December 20, 2023

Ivanti Sentry Vulnerability | Analysis & Insights

Darktrace observed a critical vulnerability in Ivanti Sentry's cybersecurity. Learn how this almost become a huge threat and how we stopped it in its tracks.

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Sam Lister

Specialist Security Researcher

Dec 2023

In an increasingly interconnected digital landscape, the prevalence of critical vulnerabilities in internet-facing systems stands as an open invitation to malicious actors. These vulnerabilities serve as a near limitless resource, granting attackers a continually array of entry points into targeted networks.

In the final week of August 2023, Darktrace observed malicious actors validating exploits for one such critical vulnerability, likely the critical RCE vulnerability, CVE-2023-38035, on Ivanti Sentry servers within multiple customer networks. Shortly after these successful tests were carried out, malicious actors were seen delivering crypto-mining and reconnaissance tools onto vulnerable Ivanti Sentry servers.

Fortunately, Darktrace DETECT™ was able to identify this post-exploitation activity on the compromised servers at the earliest possible stage, allowing the customer security teams to take action against affected devices. In environments where Darktrace RESPOND™ was enabled in autonomous response mode, Darktrace was further able inhibit the identified post-exploitation activity and stop malicious actors from progressing towards their end goals.

Exploitation of Vulnerabilities in Ivanti Products

The software provider, Ivanti, offers a variety of widely used endpoint management, service management, and security solutions. In July and August 2023, the Norwegian cybersecurity company, Mnemonic, disclosed three vulnerabilities in Ivanti products [1]/[2]/[3]; two in Ivanti's endpoint management solution, Ivanti Endpoint Manager Mobile (EPMM) (formerly called 'MobileIron Core'), and one in Ivanti’s security gateway solution, Ivanti Sentry (formerly called 'MobileIron Sentry'):

CVE-2023-35078

CVSS Score: 10.0
Affected Product: Ivanti EPMM
Details from Ivanti: [4]/[5]/[6]
Vulnerability type: Authentication bypass

CVE-2023-35081

CVSS Score: 7.2
Affected Product: Ivanti EPMM
Details from Ivanti: [7]/[8]/[9]
Vulnerability type: Directory traversal

CVE-2023-38035

CVSS Score:
Affected Product: Ivanti Sentry
Details from Ivanti: [10]/[11]/[12]
Vulnerability type: Authentication bypass

At the beginning of August 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) provided details of advanced persistent threat (APT) activity targeting EPMM systems within Norwegian private sector and government networks via exploitation of CVE-2023-35078 combined with suspected exploitation of CVE-2023-35081.

In an article published in August 2023 [12], Ivanti disclosed that a very limited number of their customers had been subjected to exploitation of the Ivanti Sentry vulnerability, CVE-2023-38035, and on the August 22, 2023, CISA added the Ivanti Sentry vulnerability, CVE-2023-38035 to its ‘Known Exploited Vulnerabilities Catalogue’. CVE-2023-38035 is a critical authentication bypass vulnerability affecting the System Manager Portal of Ivanti Sentry systems. The System Manager Portal, which is accessible by default on port 8433, is used for administration of the Ivanti Sentry system. Through exploitation of CVE-2023-38035, an unauthenticated actor with access to the System Manager Portal can achieve Remote Code Execution (RCE) on the underlying Ivanti Sentry system.

Observed Exploitation of CVE-2023-38035

On August 24, Darktrace observed Ivanti Sentry servers within several customer networks receiving successful SSL connections over port 8433 from the external endpoint, 34.77.65[.]112. The usage of port 8433 indicates that the System Manager Portal was accessed over the connections. Immediately after receiving these successful connections, Ivanti Sentry servers made GET requests over port 4444 to 34.77.65[.]112. The unusual string ‘Wget/1.14 (linux-gnu)’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, wget, was abused to initiate the requests.

Figure 1: Event Log data for an Ivanti Sentry system showing the device breaching a range of DETECT models after contacting 34.77.65[.]112.The suspicious behavior highlighted by DETECT was subsequently investigated by Darktrace’s Cyber AI Analyst™, which was able to weave together these separate behaviors into single incidents representing the whole attack chain.

‍

Figure 2: AI Analyst Incident representing a chain of suspicious activities from an Ivanti Sentry server.

In cases where Darktrace RESPOND was enabled in autonomous response mode, RESPOND was able to automatically enforce the Ivanti Sentry server’s normal pattern of life, thus blocking further exploit testing.

