We’re writing this while enduring one of the hottest Belgian summers in recent memory. That is by the way a good excuse to sit in the shade and get inspired again. Here’s a quick preview of what’s coming from us in the second half of 2026:
We’ve started recording “What is…” videos. Short pieces explaining foundational concepts in our own words. This article is the first one.
You asked for more technical depth, and we’re delivering: late September we’re launching our IT/OT Builds, a series where vendors walk through how their software solves real architectural challenges (we use the typicals we also use in our ITOT.Academy).
Also on popular request: yes, you can hire us to help pave the path towards your Data Platform/AI project or to just smoothen the relationship with the other side. We’re working on a dedicated page and offer, but feel free to reach out to David if you’d like to explore that further or take a look here.
This article is our first “What is…”, and what better place to start than the question that gave this whole publication its name: What is IT/OT convergence?
Before you start reading…
Our next IT/OT Academy kicks off September 18 with an updated program.
🙋 Join the ITOT.Academy →
And… have you already pre-ordered our IT/OT Handbook?
📘 Pre-order the IT/OT Handbook now (+ claim the bonuses!) →
IT/OT convergence.
The term was coined around the same time Industry 4.0 was introduced, and it’s also one of the most misunderstood ones in our field. So what is IT/OT convergence, why does everyone keep talking about it, and (more usefully) why does the conversation keep changing shape?
The What: Two Kinds of Convergence
IT/OT convergence is not one thing. There’s a technical side and an organisational side, and conflating the two is where most confusion — and most stalled initiatives — begins.
Technical convergence is the easier one to picture, especially if you’re an engineer. Fifteen, twenty years ago, IT and OT ran on genuinely different technology stacks: different networking, different protocols, different everything. Industry 4.0 brought the idea of reusing IT’s off-the-shelf technology inside the OT world too — Windows-based servers, standard networking components, a slow migration away from proprietary fieldbuses towards TCP/IP. Today, that side of the story is close to being solved. There’s no shortage of vendors and integration options; getting two networks to talk to each other is no longer the bottleneck it used to be.
Organisational convergence is the harder one, and it’s the one that actually explains why “convergence” projects stall. It doesn’t mean collapsing IT and OT into a single org chart or a single team — that’s a common, and unhelpful, misreading. What it actually requires is cooperation between two genuinely technical departments, each with its own expertise, its own instincts, and its own comfort zone. Neither side sets out to start a turf war. But when two skilled, self-sufficient technical groups suddenly have to share ground, friction shows up whether anyone intends it or not. Getting this right is less about restructuring and more about designing how the two sides actually work together — which is exactly why “Cooperate” is one of the three pillars our Book and Academy curriculum are built around, and not just a nice word on a mission statement.
The Why: Three Waves
Understanding the what only gets you so far. The more interesting question is why we’re still having this conversation, years after Industry 4.0 first promised to make it a non-issue. The answer is that IT/OT convergence hasn’t been one conversation, it’s been three, arriving in waves, each one building on the last rather than replacing it.
Wave 1: Infrastructure Convergence
This was the first wave, and it’s largely the story told above: shared infrastructure, standard networking, machine-to-machine (M2M) communication, the shift from serial fieldbuses to TCP/IP. It’s the wave that made everything after it possible — and, as we said, it’s the one that today feels genuinely close to done. Pick a good vendor, and the plumbing works.
Wave 2: Cybersecurity Convergence (or: the need for it)
Connectivity is never free.
The moment industrial systems started talking to enterprise networks and unfortunately sometimes the open internet, the obscurity that used to pass for OT security disappeared with it. For years, OT systems were “safe” mostly because they were boring: proprietary protocols nobody outside the plant understood, specialised hardware, and simply nothing worth stealing. Attackers went after credit card numbers and corporate secrets, not steam crackers and water pumps.
That changed. Stuxnet, in 2009, is the incident most people know — a targeted attack that physically damaged centrifuges in an Iranian enrichment facility by compromising the automation layer. It wasn’t the last of its kind: the 2015 attack on the Ukrainian power grid cut electricity to hundreds of thousands of people, and in 2017 Trisis went after industrial safety systems specifically — the one layer everyone assumed was untouchable. More recent incidents like Pipedream/Industroyer2 and FrostyGoop have kept targeting OT protocols directly.
But the headline-grabbing, nation-state-grade attacks aren’t actually the bigger risk for most manufacturers. Petya and WannaCry, in 2016 and 2017, weren’t built to target factories at all — they were IT ransomware that spread indiscriminately, and OT became collateral damage. Production lines went dark, hospitals lost access to equipment, and none of it happened because anyone was specifically after a plant. It happened because the plant was connected, and modern malware doesn’t check intent before it spreads.
That’s the problem we face: most OT security planning is built to stop the next Stuxnet, when the more realistic threat is the next WannaCry — one outdated laptop, plugged into the wrong network segment. And notice this wave isn’t purely technical either. Firewalls and network segmentation only get you so far if IT security and OT security are still run as two separate organisations with two separate policies.
Attackers don’t care about your org chart, so increasingly, neither can your security strategy.
Wave 3: Data & AI Convergence
Which brings us to where we are today. Industrial data itself isn’t new: OT data has been actively used for the better part of a decade. What’s new is AI acting as an accelerator, putting fresh pressure on the data foundation underneath it: how it’s structured, contextualised, and made scalable enough for AI use cases to move past a single proof of concept.
Here’s the thing about that “AI-first” framing, though: most organisations are still figuring out what AI actually means for them, while the data side of the equation is largely ignored. We know what good data structuring, ontology and context could look like. The technical challenge is bringing that data together in a way that’s centralised and scalable across IT and OT, so applications — AI or otherwise — can actually be built on top of it.
And once again, this isn’t purely a technical exercise. Bringing the technology together also means bringing the teams together, which loops straight back to organisational convergence: who owns this data — IT, OT, or some newly formed data team — and how do the people responsible for it actually cooperate, day to day?
So, Is IT/OT Convergence Real?
Here’s the pattern across all three waves: every wave starts as a technical story and ends up being an organisational one.
Infrastructure convergence made it possible for IT and OT to share a network — and then made it necessary for them to share responsibility for what runs on it.
Cybersecurity convergence made it possible to attack both sides of the business at once — and then made it necessary to stop treating IT and OT security as separate disciplines.
Data and AI convergence is making it possible to build one data foundation across both worlds — and it will make it necessary to figure out, organisationally, who’s accountable for it.
That’s really the answer to “what is IT/OT convergence”: it’s not a single project you finish, and it’s not primarily a technology purchase. It’s an ongoing pattern of two technical worlds discovering, wave after wave, that they need each other more than either side originally expected.
If you’re waiting for the moment when convergence is “done,” you’ll be waiting a while — we wrote about that illusion in a previous article, Ceci n’est pas IT/OT Convergence and in much more detail in our IT/OT Handbook.
Talk soon, Willem & David
Shareable image:
