and supply-chain entry points. Model the impact of a compromised engineering workstation, a malicious USB, or a tainted firmware update on Levels 1 and 2 (Stuxnet, Triton). The good news, from my experience, is that OT workflows are built for resilience and workarounds, but you still want to evaluate the potential east-west transference of cascading impact to neighboring processes.

▪  Prioritize by consequence. In OT, the highest-impact scenarios usually involve unauthorized changes to controller logic, safety system impairment, or loss of view/control rather than data exfiltration.

Frameworks such as MITRE ATT&CK for ICS provide useful technique-level detail once you have established the access vector and the Purdue level at which the adversary has landed. Segmentation that enforces the Level 3.5 principle, strict control of remote access, application allow-listing on Windows systems in Levels 2 through 3.5, and rigorous management of removable media and transient assets address the majority of observed pathways.

Closing Thoughts

The Purdue Model gives security and operations teams a shared language and map for discussing where systems live and where boundaries should exist, so you can evaluate the three primary threat access vectors:

▪  IT lateral movement through the inevitable connection.

▪  Direct internet exposure to OT.

▪  Close-access and supply-chain entry.

Most successful attacks do not require exotic zero-days against PLCs (or anything else for that matter, which is one of the reasons this is more marketing and FUD of the AI Vulnpocalypse). They exploit the operational realities of connectivity, aging Windows systems at the IT/OT boundary, exposed remote access, and the trust extended to people and devices that must physically interact with the process. Modeling those realities, and grounding them in incidents like the Danfoss refrigeration attacks or the Ukraine grid blackouts, produces more actionable risk reduction.