Figure 3: Event Log for an Ivanti Sentry server showing the device receiving a RESPOND action immediately after trying to 34.77.65[.]112.

The GET requests to 34.77.65[.]112 were responded to with the following HTML document:

Figure 4: Snapshot of the HTML document returned by 34.77.65[.]112.

None of the links within this HTML document were functional. Furthermore, the devices’ downloads of these HTML documents do not appear to have elicited further malicious activities. These facts suggest that the observed 34.77.65[.]112 activities were representative of a malicious actor validating exploits (likely for CVE-2023-38035) on Ivanti Sentry systems.

Over the next 24 hours, these Ivanti Sentry systems received successful SSL connections over port 8433 from a variety of suspicious external endpoints, such as 122.161.66[.]161. These connections resulted in Ivanti Sentry systems making HTTP GET requests to subdomains of ‘oast[.]site’ and ‘oast[.]live’. Strings containing ‘curl’ appeared in the User-Agent headers of these requests, indicating that the command-line utility, cURL, was abused to initiate the requests.

These ‘oast[.]site’ and ‘oast[.]live’ domains are used by the out-of-band application security testing (OAST) service, Interactsh. Malicious actors are known to abuse this service to carry out out-of-band (OOB) exploit testing. It, therefore, seems likely that these activities were also representative of a malicious actor validating exploits for CVE-2023-38035 on Ivanti Sentry systems.

Figure 5: Event Log for Ivanti Sentry system showing the device contacting an 'oast[.]site' endpoint after receiving connections from the suspicious, external endpoint 122.161.66[.]161.

The actors seen validating exploits for CVE-2023-38035 may have been conducting such activities in preparation for their own subsequent malicious activities. However, given the variety of attack chains which ensued from these exploit validation activities, it is also possible that they were carried out by Initial Access Brokers (IABs) The activities which ensued from exploit validation activities identified by Darktrace fell into two categories: internal network reconnaissance and cryptocurrency mining.

Reconnaissance Activities

In one of the reconnaissance cases, immediately after receiving successful SSL connections over port 8443 from the external endpoints 190.2.131[.]204 and 45.159.248[.]179, an Ivanti Sentry system was seen making a long SSL connection over port 443 to 23.92.29[.]148, and making wget GET requests over port 4444 with the Target URIs '/ncat' and ‘/TxPortMap’ to the external endpoints, 45.86.162[.]147 and 195.123.240[.]183.

Figure 6: Event Log data for an Ivanti Sentry system showing the device making connections to the external endpoints, 45.86.162[.]147, 23.92.29[.]148, and 195.123.240[.]183, immediately after receiving connections from rare external endpoints.

The Ivanti Sentry system then went on to scan for open SMB ports on systems within the internal network. This activity likely resulted from an attacker dropping a port scanning utility on the vulnerable Ivanti Sentry system.

Figure 7: Event Log data for an Ivanti Sentry server showing the device breaching several DETECT models after downloading a port scanning tool from 195.123.240[.]183.

In another reconnaissance case, Darktrace observed multiple wget HTTP requests with Target URIs such as ‘/awp.tar.gz’ and ‘/resp.tar.gz’ to a suspicious, external server (78.128.113[.]130). Shortly after making these requests, the Ivanti Sentry system started to scan for open SMB ports and to respond to LLMNR queries from other internal devices. These behaviors indicate that the server may have installed an LLMNR poisoning tool, such as Responder. The Ivanti Sentry server also went on to conduct further information-gathering activities, such as LDAP reconnaissance, HTTP-based vulnerability scanning, HTTP-based password searching, and RDP port scanning.

Figure 8: Event Log data for an Ivanti Sentry system showing the device making connections to 78.128.113[.]130, scanning for an open SMB port on internal endpoints, and responding to LLMNR queries from internal endpoints.

In cases where Darktrace RESPOND was active, reconnaissance activities resulted in RESPOND enforcing the Ivanti Sentry server’s pattern of life.

Figure 9: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its SMB port scanning activity.

Figure 10: Event Log data for an Ivanti Sentry system receiving a RESPOND action as a result of its LDAP reconnaissance activity.

Crypto-Mining Activities

In one of the cryptomining cases, Darktrace detected an Ivanti Sentry server making SSL connections to aelix[.]xyz and mining pool endpoints after receiving successful SSL connections over port 8443 from the external endpoint, 140.228.24[.]160.

