Key takeaways
- Cisco introduced the entry-level Cisco OT Security Practitioner certification to bridge skills gaps across industrial operational technology and IT environments.
- The certification focuses on practical plant-floor security: segmenting industrial networks, monitoring ICS traffic, and executing incident response.
- Cisco Talos research revealed that nearly 40% of the top 100 exploited vulnerabilities in 2025 affected legacy, end-of-life hardware common in industrial environments.
- Cisco Modeling Labs 2.11 launches November 11, 2026, adding native Kali Linux support, SAML/OIDC Single Sign-On, and wireless node clustering.
- Official training starts on Cisco U. on November 5, 2026, followed by Networking Academy availability in January 2027 and exam availability on February 3, 2027.
Cisco has introduced two infrastructure updates aimed at bridging the technical divide between enterprise networking and operational technology (OT): a new Cisco OT Security Practitioner certification and the release of Cisco Modeling Labs (CML) version 2.11. The entry-level certification validates operational competencies in industrial network segmentation, industrial control system (ICS) traffic monitoring, and plant-floor incident response. Official training begins on Cisco U. on November 5, 2026, followed by Cisco Networking Academy availability in January 2027, with formal exam testing commencing February 3, 2027. Concurrently, CML 2.11 launches November 11, 2026, adding native Kali Linux node support, enterprise Single Sign-On (SSO), and wireless node clustering for simulation environments.
Cisco Adds Entry-Level OT Security Path and CML 2.11 Lab Tooling
The announcements, detailed by Ryan Rose, Director of Skills and Certifications Product Management at Learn with Cisco, reflect evolving workforce requirements across enterprise infrastructure. Network administrators, cloud architects, and security personnel increasingly find their operational domains overlapping. IT security personnel frequently lack familiarity with plant-floor protocols, while industrial engineers face growing pressure to protect connected programmable logic controllers (PLCs) and supervisory systems against sophisticated network-borne attacks.
The Cisco OT Security Practitioner certification targets early-career practitioners, IT administrators transitioning to industrial settings, and technical students. It establishes baseline validation for concepts that previously required ad-hoc, specialized training. Rather than focusing purely on administrative policy, the certification emphasizes hands-on operational tasks: establishing network boundaries around critical equipment, inspecting industrial Ethernet protocols, and containing active anomalies without causing physical disruption.
To support practical testing across both security and networking curricula, Cisco updated its on-premises virtual lab engine, Cisco Modeling Labs. The CML 2.11 release provides software emulation of authentic Cisco operating systems—including IOS, IOS-XE, NX-OS, and IOS-XR—supplemented with tools for penetration testing and identity management.
| Offering | Release Date | Delivery Channel | Primary Audience |
|---|---|---|---|
| OT Security Practitioner Training | November 5, 2026 | Cisco U. | Early-career OT practitioners, IT engineers |
| CML 2.11 Software Platform | November 11, 2026 | Direct download / on-premises | Network and security engineers, CCIE candidates |
| Networking Academy OT Curriculum | January 2027 | Cisco Networking Academy | Students, academic institutions |
| OT Security Practitioner Exam | February 3, 2027 | Pearson VUE / Cisco Live testing | Certification candidates |
Operational Risk and the Limits of Traditional IT Security in Plant Environments
Industrial operational environments cannot be managed with standard enterprise IT playbooks. In corporate IT, security architectures prioritize confidentiality and data integrity, frequently deploying automated endpoint agents, weekly vulnerability scanning, and scheduled reboot cycles for software patches. In contrast, operational technology environments prioritize physical safety and continuous system availability. A reboot or an unannounced active port scan can freeze a sensitive PLC, halt an assembly line, or cause safety hazards in utility infrastructure.
This operational reality has created severe security challenges. Data from the Cisco Talos 2025 Year in Review revealed that nearly 40 percent of the top 100 exploited vulnerabilities in 2025 affected end-of-life (EOL) devices. Industrial facilities, water treatment plants, power grids, and logistics hubs frequently operate specialized hardware across 15- to 30-year lifecycle spans. Because these devices cannot be patched without extensive vendor qualification and planned plant shutdowns, perimeter defense and granular traffic segmentation remain the primary lines of protection.
To defend legacy machinery without disrupting physical operations, Cisco positions Cisco Cyber Vision as a core operational technology. Cyber Vision embeds passive monitoring sensors directly into industrial switches and routers. This architecture allows security operations centers to maintain an asset inventory, track communication paths between industrial automation devices, and flag protocol anomalies without injecting disruptive diagnostic traffic onto the plant floor. Similar to broader portfolio investments such as Cisco data center networking initiatives, the approach attempts to turn the physical network fabric into an active telemetry and enforcement mechanism.
Hands-On Validation: Kali Linux and Enterprise Identity in CML 2.11
While the new OT certification establishes a learning track, Cisco Modeling Labs 2.11 provides the sandbox infrastructure required to test network designs safely before production deployment. The update addresses long-standing operational requests from network engineers, certification candidates, and enterprise lab administrators.
A primary addition is native support for Kali Linux nodes. Security engineers preparing for credentials such as the CCNP Security core exam (350-701 SCOR) can now embed a standardized penetration testing node directly into simulated topologies. This enables engineers to generate network probes, evaluate firewall access lists, and verify intrusion prevention system (IPS) sensor rules against live virtual Cisco operating systems.
| Feature | Technical Function | Target Exam / Operational Use |
|---|---|---|
| Kali Linux Support | Simulates attacker and penetration-testing nodes within lab topologies | CCNP Security core exam (350-701 SCOR) defense validation |
| Enterprise Single Sign-On | Integrates authentication with OIDC, OAuth2, and SAML identity providers | CCNP Enterprise core exam (350-401 ENCOR) identity management |
| Wireless Node Clustering | Enables scaled simulation of complex multi-node wireless architectures | CCNP Enterprise Wireless Design (ENWLSD) and Implementation (ENWLSI) |
| Bulk Lab Download | Exports and backs up complete lab collections in a single operation | CCIE candidate study management and enterprise lab audits |
For enterprise teams, CML 2.11 incorporates Single Sign-On (SSO) integration supporting OpenID Connect (OIDC), OAuth 2.0, and SAML. This aligns lab platform access with corporate identity providers, meeting enterprise compliance standards while reflecting identity architectures tested in the CCNP Enterprise core exam (350-401 ENCOR). In addition, wireless node clustering expands simulation scale for engineers pursuing CCNP Enterprise Wireless Design (ENWLSD) and Implementation (ENWLSI) credentials, and a bulk export feature allows engineers managing complex CCIE study topologies to back up and migrate multiple lab files simultaneously.
What happens next
Engineering organizations and professionals preparing for these offerings face several near-term milestones across late 2026 and early 2027:
- November 5, 2026: Cisco OT Security Practitioner training material becomes accessible on Cisco U., providing candidate study guides and interactive coursework.
- November 11, 2026: Cisco Modeling Labs 2.11 becomes available for software download, allowing network teams to deploy Kali Linux nodes and configure enterprise SSO authentication.
- January 2027: Cisco Networking Academy rolls out OT security coursework to academic institutions and vocational training programs worldwide.
- February 3, 2027: The Cisco OT Security Practitioner certification exam opens for testing, launching immediately ahead of Cisco Live London. Exam blueprint topics are available for review now on the Cisco Learning Network.
Enterprise infrastructure directors should review whether their plant-floor security controls rely on ad-hoc coordination between disparate teams. With end-of-life device exploitation accounting for a significant share of operational threats, formalizing OT network segmentation and training staff on specialized monitoring tools represents an immediate risk mitigation priority.
