What are OT and IoT, and why do they make IAM harder?

OT (operational technology) monitors and controls industrial machines, plants and processes; IoT (Internet of Things) means small embedded devices that act as Internet-connected actors. Both add large numbers of non-human actors with special constraints.

• Operational technology (OT): hardware and software that detects or causes changes in the physical world by directly monitoring and controlling industrial equipment: production lines, building control, power plants, pipelines. Classic OT was isolated and proprietary; today it is increasingly networked with IT ("IT/OT convergence").
• Internet of Things (IoT): integrated (often tiny) devices such as sensors, cameras, trackers or smart meters that connect to the Internet and act on their own.

Why this matters for IAM:

• They are actors, not just resources. A sensor that pushes readings to a cloud service needs an identity and credentials, just like a person logging in.
• Scale: a factory may have far more devices than employees, so manual account handling is impossible.
• Constraints: many devices cannot run a browser login, show a password prompt or be patched often. OT systems may run for decades and cannot be taken offline for an update.
• Consequences: wrong access in OT does not just leak data; it can stop production or create physical danger.

Go deeper:

• Operational technology (Wikipedia) — definition, typical systems and the IT/OT convergence.
• Internet of things (Wikipedia) — what counts as an IoT device and the security problems they bring.