Figure 11: Event Log data for an Ivanti Sentry system showing the device contacting aelix[.]xyz and mining pool endpoints immediately after receiving connections from the external endpoint, 140.228.24[.]160.

In a cryptomining case on another customer’s network, an Ivanti Sentry server was seen making GET requests indicative of Kinsing malware infection. These requests included wget GET requests to 185.122.204[.]197 with the Target URIs ‘/unk.sh’ and ‘/se.sh’ and a combination of GET and POST requests to 185.221.154[.]208 with the User-Agent header ‘Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36’ and the Target URIs, ‘/mg’, ‘/ki’, ‘/get’, ‘/h2’, ‘/ms’, and ‘/mu’. These network-based artefacts have been observed in previous Kinsing infections [13].

Figure 12: Event Log data for an Ivanti Sentry system showing the device displaying likely Kinsing C2 activity.

On customer environments where RESPOND was active, Darktrace was able to take swift autonomous action by blocking cryptomining connection attempts to malicious command-and-control (C2) infrastructure, in this case Kinsing servers.

Figure 13: Event Log data for an Ivanti Sentry server showing the device receiving a RESPOND action after attempting to contact Kinsing C2 infrastructure.

Fortunately, due to Darktrace DETECT+RESPOND prompt identification and targeted actions against these emerging threats, coupled with remediating steps taken by affected customers’ security teams, neither the cryptocurrency mining activities nor the network reconnaissance activities led to significant disruption.

Figure 14: Timeline of observed malicious activities.

Conclusion The inevitable presence of critical vulnerabilities in internet-facing systems underscores the perpetual challenge of defending against malicious intrusions. The near inexhaustible supply of entry routes into organizations’ networks available to malicious actors necessitates a more proactive and vigilant approach to network security.

While it is, of course, essential for organizations to secure their digital environments through the regular patching of software and keeping abreast of developing vulnerabilities that could impact their network, it is equally important to have a safeguard in place to mitigate against attackers who do manage to exploit newly discovered vulnerabilities.

In the case of Ivanti Sentry, Darktrace observed malicious actors validating exploits against affected servers on customer networks just a few days after the public disclosure of the critical vulnerability. This activity was followed up by a variety of malicious and disruptive, activities including cryptocurrency mining and internal network reconnaissance.

Darktrace DETECT immediately detected post-exploitation activities on compromised Ivanti Sentry servers, enabling security teams to intervene at the earliest possible stage. Darktrace RESPOND, when active, autonomously inhibited detected post-exploitation activities. These DETECT detections, along with their accompanying RESPOND interventions, prevented malicious actors from being able to progress further towards their likely harmful objectives.

Credit to Sam Lister, Senior Cyber Analyst, and Trent Kessler, SOC Analyst

‍

Appendices

MITRE ATT&CK Mapping

Initial Access techniques:

Exploit Public-Facing Application (T1190)

Credential Access techniques:

Unsecured Credentials: Credentials In Files (T1552.001)
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)

Discovery

Network Service Discovery (T1046)
Remote System Discovery (T1018)
Account Discovery: Domain Account (T1087.002)

Command and Control techniques:

Application Layer Protocol: Web Protocols (T1071.001)
Ingress Tool Transfer (T1105)
Non-Standard Port (T1571)
Encrypted Channel: Asymmetric Cryptography (T1573.002)

Impact techniques

Resource Hijacking (T1496)

List of IoCs

Exploit testing IoCs:

· 34.77.65[.]112

· Wget/1.14 (linux-gnu)

· cjjovo7mhpt7geo8aqlgxp7ypod6dqaiz.oast[.]site • 178.128.16[.]97

· curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

· cjk45q1chpqflh938kughtrfzgwiofns3.oast[.]site • 178.128.16[.]97

· curl/7.29.0

Kinsing-related IoCs:

· 185.122.204[.]197

· /unk.sh

· /se.sh

· 185.221.154[.]208

· 45.15.158[.]124

· Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

· /mg

· /ki

· /get

· /h2

· /ms

· /mu

· vocaltube[.]ru • 185.154.53[.]140

· 92.255.110[.]4

· 194.87.254[.]160

Responder-related IoCs:

· 78.128.113[.]130

· 78.128.113[.]34

· /awp.tar.gz

· /ivanty

· /resp.tar.gz

Crypto-miner related IoCs:

