Security Through Subtraction: The Biggest OT Risk Reductions Won’t Come from Anything You Buy

The biggest risk reductions in your program this year won’t come from anything you buy. They’ll come from what you remove.

Walk into any critical-infrastructure security program and count the tools. Forty-five on average at enterprise security teams, and the number climbs every year (IBM/Ponemon, 2020). We are very good at adding. We are almost incapable of removing. I want to make the case that in operational technology especially, that instinct is backwards: the biggest risk reductions available to you this year won’t come from a new platform. They’ll come from what you take away.

Why We Can’t Stop Adding

Three incentives keep the ratchet turning in one direction. Compliance scores presence, not absence. An absent control is a finding, while a deliberate, virtuous absence is, at best, a conversation with your auditor. Vendors land and expand, and every tool you add has a renewal motion; there is no renewal motion for a tool you removed. And nobody got fired for buying because adding is easy to defend in a post-incident review, and subtracting, so far, is not. The asymmetry is brutal: remove the tool and there’s an incident, you removed it; keep the tool and there’s an incident, it’s the tool’s fault. So, we keep the tool.

The Hidden Cost of Addition

None of that additive cost shows up on the purchase order. Three costs show up later. 

• Integration debt: every tool has to talk to every other tool, and connector count grows roughly with the square of tool count. 

• Alert volume: each new sensor at default sensitivity adds noise faster than signal; the average tier-1 analyst already faces about 4,484 alerts a day (Vectra, 2023). 

• Attack surface: every agent is a daemon, every connector is a credential, every console is a target. 

The data backs the discomfort; showing organizations running more than about fifty security tools rank lower in detection and response, not higher (IBM/Ponemon, 2020). Past a point, we are buying our way into worse outcomes.

In OT, Every Tool You Add Is a Tool You Hand the Attacker

This isn’t abstract in operational technology. Living-off-the-land is now the dominant intrusion style: 84% of high-severity attacks in 2024–2025 leveraged legitimate system tools rather than custom malware (CrowdStrike). Volt Typhoon didn’t bring malware, it lived inside U.S. critical-infrastructure networks for years using the native tools and remote-access pathways already there (CISA, AA24-038A). Every management interface, every remote-support agent, every jump host you stand up to defend the environment is one more thing an adversary can turn against it. And the way in is usually someone else’s access: 82% of cyber-physical-systems organizations had an attack in the past year that originated from third-party access; and, 63% don’t fully understand that connectivity in the first place (Claroty, 2024). In IT, being wrong costs you data. In OT, being wrong is physical. You can’t restore a substation from backup.

What Subtraction Actually Looks Like

Subtraction isn’t “buy less.” It’s replacing standing, persistent, always-on infrastructure with things that exist only when they’re needed. Five patterns carry most of the value, and every one of them is a removal:

• Standing access → time-boxed sessions. Credentials become necessary, not sufficient; the path is built by an approver, for a window, then torn down.

• Persistent paths → ephemeral, moving-target routing. No stable IP and port to find on a Tuesday night because the path is generated at session start and gone at session end.

• Long-lived credentials → just-in-time identity. Nothing sitting in a vault to steal; credentials are minted per session and expire with it.

• The jump host → disposable workspaces. The most defended box in your network — and your highest-value target — replaced by a workspace destroyed when the session ends.

• The VPN → a brokered, policy-enforced gateway. The user gets the destination, not the network behind it; explicit deny by default.

Each of these removes a foothold rather than adding a guard. And each denies something specific to a living-off-the-land adversary: a standing account to authenticate against, a stable path to enumerate, a credential to extract, a persistent host to pivot from, a flat network to roam. That’s the whole idea: you don’t out-monitor an attacker who’s using your own tools against you. You remove the tools. 

The Frameworks Are Already Walking This Way

If subtraction feels contrarian, look at where the standards are headed. NIST 800-53 is a catalog of roughly 1,200 mostly additive control statements — a monument to presence. NIST CSF and IEC 62443 are transitional: outcome-based, crediting boundary controls and zone-and-conduit isolation, which is subtraction by another name, removing implicit pathways between zones until they earn a conduit. NIST 800-82 for OT is boundary-first for exactly the reasons above. And NIST 800-207, zero trust, is subtractive to its core: every principle rewards the removal of implicit trust. Subtraction isn’t a fringe position. It’s the direction of travel.

The Politics of Subtraction

Here’s the honest objection I hear in every room: “I tried to remove the VPN once, and I lost my job.” Subtraction needs cover, and there are four ways to get it. 

• Run parallel for a quarter — leave the old tool in place and prove the absence is safe before you cut for real. 

• Frame removal as consolidation, not reduction — “we retired two overlapping tools” survives a board readout; “we turned off the SIEM” does not. 

• Start with the smallest removal — the win is in the precedent, not the count. 

• Write the post-incident answer first — draft the paragraph you’d write if there were a breach next quarter; if you can defend it on paper, you can defend it in the room.

Three Removals You Can Start This Quarter

None of these needs a procurement cycle:

• Time-box one vendor. Pick a vendor with standing access into OT and cut it from 168 hours a week to four. Watch what breaks. Almost nothing will.

• Retire your smallest VPN concentrator. Not the big one — the one with the fewest users. Replace it with a brokered path. The win is the precedent.

• Sunset your three oldest service accounts. Put a 90-day rotation deadline on them. The deadline is the artifact, not the rotation.

Three removals. One quarter. Nothing bought.

The Bottom Line

I keep a sticky note that says: "The most expensive security control is the one you never had to install." In OT, where the cost of being wrong is measured in physical consequences, that isn’t a philosophy. It’s a risk strategy.

At Dispel, the Dispel Zero Trust Engine is the operational expression of these five patterns: time-bound access, moving-target routing, just-in-time identity, disposable workspaces, and brokered, clientless access — in production at critical-infrastructure operators today. But you don’t need us to start subtracting. You need permission, and a small first cut.

Learn how OT teams are reducing risk, protecting uptime, and eliminating standing access. Read the SANS whitepaper →