The tell was a list of MAC addresses. Testers compared the clients associated with the corporate SSID against the hosts they were seeing on the control room LAN, and the same addresses turned up in both places [4]. Nothing had to be exploited to produce that: the write-up from Pentest Partners says the IT-OT segmentation could be broken without the testers doing anything at all [19], and it surfaced during the passive monitoring and low-risk probing that their OT engagements start with [14].
The mechanism is dull, which is the point. Engineers asked the IT provider for corporate and internet access from the control room, and the provider reused the routes out that the control room already had for SaaS traffic [5]. That delivered outbound internet to corporate machines sitting in the control room [1]. An access point, though, has no concept of mapping an SSID to a particular network, so when someone from the offices walked over with a phone in a pocket and a laptop under an arm, their devices roamed and landed on the control network [6]. The wireless had been explained to the testers as provision for corporate laptops and personal devices at breaks and lunches [7].
A segmentation review built on firewall configuration would not have found this. The path existed because clients roamed across a shared SSID, not because a rule permitted it, so the evidence lives in radio coverage and in client-to-subnet correlation rather than in a ruleset [20]. Devices simply hopped between the IT and OT sides [2], and the population on the control LAN grew to include laptops and mobiles of various makes where only OT gear, HMIs and servers were expected [3].
Both directions carry something. Corporate hosts bring in the consequences of business-facing attacks such as phishing and commodity malware [8], and on this network even malware that merely probed for hosts could be enough to crash devices [9]. In the other direction, OT segments can carry commodity malware while continuing to run normally, so an infection dormant on the control side can be walked back out to IT [10].
The interesting part of the engagement is what the testers refused to write. Banning personal devices, changing the SSID, or cutting the control room's internet were all available recommendations, and each was rejected as incomplete or unworkable against how the room actually runs [13]. The stated requirement had been internet access to view logistics dashboards showing orders to fulfil [17]. Questions produced a different picture: operators sometimes check upcoming orders or watch CCTV during process operation, and they were also reading work email on control room PCs through the business cloud service [11]. Some OT estates do have real cloud dependencies, such as PLC management platforms or outstation telemetry, but this one did not, and none of the stated needs required an OT machine to reach the internet when a second device could serve them [12] [18]. The report's own standard for closing a segmentation finding is whether the fix addresses the demand that created it, or whether that demand returns in another form [16].