· 140.228.24[.]160

· aelix[.]xyz • 104.21.60[.]147 / 172.67.197[.]200

· c8446f59cca2149cb5f56ced4b448c8d (JA3 client fingerprint)

· b5eefe582e146aed29a21747a572e11c (JA3 client fingerprint)

· pool.supportxmr[.]com

· xmr.2miners[.]com

· monerooceans[.]stream

· xmr-eu2.nanopool[.]org

Port scanner-related IoCs:

· 122.161.66[.]161

· 192.241.235[.]32

· 45.86.162[.]147

· /ncat

· Wget/1.14 (linux-gnu)

· 45.159.248[.]179

· 142.93.115[.]146

· 23.92.29[.]148

· /TxPortMap

· 195.123.240.183

· 6935a8d379e086ea1aed159b8abcb0bc8acf220bd1cbc0a84fd806f14014bca7 (SHA256 hash of downloaded file)

Darktrace DETECT Model Breaches

· Anomalous Server Activity / New User Agent from Internet Facing System

· Device / New User Agent

· Anomalous Connection / New User Agent to IP Without Hostname

· Device / New User Agent and New IP

· Anomalous Connection / Application Protocol on Uncommon Port

· Anomalous Connection / Callback on Web Facing Device

· Compromise / High Volume of Connections with Beacon Score

· Compromise / Large Number of Suspicious Failed Connections

· Compromise / High Volume of Connections with Beacon Score

· Compromise / Beacon for 4 Days

· Compromise / Agent Beacon (Short Period)

· Device / Large Number of Model Breaches

· Anomalous Server Activity / Rare External from Server

· Compromise / Large Number of Suspicious Successful Connections

· Compromise / Monero Mining

· Compromise / High Priority Crypto Currency Mining

· Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

· Device / Internet Facing Device with High Priority Alert

· Device / Suspicious SMB Scanning Activity

· Device / Internet Facing Device with High Priority Alert

· Device / Network Scan

· Device / Unusual LDAP Bind and Search Activity

· Compliance / Vulnerable Name Resolution

· Device / Anomalous SMB Followed By Multiple Model Breaches

· Device / New User Agent To Internal Server

· Anomalous Connection / Suspicious HTTP Activity

· Anomalous Connection / Unusual Internal Connections

· Anomalous Connection / Suspicious HTTP Activity

· Device / RDP Scan

· Device / Large Number of Model Breaches

· Compromise / Beaconing Activity To External Rare

· Compromise / Beacon to Young Endpoint

· Anomalous Connection / Suspicious HTTP Activity

· Compromise / Suspicious Internal Use Of Web Protocol

· Anomalous File / EXE from Rare External Location

· Anomalous File / Internet Facing System File Download

· Device / Suspicious SMB Scanning Activity

· Device / Internet Facing Device with High Priority Alert

· Device / Network Scan

· Device / Initial Breach Chain Compromise

References

[1] https://www.mnemonic.io/resources/blog/ivanti-endpoint-manager-mobile-epmm-authentication-bypass-vulnerability/
‍[2] https://www.mnemonic.io/resources/blog/threat-advisory-remote-file-write-vulnerability-in-ivanti-epmm/
‍[3] https://www.mnemonic.io/resources/blog/threat-advisory-remote-code-execution-vulnerability-in-ivanti-sentry/
‍[4] https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
‍[5] https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US
‍[6] https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078?language=en_US
‍[7] https://www.ivanti.com/blog/cve-2023-35081-new-ivanti-epmm-vulnerability
‍[8] https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US
‍[9] https://forums.ivanti.com/s/article/KB-Arbitrary-File-Write-CVE-2023-35081?language=en_US
‍[10] https://www.ivanti.com/blog/cve-2023-38035-vulnerability-affecting-ivanti-sentry
‍[11] https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US
‍[12] https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US
‍[13] https://isc.sans.edu/diary/Your+Business+Data+and+Machine+Learning+at+Risk+Attacks+Against+Apache+NiFi/29900

Written by

Sam Lister

Specialist Security Researcher

Inside the SOC

Written by

Sam Lister

Specialist Security Researcher

The Darktrace Community

Watch the NIS2 Webinar

Blog

Compliance

November 25, 2025

UK Cyber Security & Resilience Bill: What Organizations Need to Know

Why the Bill has been introduced

The UK’s cyber threat landscape has evolved dramatically since the 2018 NIS regime was introduced. Incidents such as the Synnovis attack against hospitals and the British Library ransomware attack show how quickly operational risk can become public harm. In this context, the UK Department for Science, Innovation and Technology estimates that cyber-attacks cost UK businesses around £14.7 billion each year.

