"My next patching opportunity is February 2027, because the production line can't be stopped."
Trevor Dearing runs Industry Solutions at Illumio. He hears a version of that from security leaders in many countries he visits. If you run EV chargers, substations, pumping stations or a factory floor, the line will sound familiar.
On 8 October Trevor joined IXT CTO Henning Solberg for an hour on the question behind it: how do you secure devices you can't patch, can't scan and can't install software on? Let's look at some key takeaways from the session:
IoT and OT are not the same problem
Most security teams file IoT and OT under one heading. Trevor argues that is a mistake. An OT device sits inside a hierarchy of control systems on a production line, a power grid or a treatment plant. An IoT device, a meter, a tracker, a charger, works on its own and reports straight back to a cloud or head-end system. They fail in different ways, so they need protecting in different ways.
"Treating them as one creates blind spots within your organisation." Trevor Dearing, Illumio
Henning added a grey zone: edge devices with AI capability, which behave far more like OT than a simple sensor does. If your fleet mixes all three, one security model will leave gaps somewhere.
The IT playbook does not transfer
In IT you patch, you scan and you install an agent. In OT each of those carries risk. Trevor told the story of a company that ran an active vulnerability scan on its OT network and crashed the whole environment. Patch windows come once or twice a year, if that.
At the far end of the network sits a different problem. Henning described the constrained IoT device: a small processor, nobody on site, years in the field. It has no way to protect itself. Whatever protection it gets has to come from the network around it.
AI widens the gap
Both speakers see AI shortening the time it takes to find a weakness. Patching has not sped up to match. Trevor quoted a customer:
"I can't patch the 10 vulnerabilities I know about that are really important, let alone the 1000 that have been found by frontier AI."
His advice: stop trying to patch your way out. Surround your most exposed systems and allow only the connections they need.
Regulators want proof of control
Regulation points the same way. NIS2 widened the sectors in scope, energy, transport, water, manufacturing and health among them, and it places accountability at board and C-suite level. The Cyber Resilience Act sets security requirements for connected products themselves. Device makers also face the cybersecurity requirements in the Radio Equipment Directive.
Henning's point: enforcement now reaches IoT and OT as well as IT. Under NIS2, control of the endpoint is what you will be asked to show.
Zero Trust in one sentence
Zero Trust has a hundred definitions. Trevor's is the shortest we have heard:
"It's a shift away from trying to find the bad stuff and stopping it, to identifying the good stuff and allowing it. Because there's a lot less good stuff than there is bad stuff." Trevor Dearing, Illumio
For your fleet, that means allow rules, not block lists. A sensor talks to one controller, on one protocol, and nothing else.
Do you know what your devices are talking to?
The most telling moment came when Henning described what happens the first time you switch on traffic visibility. An EV charger was configured to talk to a single backend. It turned out to be doing something else as well:
"There is a module from a manufacturer that sits in this charger, attempting to connect to a firmware server somewhere in South Korea." Henning Solberg, IXT
Trevor sees the same pattern in banking:
"We know exactly our ATM is only connected to here. But suddenly it's got six other connections. And this shocks people." Trevor Dearing, Illumio
Neither example has to be malicious. Both are connections nobody planned for, and nobody was watching.
So here is a question to take into your next audit. Do you have a list of every connection your devices made last week? Would it stand up in front of a regulator?
Watch the full session on demand.
This article was first published on 13 October 2026 in Secure SIM Insights, IXT's weekly newsletter on LinkedIn. Subscribe on LinkedIn to get each edition when it comes out.
Why trust this guide
This guidance is based on real IoT and OT deployments in regulated industries including energy, utilities, and industrial environments.
IXT designs and operates secure connectivity architectures where:
- devices are deployed across multiple countries and networks
- SIM-level identity is enforced at the network edge
- third-party access is controlled without VPNs
- audit trails are required for regulatory compliance (including NIS2)
The patterns described here reflect how these environments are secured in practice, not theoretical models.
About the author
This article was written by the IXT Connectivity and Security team.
IXT operates a full MVNO core network and delivers secure IoT connectivity across 190+ countries and 600+ mobile networks. The team works directly with industrial, utilities, and infrastructure operators to design and secure large-scale IoT and OT deployments.
Their focus is on network-level Zero Trust architecture, SIM-based identity, and secure device communication without relying on VPNs or endpoint agents.
