OT Visibility: The Production Case for Mining

An overloaded autonomous haul truck drops to 15 km/h, and nothing on site raises a flag. The strongest case for OT visibility is made in production, not in the security budget.

Key Takeaways

OT visibility is usually pitched as a security requirement, where it competes with site priorities and often loses. The stronger case is production.
The same real-time view of OT assets and data that detects a threat also shows where throughput is quietly leaking, such as an overloaded autonomous haul truck limiting itself to a crawl.
Air gaps are a memory. Research finds 40% of industrial organisations studied have OT assets insecurely connected to the internet, and seeing that environment safely takes OT-native tooling.
Connectivity is now a production variable, and regulation is moving from documented policy to evidence of control, including across supply chains.

On a large Australian mine site, an autonomous haul truck has just slowed to about 15 km/h. It is carrying around 200 tonnes of ore. Nothing has failed. No alarm has sounded. The fleet system shows a healthy truck, the network is up and the security console is quiet. It was loaded beyond its limit, so it dropped into a protective crawl mode, exactly as designed. It is a production problem, and it is also an OT visibility problem.

Nobody notices, because the only symptom is a truck moving slowly. Multiply that across a fleet and a shift, and the loss becomes material. It is precisely the kind of loss that OT visibility is good at finding. Yet finding it is almost never the reason OT visibility gets funded.

The Truck Was Fine. The Loading Data Was Missing.

The truck is making a sensible decision. Overloading puts stress on the drivetrain, tyres and brakes, so it protects itself. Underloading is the opposite problem: every cycle carries less than the truck could have moved. The traditional fix was an instruction to the loading crew to load more. That tended to overcorrect into overloading and more crawling.

What changes the outcome is data, not instruction. Share real-time payload data with the loading crew, and trucks can leave the face at around 95 per cent of optimal. They carry close to capacity, run at full speed, and throughput rises without anything else on site slowing down.

The same data does more once it is combined with conditions. After heavy rain, loading slightly lighter protects the haul roads. That matters. A chewed-up road means graders, repairs and lost production measured in days rather than minutes. Haulage is also already the heaviest cost line in open-pit mining. A recent systematic review puts it at 50 to 60 per cent of total mining costs (Lotsu et al., 2026).

For years, this kind of fleet data sat inside proprietary, equipment-specific systems. Operators now expect it to flow into their wider operational and enterprise data. That is the point at which it becomes both valuable and exposed.

OT Visibility Keeps Losing the Budget Argument

OT visibility is usually presented to a site as a security requirement. That framing pits it against other security spend. More often, it pits it against the site’s own priorities: the shutdown schedule, the maintenance backlog, the next production target. A site leader measured on tonnes and safety will reasonably rank an abstract cyber risk below a concrete production one.

The framing is the problem, not the site leader. A security team uses real-time OT visibility to spot an unfamiliar connection. The same view shows operations where throughput leaks, which assets misbehave and where a process drifts. Government guidance already recognises the overlap. Joint OT inventory guidance co-sealed by ASD’s ACSC lists cost savings, less downtime and better efficiency among its benefits, and recommends real-time monitoring of process variables (ASD’s ACSC, 2025).

Built as one case, visibility stops being a cost the site tolerates and becomes part of how the site runs. Built as two cases, it usually loses both.

Air Gaps Are a Memory

Much OT security thinking still assumes that plant networks are physically separate from everything else. On most large sites that separation is gone. Controllers, sensors and vehicles now speak IP over Ethernet, Wi-Fi and private LTE. Their data can flow into enterprise platforms, and risk can flow back the other way.

Claroty’s Team82 analysed close to one million OT devices across manufacturing, logistics and natural resources. It found that 40 per cent of organisations had OT assets insecurely connected to the internet (Claroty Team82, 2025). Claroty also reviewed more than 200 attacks on cyber-physical systems during 2025. In 82 per cent, attackers reached exposed, internet-facing assets remotely, and many needed no vulnerability at all (Claroty, 2026). Closer to home, Nozomi Networks Labs ranked Australia first for alerts per organisation from June to August 2026, with manufacturing the most targeted industry (Nozomi Networks Labs, cited in iTWire, 2026).

Seeing that environment takes tooling built for it. OT networks run industrial protocols that general IT tools do not interpret. Many field devices were never designed to handle unexpected traffic. An active scan that a corporate laptop would shrug off can disrupt a fragile controller. That is why passive, protocol-aware monitoring is the sensible default for OT visibility on a production network. Orro looked at that path by path in When the Factory Floor Meets the Network.

None of this makes isolation obsolete. It turns isolation into a deliberate capability rather than a standing condition. ASD’s CI Fortify guidance asks operators to be able to isolate vital OT systems for three months while keeping critical services running (ASD, 2025). Its first preparatory step is an up-to-date inventory of OT assets and their dependencies. An operator cannot plan to cut connections it cannot see.

Evidence Snapshot

On exposure

40% of industrial organisations analysed had OT assets insecurely connected to the internet (Claroty Team82, 2025)
82% of attacks on cyber-physical systems studied in 2025 involved remote access to exposed, internet-facing assets, and 66% involved compromise of HMI or SCADA systems (Claroty, 2026)

On the Australian picture

Australia recorded the highest number of OT and IoT alerts per organisation of any country from June to August 2026 (Nozomi Networks Labs, cited in iTWire, 2026)

On the production stakes

Haulage accounts for 50 to 60% of total mining costs (Lotsu et al., 2026)

Connectivity Is Now a Production Variable

On a large open-cut site, the haul from pit to processing can run 25 kilometres. Wi-Fi was never built for that distance. Private LTE and 5G networks provide the coverage and latency autonomous fleets need. The difference shows up directly in production. In Orro’s experience, trucks held back by patchy connectivity run well below design speed. They lift sharply once coverage and latency are fixed.