At the same time, the widespread adoption of AI has expanded organisations’ attack surfaces and empowered threat actors to launch more effective and sophisticated activities, including crafting convincing phishing campaigns, exploiting vulnerabilities and initiating ransomware attacks at unprecedented speed and scale.

The CSRB responds to these challenges by widening who is regulated, accelerating incident reporting and tightening supply chain accountability, while enabling rapid updates that keep pace with technology and emerging risks.

Key provisions of the Cyber Security and Resilience Bill

A wider set of organisations in scope

The Bill significantly broadens the range of organisations regulated under the NIS framework.

Managed service providers (MSPs) - medium and large MSPs, including MSSPs, managed SOCs, SIEM providers and similar services,will now fall under NIS obligations due to their systemic importance and privileged access to client systems. The Information Commissioner’s Office (ICO) will act as the regulator. Government analysis anticipates that a further 900 to 1,100 MSPs will be in scope.
Data infrastructure is now recognised as essential to the functioning of the economy and public services. Medium and large data centres, as well as enterprise facilities meeting specified thresholds, will be required to implement appropriate and proportionate measures to manage cyber risk. Oversight will be shared between DSIT and Ofcom, with Ofcom serving as the operational regulator.
Organisations that manage electrical loads for smart appliances, such as those supporting EV charging during peak times, are now within scope.

These additions sit alongside existing NIS-regulated sectors such as transport, energy, water, health, digital infrastructure, and certain digital services (including online marketplaces, search engines, and cloud computing).

Stronger supply chain requirements

Under the CSRB, regulators can now designate third-party suppliers as ‘designated critical suppliers’ (DCS) when certain threshold criteria are met and where disruption could have significant knock-on effects. Designated suppliers will be subject to the same security and incident-reporting obligations as Operators of Essential Services (OES) and Relevant Digital Service Providers (RDSPs).

Government will scope the supply chain duties for OES and RDSPs via secondary legislation, following consultation. infrastructure incidents where a single supplier’s compromise caused widespread disruption.

Faster incident reporting

Sector-specific regulators, 12 in total, will be responsible for implementing the CSRB, allowing for more effective and consistent reporting. In addition, the CSRB introduces a two-stage reporting process and expands incident reporting criteria. Regulated entities must submit an initial notification within 24 hours of becoming aware of a significant incident, followed by an incident report within 72 hours. Incident reporting criteria are also broadened to capture incidents beyond those which actually resulted in an interruption, ensuring earlier visibility for regulators and the National Cyber Security Centre (NCSC). The importance of information sharing across agencies, law enforcement and regulators is also facilitated by the CSRB.

The reforms also require data centres and managed service providers to notify affected customers where they are likely to have been impacted by a cyber incident.

An agile regulatory framework

To keep pace with technological change, the CSRB will enable the Secretary of State to update elements of the framework via secondary legislation. Supporting materials such as the NCSC Cyber Assessment Framework (CAF) are to be "put on a stronger footing” allowing for requirements to be more easily followed, managed and updated. Regulators will also now be able to recover full costs associated with NIS duties meaning they are better resourced to carry out their associated responsibilities.

Relevant Managed Service Providers must identify and take appropriate and proportionate measures to manage risks to the systems they rely on for providing services within the UK. Importantly, these measures must, having regard to the state of the art, ensure a level of security appropriate to the risk posed, and prevent or minimise the impact of incidents.

The Secretary of State will also be empowered to issue a Statement of Strategic Priorities, setting cross-regime outcomes to drive consistency across the 12 competent authorities responsible for implementation.

Penalties

The enforcement framework will be strengthened, with maximum fines aligned with comparable regimes such as the GDPR, which incorporate maximums tied to turnover. Under the CSRB, maximum penalties for more serious breaches could be up to £17 million or 4% of global turnover, whichever is higher.

Next steps

The Bill is expected to progress through Parliament over the course of 2025 and early 2026, with Royal Assent anticipated in 2026. Once enacted, most operational measures will not take immediate effect. Instead, Government will bring key components into force through secondary legislation following further consultation, providing regulators and industry with time to adjust practices and prepare for compliance.

Anticipated timeline

2025-2026: Parliamentary scrutiny and passage;
2026: Royal Assent;
2026 consultation: DSIT intends to consult on detailed implementation;
From 2026 onwards: Phased implementation via secondary legislation, following further consultation led by DSIT.

How Darktrace can help

The CSRB represents a step change in how the UK approaches digital risk, shifting the focus from compliance to resilience.

Darktrace can help organisations operationalise this shift by using AI to detect, investigate and respond to emerging threats at machine speed, before they escalate into incidents requiring regulatory notification. Proactive tools which can be included in the Darktrace platform allow security teams to stress-test defences, map supply chain exposure and rehearse recovery scenarios, directly supporting the CSRB’s focus on resilience, transparency and rapid response. If an incident does occur, Darktrace’s autonomous agent, Cyber AI Analyst, can accelerate investigations and provide a view of every stage of the attack chain, supporting timely reporting.

Darktrace’s AI can provide organisations with a vital lens into both internal and external cyber risk. By continuously learning patterns of behaviour across interconnected systems, Darktrace can flag potential compromise or disruption to detect supply chain risk before it impacts your organisation.

In a landscape where compliance and resilience go hand in hand, Darktrace can equip organisations to stay ahead of both evolving threats and evolving regulatory requirements.

[related-resource]

About the author

The Darktrace Community

Blog

OT

November 20, 2025

Managing OT Remote Access with Zero Trust Control & AI Driven Detection

managing OT remote access with zero trust control and ai driven detection

The shift toward IT-OT convergence

Recently, industrial environments have become more connected and dependent on external collaboration. As a result, truly air-gapped OT systems have become less of a reality, especially when working with OEM-managed assets, legacy equipment requiring remote diagnostics, or third-party integrators who routinely connect in.

This convergence, whether it’s driven by digital transformation mandates or operational efficiency goals, are making OT environments more connected, more automated, and more intertwined with IT systems. While this convergence opens new possibilities, it also exposes the environment to risks that traditional OT architectures were never designed to withstand.

The modernization gap and why visibility alone isn’t enough

The push toward modernization has introduced new technology into industrial environments, creating convergence between IT and OT environments, and resulting in a lack of visibility. However, regaining that visibility is just a starting point. Visibility only tells you what is connected, not how access should be governed. And this is where the divide between IT and OT becomes unavoidable.

Security strategies that work well in IT often fall short in OT, where even small missteps can lead to environmental risk, safety incidents, or costly disruptions. Add in mounting regulatory pressure to enforce secure access, enforce segmentation, and demonstrate accountability, and it becomes clear: visibility alone is no longer sufficient. What industrial environments need now is precision. They need control. And they need to implement both without interrupting operations. All this requires identity-based access controls, real-time session oversight, and continuous behavioral detection.

The risk of unmonitored remote access

This risk becomes most evident during critical moments, such as when an OEM needs urgent access to troubleshoot a malfunctioning asset.

Under that time pressure, access is often provisioned quickly with minimal verification, bypassing established processes. Once inside, there’s little to no real-time oversight of user actions whether they’re executing commands, changing configurations, or moving laterally across the network. These actions typically go unlogged or unnoticed until something breaks. At that point, teams are stuck piecing together fragmented logs or post-incident forensics, with no clear line of accountability.

In environments where uptime is critical and safety is non-negotiable, this level of uncertainty simply isn’t sustainable.

The visibility gap: Who’s doing what, and when?

The fundamental issue we encounter is the disconnect between who has access and what they are doing with it.

Traditional access management tools may validate credentials and restrict entry points, but they rarely provide real-time visibility into in-session activity. Even fewer can distinguish between expected vendor behavior and subtle signs of compromise, misuse or misconfiguration.

As a result, OT and security teams are often left blind to the most critical part of the puzzle, intent and behavior.

Closing the gaps with zero trust controls and AI‑driven detection

Managing remote access in OT is no longer just about granting a connection, it’s about enforcing strict access parameters while continuously monitoring for abnormal behavior. This requires a two-pronged approach: precision access control, and intelligent, real-time detection.

Zero Trust access controls provide the foundation. By enforcing identity-based, just-in-time permissions, OT environments can ensure that vendors and remote users only access the systems they’re explicitly authorized to interact with, and only for the time they need. These controls should be granular enough to limit access down to specific devices, commands, or functions. By applying these principles consistently across the Purdue Model, organizations can eliminate reliance on catch-all VPN tunnels, jump servers, and brittle firewall exceptions that expose the environment to excess risk.

