For years, “we can see our assets now” was the win. In 2026, that statement starts to sound like an excuse.
Three separate pieces of research landed within weeks of each other this summer, and together they say something the industry hasn’t fully absorbed yet: OT asset visibility was never the goal. It was step one. Most organizations are still standing on step one, congratulating themselves.
What the Market Has Been Saying
Bitsight’s 2026 Global State of ICS/OT Exposure report found that only 45% of organizations continuously monitor their environment to discover at-risk assets. Not “have a full inventory.” Continuously monitor. Fewer than half.
Around the same time, Forescout’s Vedere Labs published research showing ICS vulnerability disclosures hit a record in 2025: 508 advisories covering 2,155 vulnerabilities, the highest volume since CISA/ICS-CERT started tracking in 2010. The researchers were blunt about the reason it matters. A growing share of these vulnerabilities affect devices that never get properly tracked, leaving asset owners with blind spots they don’t know exist.
Dragos’s 2026 OT/ICS Year in Review adds the threat-side confirmation: more adversary groups are targeting OT, and they’re moving further through the attack chain, past initial access and into reconnaissance of actual control loops. Attackers aren’t just probing the perimeter anymore. They’re studying how your process works.
Put these three together and the market’s opinion is becoming hard to argue with: visibility without intelligence is a dashboard, not a defense.
Visibility Is Not the Same Thing as Intelligence
Here’s where we’ll put our own opinion on the table. A lot of “asset visibility” projects are just asset discovery projects wearing a nicer label.
Discovery tells you a device exists. It has an IP, a MAC address, maybe a vendor fingerprint. Intelligence tells you what that device does, what happens if it fails, who’s allowed to touch it, and whether the last change to it went through proper approval. One is a list. The other is context you can actually act on.
We’ve made this argument before: asset management is the foundation OT cybersecurity is built on, not a side project you run once for an audit. A firewall rule is meaningless if the engineer writing it doesn’t know what’s behind the IP address. A patch decision is a guess if nobody knows the firmware version or the redundancy setup. Visibility feeds every other control. Without intelligence layered on top of it, that feed is mostly noise.
Why This Gap Keeps Showing Up
Three patterns explain why visibility keeps outpacing intelligence.
Discovery tools are easier to buy than discipline is to build. A sensor on the network can populate a dashboard in weeks. Getting to engineer, operations, and security to agree on ownership, criticality, and change management for every asset takes months, and it never really finishes.
Spreadsheets still linger behind the dashboards. Plenty of organizations have a discovery tool and a separate spreadsheet nobody trusts fully. The dashboard shows what’s on the network. The spreadsheet, still, is where the “real” ownership and criticality data lives, out of sync with everything else.
Intelligence requires operational buy-in, not just IT buy-in. You can’t know whether a device is safety-critical without asking the process engineer, not the network engineer. That conversation gets skipped constantly.
What Good Asset Intelligence Actually Looks Like
Based on where the conversation has landed this summer, a handful of things separate real intelligence from a nicer-looking inventory:
- Criticality tied to consequence, not just connectivity. Knowing a device exists matters less than knowing what happens if it’s compromised.
- Change management built into the record, not bolted on. If a firmware update happens outside the documented process, the inventory should flag it, not silently accept it.
- Continuous updates, not periodic snapshots. Bitsight’s 45% figure is really a statement about staleness. A quarterly export isn’t visibility. It’s a photograph of a moving target.
- One source of truth across teams. SOC, engineering, and compliance all working from the same record, not three different versions of “what we have.”
This is also where regional compliance pressure adds urgency. Frameworks like Saudi Arabia’s NCA OTCC explicitly require asset criticality classification, not just an asset list. A dashboard full of unclassified devices won’t satisfy an auditor, and it won’t tell a SOC analyst what to prioritize during an actual incident either.
It’s worth noting this isn’t a new idea, even if the market is only now catching up to it. The SANS Institute’s Five ICS Cybersecurity Critical Controls, first published years ago, already ranks asset identification and inventory as foundational, not as the finish line. The rest of the controls, defensible architecture, network monitoring, remote access management, risk-based vulnerability management, all assume that inventory already carries operational context. The market is essentially rediscovering something SANS said plainly a while ago: an asset list without context doesn’t make the other four controls any easier to implement.
Our Take
The industry spent the last few years solving discovery. That work mattered, and most organizations are genuinely better off for having done it. But the recent research makes one thing clear: the next competitive edge in OT security isn’t finding more assets. It’s understanding the ones you’ve already found well enough to make fast, defensible decisions about them.
Organizations that keep treating asset visibility as a finished project are going to keep showing up in next year’s version of these same reports. The ones pulling ahead are the ones asking a harder question: not “do we see it,” but “do we understand it enough to act on it before someone else does.”
If you’re rethinking whether your asset inventory is intelligence or just discovery, our OT/ICS assessment team can help you find out where the gap actually sits. Get in touch with ACET Solutions to talk it through.
