Zscaler flags vendor access control gap in OT workshops

Zscaler has published findings from a dozen OT architecture workshops with manufacturers in discrete, process, food and beverage, pharma and chemicals. Nine of the twelve already had a named mechanism for third-party access into OT, but almost all lacked vendor control: the ability to decide who gets in, to what, for how long, and to stop a session in progress.

The company describes three common shapes of vendor access, an OEM gateway that dials home on the vendor’s credentials, IT remote access through a VPN and jump host, and OT-native remote-access products chosen because the plant network forced the decision. It argues control should move off the plant network and onto the session, and points to CISA’s April 2026 zero trust guidance for OT and the January 2026 Secure Connectivity Principles as supporting that direction.

Zscaler says its Privileged Remote Access product brokers sessions through the Zero Trust Exchange, with no jump host or landing zone, time-bound approvals, vaulted credentials and session recording, and pairs it with Zero Trust Branch segmentation and Zscaler Cellular for sites without WAN.