Why OT cybersecurity and physical security must converge in critical infrastructure

Critical infrastructure organizations depend on connected systems that do more than move data or control production. Physical access control, CCTV, HVAC, building systems and facility infrastructure can all affect safety, uptime and daily operations.

That makes cyber and physical security convergence a practical requirement. Cyber teams need to understand which connected systems are in scope, who can access them, and how disruption could affect the operation before an incident occurs.

Consider a data center with a security operations center that includes cybersecurity analysts and physical security personnel. The data center’s HVAC system is connected to the OT network for centralized management and energy optimization.

One morning, the cybersecurity team detects the HVAC controller communicating with an unauthorized external IP address. Analysts determine that malware has been installed on the HVAC management server and is attempting to move laterally.

The cybersecurity team isolates the affected assets, blocks outbound communications and collects forensic evidence. The physical security team reviews badge logs, CCTV footage and visitor records. Those records show that an external vendor accessed the HVAC control room two days earlier and connected a maintenance laptop to the engineering workstation.

Together, the teams trace the likely source to malware introduced through the vendor’s maintenance laptop. The cyber evidence shows what happened on the network. The physical evidence shows who accessed the equipment and how the malware may have entered the environment.

The practical value is speed and confidence. Cybersecurity and physical security teams can see how the incident unfolded and choose response steps that do not put operations at greater risk.

The Honeywell Technologies 2026 OT Cybersecurity Benchmark Report found that 43% of respondents do not include physical security systems in their OT security program, and 44% do not include facility infrastructure. That leaves a substantial share of connected systems outside OT security scope, even as those systems increasingly support uptime, safety, facility operations and incident response.

Convergence delivers stronger security context

Security teams need to know more than where an alert appeared. They need to know what the affected system does and what could happen if it is taken offline.

A malware alert on a business workstation is one kind of problem. The same alert on an HVAC controller or access control server can carry a different level of operational risk. Cooling, patient care, production and site access all depend on systems that may look ordinary in a cyber alert queue.

That is where convergence matters. When cybersecurity, physical security and facilities teams share context early, leaders can make safer response decisions. They can decide whether to isolate a system, involve facilities or escalate to OT before a technical action creates an operational problem.

Clear ownership makes convergence work

Cyber-physical security convergence depends on clear ownership. In many organizations, facilities, cybersecurity and physical security each hold part of the picture. During a CPS incident, those separate roles have to support one response.

That coordination must be defined before disruption occurs. Teams need to know who can authorize action on a building or facility system, where the evidence lives and when OT or facilities must be consulted. Without that clarity, a standard IT response, such as blocking access or isolating a device, can create operational disruption.

CISOs and OT security leaders should define the decision path in advance. Clear ownership helps all teams move faster, reduce handoffs and avoid response actions that solve one problem while creating another.

Physical security signals add cybersecurity context

Cyber investigations often start with technical signals from networks, endpoints and authentication systems. In a cyber-physical environment, those signals may show what happened on a system, but they may not explain how the activity began.

Physical security data can help fill in missing details. Badge records, CCTV footage, visitor logs and intrusion alarms can show whether recent site activity is relevant to the cyber event. A workstation alert may look routine until video shows someone connecting an unauthorized device. A suspicious connection may take on new meaning when access records show recent vendor maintenance on the affected equipment.

Used well, physical security data can turn a technical alert into a clearer sequence of events. That can help teams understand whether recent maintenance, site access or activity near the affected system played a role.

Test response before disruption

A response plan may look complete on paper. The real test comes when teams need access to logs, video, visitor records, system history and operational decision-makers.

Tabletop exercises can expose gaps before a real incident. They show whether evidence is accessible, whether the right teams know when to engage and whether response actions have been reviewed for operational impact. They also help confirm whether IT, OT, facilities, physical security, legal and compliance teams understand their roles before an incident occurs.

This preparation can affect how long disruption lasts. Our report found that 21% of incident-affected organizations with reactive or tool-by-tool programs reported at least one day of downtime, compared with 12% of those with planned or design-led programs.

For CISOs and OT security leaders, cyber-physical security planning should account for facility systems, investigation records and response steps that protect uptime, safety and continuity.

How Honeywell Technologies can help strengthen OT and physical security

Honeywell Technologies helps critical infrastructure organizations strengthen OT security across facility, building, and physical security systems. Our support includes cybersecurity assessments aligned with industry standards and regulations such as NIST CSF and NIS2, OT vulnerability assessments and penetration testing (VAPT), monitoring, incident response planning, tabletop exercises, and expert support during critical cyber incidents.

Honeywell Technologies also offers solutions such as Cyber Insights, which help organizations improve asset visibility, identify cyber risks, detect threats, and strengthen their overall OT cybersecurity posture.

Reach out to us to learn how.