Access control is only one part of the equation

Darktrace / OT complements zero trust controls with continuous, AI-driven behavioral detection. Rather than relying on static rules or pre-defined signatures, Darktrace uses Self-Learning AI to build a live, evolving understanding of what’s “normal” in the environment, across every device, protocol, and user. This enables real-time detection of subtle misconfigurations, credential misuse, or lateral movement as they happen, not after the fact.

By correlating user identity and session activity with behavioral analytics, Darktrace gives organizations the full picture: who accessed which system, what actions they performed, how those actions compared to historical norms, and whether any deviations occurred. It eliminates guesswork around remote access sessions and replaces it with clear, contextual insight.

Importantly, Darktrace distinguishes between operational noise and true cyber-relevant anomalies. Unlike other tools that lump everything, from CVE alerts to routine activity, into a single stream, Darktrace separates legitimate remote access behavior from potential misuse or abuse. This means organizations can both audit access from a compliance standpoint and be confident that if a session is ever exploited, the misuse will be surfaced as a high-fidelity, cyber-relevant alert. This approach serves as a compensating control, ensuring that even if access is overextended or misused, the behavior is still visible and actionable.

If a session deviates from learned baselines, such as an unusual command sequence, new lateral movement path, or activity outside of scheduled hours, Darktrace can flag it immediately. These insights can be used to trigger manual investigation or automated enforcement actions, such as access revocation or session isolation, depending on policy.

This layered approach enables real-time decision-making, supports uninterrupted operations, and delivers complete accountability for all remote activity, without slowing down critical work or disrupting industrial workflows.

Where Zero Trust Access Meets AI‑Driven Oversight:

Granular Access Enforcement: Role-based, just-in-time access that aligns with Zero Trust principles and meets compliance expectations. ‍
Context-Enriched Threat Detection: Self-Learning AI detects anomalous OT behavior in real time and ties threats to access events and user activity. ‍
Automated Session Oversight: Behavioral anomalies can trigger alerting or automated controls, reducing time-to-contain while preserving uptime. ‍
Full Visibility Across Purdue Layers: Correlated data connects remote access events with device-level behavior, spanning IT and OT layers. ‍
Scalable, Passive Monitoring: Passive behavioral learning enables coverage across legacy systems and air-gapped environments, no signatures, agents, or intrusive scans required.

Complete security without compromise

We no longer have to choose between operational agility and security control, or between visibility and simplicity. A Zero Trust approach, reinforced by real-time AI detection, enables secure remote access that is both permission-aware and behavior-aware, tailored to the realities of industrial operations and scalable across diverse environments.

Because when it comes to protecting critical infrastructure, access without detection is a risk and detection without access control is incomplete.

About the author

Pallavi Singh

Product Marketing Manager, OT Security & Compliance

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Ivanti Sentry Vulnerability | Analysis & Insights

Exploitation of Vulnerabilities in Ivanti Products

Observed Exploitation of CVE-2023-38035

Reconnaissance Activities

Crypto-Mining Activities

Appendices

MITRE ATT&CK Mapping

List of IoCs

References

Xillen Stealer Updates to Version 5 to Evade AI Detection

UK Cyber Security & Resilience Bill: What Organizations Need to Know

Enjoying the blog?

More in this series

Xillen Stealer Updates to Version 5 to Evade AI Detection

Unmasking Vo1d: Inside Darktrace’s Botnet Detection

Darktrace Named the Only 2025 Gartner® Peer Insights™ Customers’ Choice for Network Detection and Response

Blog

Compliance

November 25, 2025

UK Cyber Security & Resilience Bill: What Organizations Need to Know

Why the Bill has been introduced

Key provisions of the Cyber Security and Resilience Bill

A wider set of organisations in scope

Stronger supply chain requirements

Faster incident reporting

An agile regulatory framework

Penalties

Next steps

Anticipated timeline

How Darktrace can help

Blog

OT

November 20, 2025

Managing OT Remote Access with Zero Trust Control & AI Driven Detection

The shift toward IT-OT convergence

The modernization gap and why visibility alone isn’t enough

The risk of unmonitored remote access

The visibility gap: Who’s doing what, and when?

Closing the gaps with zero trust controls and AI‑driven detection

Access control is only one part of the equation

Where Zero Trust Access Meets AI‑Driven Oversight:

Complete security without compromise