Nextro Insight: Securing critical infrastructure in New Zealand with a threat-informed OT defence
Operational technology environments that underpin critical infrastructure are facing an increasingly sophisticated threat landscape. In a recent Fortinet article on OT security, it is clear that traditional perimeter-focused and IT-centric network security approaches are no longer sufficient to defend industrial control systems against modern, behaviour driven attacks.
A Fortinet blogpost highlights the need for a threat-informed defence model that aligns security operations with the real tactics, techniques and procedures used by modern adversaries. At Nextro, we work closely with businesses across New Zealand’s critical infrastructure and utilities sectors to strengthen OT network resilience with strategies that combine OT visibility with threat intelligence, behavioural detection, and coordinated response.
Why OT security is critical for New Zealand’s critical infrastructure
Operational technology systems control and monitor physical processes across energy, transport, manufacturing and utilities sectors. Many of these systems were designed for reliability and uptime rather than cybersecurity, which makes them attractive targets for threat actors.
Fortinet notes that attackers are increasingly targeting OT environments with advanced techniques designed to disrupt operations rather than simply steal data. For New Zealand organisations operating essential services, the financial and societal impact of downtime can be significant.
What a threat-informed defence means
- Mapping security controls to real world attack behaviours so defenders understand how adversaries operate in OT environments.
- Embedding layered protection across industrial networks, including segmentation, monitoring and response capabilities.
- Using intelligence and automation to prioritise alerts and reduce investigation time.
- Aligning detection and response capabilities to adversary tactics documented in frameworks such as MITRE ATT&CK for ICS.
A call to action: how New Zealand critical infrastructure operators can protect OT networks now
To strengthen the security of operational technology environments, New Zealand organisations should prioritise practical, threat-informed measures that directly reduce exposure and improve resilience.
Close foundational security gaps in OT environments
- Enforce multi factor authentication for remote access into OT networks
- Remove or change default credentials on industrial devices and control systems
- Implement strong identity and access management across IT and OT domains
- Conduct regular external attack surface assessments to identify exposed services
Align security operations with real world attacker behaviour
- Develop playbooks aligned to frameworks such as MITRE ATT&CK for ICS
- Integrate threat intelligence with logging, monitoring and analysis platforms
- Apply network segmentation to prevent lateral movement between IT and OT environments
- Use deception or detection technologies to identify abnormal movement within industrial networks
Plan for operational disruption
- Run tabletop exercises that simulate OT specific attack scenarios
- Establish coordinated incident response processes across IT and OT teams
- Train staff to recognise phishing, social engineering and AI generated threats
- Test backup and recovery processes to ensure operational continuity
This structured approach ensures that OT security controls are directly mapped to documented adversary behaviours, strengthening resilience against both opportunistic and targeted attacks.
Nextro’s role in strengthening New Zealand’s OT security
At Nextro, we help New Zealand businesses build OT security strategies that reflect the realities of modern threat landscapes. Our services include:
- OT network risk assessments tailored to critical infrastructure environments.
- Deployment of integrated security platforms that unify visibility, detection and response across IT and OT networks.
- Secure network design and segmentation solutions to contain threats and reduce attack surfaces.
Given the increased targeting of industrial and OT environments globally, strengthening OT defences is now a strategic necessity for businesses operating critical infrastructure in New Zealand. By adopting a threat-informed defence, with automation, context, and intelligence at its core, New Zealand businesses can stay ahead of evolving cyber threats while maintaining the continuity of essential services.
Contact Nextro today to secure your critical infrastructure with a threat-informed OT defence.