Chances are your Siemens S7-1200 or S7-1500 is already reporting into something. Maybe OPC UA. Maybe MQTT. Both are good at pulling process values out of the controller and into your monitoring stack.

Somewhere on your production floor, there is a Siemens S7-300 or S7-400 running a process that simply cannot go down. A filling line. A pump station. A conveyor feeding the next stage of assembly. And chances are, nobody on the IT side is watching it the way they watch a server.

Ask an OT security lead at any utility why their SCADA network sits behind an air gap, and the answer is almost always the same: because it has to. Substations, generation assets, and the RTUs and PLCs running them are critical infrastructure, and critical infrastructure gets isolated on purpose.

Somewhere between a wind farm substation and the utility's central control room sits a patchwork of equipment nobody quite planned for. Programmable logic controllers running firmware from a decade ago. Remote terminal units wired into protection relays older than the company's IT department. A SCADA system that, until fairly recently, nobody outside the operations team had ever logged into. That patchwork is now part of the energy sector's information technology and operational technology landscape whether anyone designed it that way or not - and it's exactly the kind of environment where IT/OT convergence gets tested for real, not on a slide.

The NIS2 directive is no longer a project on the horizon. It is enforced EU law, and national law in most member states now reflects its requirements for cybersecurity risk management, incident reporting, and business continuity. Compared with its predecessor, NIS1, the scope has grown substantially: many more organizations across critical sectors and important entities now fall under the regulation, from energy and transport to healthcare, banking, and digital infrastructure.