Having worked in automation, OTSec adoption is in its infancy. SSO? SSL? Shared passwords everywhere, mostly root or admin. Usually walled garden approach, and once you're in, those apples are ripe for picking.