Signs Your OT Environment Needs a Security Assessment

Attackers Now Know Where the Leverage Is

Industrial operators are no longer collateral damage; they are chosen because downtime hurts them most. The number of ransomware groups hitting industrial organizations has grown sharply year on year, and manufacturing absorbs the largest share of victims.

State-linked actors are going deeper. They reach critical infrastructure through compromised edge devices such as cellular gateways and VPN appliances, then mine engineering workstations for the process conditions that would trigger a shutdown.

Hacktivists keep finding internet-exposed HMIs and open Modbus/TCP and DNP3 services. None of this is novel. It works because owners often do not know the exposure exists.

The Plant Stops Even When the PLCs Are Untouched

The costliest OT incidents often begin in IT. A ransomware infection in corporate systems can halt production for weeks without a single PLC being touched, because nobody can prove the control network is clean.

A precautionary shutdown is the rational choice when visibility is missing, and it is expensive. For a large manufacturer, a single week of lost output can run into tens of millions, with losses cascading to suppliers, logistics providers and customers.

The lesson for boards is uncomfortable. Uncertainty, not malware, often decides how long production stays down. Organizations with continuous OT visibility tend to contain ransomware in days; those without it measure recovery in weeks.

Five Signs Your OT Environment Needs an Assessment

Each sign ends with a question leadership can put to the team.

1. Your asset inventory is a spreadsheet, not a live picture

An inventory compiled from P&IDs and purchase records, and last updated for an audit, is already wrong. Windows-based HMIs and engineering workstations are often logged as IT assets, which is one reason OT incidents keep being misclassified as “IT only.” Very few organizations can say which of their OT assets are end-of-life or unsupported.

Ask your team: Can we list every controller, HMI and engineering workstation at our most critical site, with firmware versions, within 48 hours?

2. Your segmentation lives on the drawing, not on the wire

Most sites can produce a clean zones-and-conduits diagram. The reality is often broad firewall rules, dual-homed servers, and “temporary” tunnels for historian replication or cross-site engineering access that quietly became permanent. Weak IT/OT segmentation remains the most common architectural finding in OT assessments.

Ask your team: When were our IT/OT firewall rules last validated against observed traffic rather than the design?

3. Remote access has grown faster than anyone approved it

Every OEM, integrator and contractor brings its own way in: a VPN account, a remote desktop tool, a cellular gateway in a remote cabinet. Shared credentials, missing MFA and unrecorded sessions tend to follow. Remote access and internet-facing systems now rank among the most frequent high-risk findings in OT assessments.

Ask your team: How many ways can a third party reach our control network today, and who approves each session?

4. “We can’t patch OT” has become “we don’t manage OT vulnerabilities”

Deferring a patch is often the right engineering call; treating deferral as the end of the conversation is not. Published severity scores are a poor guide in OT: a meaningful share of ICS advisories carry inaccurate CVSS scores or offer no patch or mitigation, and only a small fraction demand immediate action. What matters is exposure, compensating controls and process consequence.

Ask your team: For our ten highest-risk vulnerabilities, what compensating control is in place, and who accepted the residual risk?

5. Your incident response plan has never met the plant floor

OT incidents rarely announce themselves; many first surface as unexplained operational issues, such as inconsistent values or equipment behaving strangely. Yet few asset owners have clear criteria for when an anomaly should trigger a cyber investigation. A one-page runbook for each critical asset, listing contacts, safe shutdown steps and backup locations, is a practical place to start.

Ask your team: Who has authority to isolate OT from IT, and when did we last rehearse that decision with operations in the room?

The Solution: What a Credible OT Assessment Looks Like

A credible assessment is not an IT vulnerability scan with an OT label. Active scanning can crash fragile controllers, and a CVE count tells a plant manager nothing about consequence. Start with the site whose outage would cost the most per day, and insist on four things:

1. Passive discovery and site walkdowns. Build the inventory from observed network traffic and conversations with the operators who run the process.
2. Architecture tested against reality. Define zones and conduits per ISA/IEC 62443-3-2, then check every rule, tunnel and remote path against actual flows.
3. Consequence-based priorities. Rank findings by impact on safety, production and recovery, using NIST SP 800-82 Rev. 3 rather than raw CVSS.
4. A roadmap, not a findings dump. A short, sequenced plan with owners, costs and compensating controls.

Be wary of any assessment that recommends a product before it has quantified a risk. At board level, the scope is simple: know your critical assets, challenge realistic compromise scenarios, and prove you can recover.

From Periodic Audit to Continuous Assurance

Regulation is moving from policy to proof. Product-security rules now require manufacturers to report actively exploited vulnerabilities within hours, and national OT frameworks increasingly ask for demonstrable controls, not just policies. Those vendor warnings help only asset owners who know exactly which products and firmware they run.

Complexity is rising too. AI in operations, battery storage and distributed energy will multiply the blind spots of any organization that cannot monitor its OT today. I expect boards to start asking for OT risk the way they see financial risk: continuously, and in currency.

About the Author

Saad Saeed is an OT Cybersecurity and Network Infrastructure professional with over 8 years of experience in securing and managing complex industrial environments. He leads OT cybersecurity projects from assessment and design through implementation, covering IT/OT network architecture, risk and gap assessments, firewall deployment, high availability, and cybersecurity solution integration.

His expertise spans IEC 62443 / ISA-99, NIST SP 800-82, and NCA OTCC, with responsibility for technical designs, cybersecurity policies, risk mitigation, and coordination across technical teams, stakeholders, and vendors.