Flat OT networks facilitate lateral attack propagation; endpoint-level enforcement stops these movements more effectively than network segmentation alone.