The pattern holds well beyond mining. A major Australian airport has 20 to 30 kilometres of fence line. Connected cameras on a dedicated network use movement detection to tell wildlife from a person, so staff respond immediately. In each case, the network no longer sits quietly underneath operations. It is one of the variables that sets how fast, how safely and how productively the operation runs.

That is why connectivity and visibility belong in the same conversation. ASD’s ACSC and international partners released secure connectivity principles for OT in January 2026. They accept that connectivity delivers operational benefits but can raise cyber risk if it is not managed (ASD’s ACSC, 2026). One principle is to monitor connectivity and detect threats early. Every new link that lifts production is also a path that needs to be seen.

What Critical Infrastructure Leaders Told Us in Sydney

At a roundtable Orro facilitated at the Cyber Resilience Summit NSW in Sydney on 29 October, leaders from water, telecommunications, food and airport operations spent much of the conversation on vulnerabilities and patching. Underneath sat a harder problem. Several had asset discovery or monitoring tools in place, yet still lacked a validated picture of how their OT environments actually run. Others described experienced engineers and operators retiring, and real doubt about whether the people who remain could sustain manual operation for long.

Supplier dependencies came up too. Participants described suppliers, including some using AI in their services, who could not or would not explain how and where their data is processed. The common thread matches this article’s argument: a dashboard can show green while nobody has proven the operation can keep running, or recover, when something fails.

Earlier in October, Orro and Splunk hosted a session with technology and security leaders from banking, utilities and logistics. They arrived at a similar point from a different direction: the gap between how mature an organisation’s policies look on paper and how mature its operations really are. We’ll share more from that conversation in a dedicated piece soon.

From Policy to Proof: OT Visibility Is the Evidence

Regulation is moving the same way, through the Security of Critical Infrastructure Act 2018 (SOCI Act). Its enhanced Critical Infrastructure Risk Management Program (CIRMP) Rules took effect on 10 June 2026. They go further than asking for a documented program. They cover specific asset classes, including critical electricity, gas, water, liquid fuel and freight assets. For those assets they name measures such as critical system segregation, phishing-resistant MFA, supply chain mapping and vendor assessment (CISC, 2026). Offshore remote access to OT control systems is singled out as a risk in its own right. Most measures fall due by June 2028. Each of those is far easier to evidence with OT visibility than without it.

The supply chain requirement reaches further than many organisations expect. A mining or manufacturing business may not be a responsible entity under the Act at all. But if it supplies, maintains or operates services for one, it should expect questions. It will be asked for evidence of how it manages risk to the systems it touches. Visibility is how that question gets answered with data rather than assurances.

Whether, and how, the Security of Critical Infrastructure Act 2018 applies depends on each organisation’s assets, sector and responsible entity status. Obligations should always be confirmed against your specific circumstances with appropriate legal and regulatory advice.

One Data Foundation, Two Returns

The overloaded truck, the slowed fleet and the unseen connection share one root cause. The operation cannot see its own OT environment in real time. Fix that, and the returns land on both sides of the ledger. Operations get tonnes, uptime and haul roads that last. Security gets an inventory, a baseline of normal and the evidence regulators now expect. When the same data foundation pays for itself in production, security stops being a tolerated line item. It becomes part of how the site runs.

When something does look wrong, response matters too. Orro’s earlier piece When the Conveyor Stops covers OT incident response in depth.

For organisations working through SOCI, the first practical step is often simpler than it looks. It starts with knowing who needs to be in the room. Get that right, and seeing your obligations clearly gets much easier.

Get the right people in the room

Orro’s SOCI conversation planner is a short meeting-prep tool. It helps you work out who to bring to a SOCI conversation with Orro and what to find out beforehand. Your answers are processed in your browser and are not sent to Orro.

PLAN YOUR SOCI CONVERSATION

OT Visibility: Common Questions

What is OT visibility?

OT visibility is a real-time, accurate view of the operational technology on a site: which controllers, sensors, vehicles and systems exist, how they communicate and what normal behaviour looks like. It is the foundation for both securing an OT environment and running it efficiently.

Why does OT visibility matter for production, not just security?

The same data that reveals an unfamiliar connection also shows where throughput is leaking, such as an overloaded autonomous haul truck slowing itself to a crawl, or a process drifting from normal. Treating visibility as one investment with two returns makes a stronger case than treating it as a security cost alone.

Can IT security tools monitor OT networks?

Not safely on their own. OT networks run industrial protocols that general IT tools do not interpret, and many field devices were not designed to handle unexpected traffic. Passive, protocol-aware monitoring built for OT is the sensible default on a production network.

What do the enhanced SOCI CIRMP Rules require?

The enhanced CIRMP Rules commenced on 10 June 2026 and apply to specified critical infrastructure asset classes, including electricity, gas, water, liquid fuel and freight. They name measures such as segregation of critical systems, phishing-resistant multi-factor authentication, supply chain mapping and vendor assessment. Applicability is specific to each organisation and asset, so confirm your position with legal and regulatory advisers.

Does SOCI affect suppliers to critical infrastructure?

An organisation that is not itself a responsible entity can still be drawn in. Where a SOCI-regulated entity must map its supply chain and assess vendors, its suppliers should expect to be asked for evidence of how they manage risk. Confirm any obligations with your legal advisers.

Orro recently facilitated a roundtable with critical infrastructure leaders at the Cyber Resilience Summit NSW in Sydney on 29 October 2026. Thank you to everyone who joined the conversation.