Who Can Still Log Into Your Factory at 2:00 A.M.
Your access review counts names. An attacker counts paths.
Your access review counts names. An attacker counts paths.
An account nobody revoked is a vendor relationship that outlived the contract.
Ask your team how many accounts can reach the plant network from outside the building. You will get a number. It comes from VPN group membership, and it is low enough to sound managed.
Now count paths instead. The SSL VPN. The remote access tool the OEM installed during commissioning and still supports on their own licence. The jump host with a shared local account the integrator uses, because provisioning named accounts took longer than the last outage did. The cellular modem the vendor builds into every skid they ship.
The second number is the one an attacker works from.
Order decides whether work exists, and the host decides whether anyone can see it. Access is the third strand of the IT tether, and it decides who else is standing at your controls.
Your access review counts the wrong noun
The annual review takes the list you already hold and asks whether each name still needs what it has. It has no way of asking what never reached the list. An OEM engineer connecting to a machine they support under warranty does not generate a row in your identity system, and the commissioning project that created their path closed three years ago.
Vendor sprawl is the shape this takes at scale. Secomea’s 2026 industrial remote access research put it plainly: confidence in access control runs ahead of actual control, and the gap widens with every vendor added.
The part where having MFA stops being an answer
Akira has been reaching organizations through SonicWall SSL VPN appliances, and Rapid7 documented the combination that made it work. An unpatched CVE-2024-40766, disclosed in August 2024, sat alongside a group default that over-provisioned access to SSLVPN services.
The piece worth your attention is the third one. The Virtual Office Portal was reachable from the internet in default configurations, and an attacker already holding a valid username and password could use it to enroll their own MFA token. The second factor became something the attacker issued to themselves.
“We have MFA” answers a question about your architecture. It does not answer whether the enrollment path is exposed, and those are different questions with different owners.
How long a door stays open once nobody is watching it
Black Kite’s third-party breach report, published 5 March 2026, put unauthorized network access at 47.06 percent of verified breaches in 2025. Ransomware accounted for 13.24 percent and stolen credentials for 6.62 percent. The same work found an average of 5.28 downstream victims for every third-party breach, the highest figure they have recorded, and an average of 730 days to detect an advanced persistent threat.
Two years. Set that against the standing vendor account nobody revoked and the question stops being whether a door is open. It becomes what has already been done through it, by someone who had no reason to hurry.
Inventory paths, and give every one an expiry date
They inventory paths rather than people. One row per way in, with the vendor, the purpose, the owner inside the company, and a date it stops working.
That last field does the work. Vendor access expires by default, and somebody has to ask for it back. An OEM who needs standing access to support a warranty will ask, which turns an invisible permission into a conversation with a renewal date on it.
What you can do this week
If you’re a plant or OT leader: Walk one line and write down every way a person outside the building could reach something on it, including the modems and the vendor tools. Compare that against the access review you signed.
If you’re a CISO or enterprise risk lead: Run the 2 a.m. list at one site. Every account and path that could authenticate to plant systems tonight. Report the count that was not on the access review, because that number is the finding.
If you’re a COO or CFO: Ask what happens to a vendor’s access when their contract ends. If the answer describes a process rather than an expiry date, the access is still live at sites you stopped paying for years ago.
A final thought
None of this reads as a security failure while it is happening. It reads as a plant that gets support quickly, an integrator who can fix a line at midnight without a ticket, and an uptime number your board likes. The access built to protect production is the access most likely to end it, and the reason it survives every review is that it works.
Your turn
Pick your last commissioning project. Whose remote access did it create, and is that access still live tonight? If you cannot answer without calling the integrator, they are holding a key to your factory and the record of who has used it.
This post is part of The IT Tether series. Read every chapter in one place in The IT Tether eBook, or book a demo to see how Resilion maps what stops your line.